statewide it, infosec and privacy update · \爀屲exchange online, and is designed to improve...

$: Statewide IT, InfoSec and Privacy Update · \爀屲Exchange Online, and is designed to improve security, eliminate redundant infrastructure and optimize sy對stem efficiency. South$
Statewide IT, InfoSec and Privacy Update

September 2019

Recent Successes of Shared Services $71,000 per year for agencies as well as $1.2 million in cost avoided by not

operating the DTO Print and Mail facility. Internet and Network

Up to 67 percent savings for DTO Internet service; Up to 25 percent savings for DTO MetroNet service; Up to 78 percent savings for DTO MetroNet MPLS service.

SLED and DIS partnership to enhance security Email Standard

Presenter

Presentation Notes

The state’s IT resources are safeguarded, in part, through a partnership of between the South Carolina Law Enforcement Division (SLED) and Admin’s Division of Information Security (DIS). SLED’s “Critical Infrastructure Cyber Security Program” concentrates on enhancing private and public critical infrastructure and key resources while DIS is responsible for ensuring the security of state agencies. Exchange Online, and is designed to improve security, eliminate redundant infrastructure and optimize system efficiency. South Carolina is not the only state to choose a such a solution, as 40 others have commercially-provided cloud-based systems in use, with more than 80 percent of those utilizing Microsoft. As an added benefit, Microsoft was already being used by 53 of the 74 state agencies, thus leveraging the significant investment already made in this solution.

IT Self-Service Portal

Benefits: Easy access for self-service

Transparency for checking status

Foundation for future portal capabilities: forms automation, knowledge, etc.

New IT Self-Service Portal

Overview: OTIS is currently piloting a new

IT Self-Service Portal.

This will allow selected Agency IT roles to submit IT requests and issues directly into ServiceNow without contacting the DTO Service Desk by phone or email.

This will also allow access to view open tickets and history for the agency.

Portal Functionality Submit new IT Requests online with simple

interface.

Report any IT issues without having to call or email DTO service desk.

Check Status of any open tickets across the Agency.

View History and download past Agency Incident / Request information.

See any Announcements about Major Incidents / Outages.

Use Quick Links to reset passwords.

Submit and Update Tickets Directly Into ServiceNow

IT Self-Service Capabilities

Service Level Reporting

Benefits Provide: A data driven approach to harvest ServiceNow and monitoring information.

Visibility for service performance and trends.

Automation to reduce manual data aggregation and reporting.

Overview: OTIS has been building out the next

generation approach for expanding service level capabilities.

Earlier efforts focused on identifying priorities for service level coverage from ARM Board members.

Based on this input and available data, new dashboard models have been built out.

Realizing IT Shared Services Benefits

Utilizing IT Shared Services — IT Shared Services Video South Carolina Department of Public Safety

https://365sc.sharepoint.com/portals/hub/_layouts/15/PointPublishing.aspx?app=video&p=p&chid=f332073b-6800-4635-a163-ae2d90e3ae91&vid=8196f48d-dad0-4e5e-b114-f67023b5fd2e&from=2

InfoSec Update System Configuration Baseline Purpose

The primary goal of the State’s System Configuration & Baseline Standards Program:

Leverage industry-recognized standards

Alignment to system data classification

Consistent approach to system hardening

Objectives

The objectives are to:

Establish a minimum system configuration baseline

Reduce risks inherent to system default configurations

Implement continuous monitoring for security, compliance and assurance

CiscoMicrosoft

Google

Mozilla

VMWare

Red Hat

IBM Industry standard

configuration guidelines

Oracle

Presenter

Presentation Notes

Manufacturers deliver systems with default configurations that are aimed at usability rather than security. To mitigate the risks this presents, the State of South Carolina’s standard expectation for system minimum-security baseline standards is the Center for Internet Security (CIS) Benchmarks. CIS provides configuration security baselines covering a lot of widely used technologies. Additionally, this direction aligns with SC-DIS 200 requirement 13.200 for Configuration Management. CIS Benchmarks are provided in two levels for most technologies – Level 1 and Level 2. Level 1 settings are expected to be practical items that provide a clear security benefit when applied as recommend but would not inhibit use of the technology or product being configured. Level 2 extends the Level 1 profile meaning Level 1 settings are included. Level 2 settings are used in environments where security protection such as data and system integrity and confidentiality are most important. Level 2 settings ay negatively impact the expected performance of a service or technology. As a general best practice, all recommended security configuration baselines should be thoroughly tested for impact prior to applying to production systems. DIS maintains a Bi-Annual lifecycle for baseline certification; this process ensures that all agencies are on a single version of the respective benchmarks. This will also help ensure continuous monitoring solutions are maintained at the correct versions for standardization.

Audit & Assessment Program The primary goal of the Audit and Assessment (A&A) Approach and Procedure

is to establish an A&A process that is: Standardized

Framework agnostic

Integrated with risk management

Adaptable across Agencies of varying sizes, types, and maturity levels

DIS will use the program to assess agency compliance starting this Fiscal Year

Privacy Update Privacy Assessment Tool (PAT)

Web based central repository for privacy impact assessments (PIAs)

Automated workflow

Available at no cost to agencies

Contact the Enterprise Privacy Office at [email protected]

Privacy Training on SCEIS MySCLearning Available now

Information Privacy Basics for State Employees

Contact SCEIS for deployment to your agency’s workforce.

Multifactor Implementation (DUO) Implementation across multiple platforms

SCEIS DTO provided services

Desktop; Email; VPN; ETC. Replaces Safenet VPN services Federated model will be available to all state agencies Communications will start soon with implementations starting early 2020

Cloud Services State’s Background and Objectives

Develop a standard approach for cloud management

Increase resiliency and reliability

Put in a methodology for on-boarding state agencies

Enhance financial transparency and accountability around the consumption of IT services and Security postures

Activ

ities

• Team Mobilization• Discovery Interviews & Workshops• Create Target State • Gap Analysis (including 3rd party tools)• Project Risk Assessment• Preliminary Application Suitability Analysis• Organizational Readiness Assessment• Design Meetings & Workshops

• Enterprise Service Provider Build• Security Requirements Build• Broker Platform Build• Cloud Operation Organization Design• Process Development & Modifications• Communications • Training Build• Documentation Build

• Support of the Cloud Brokerage System• Execution of System Enhancement

Requests• Continuous Monitoring

Del

iver

able

s

• Target State• Gap Analysis• Implementation Designs• Implementation Project Plan• Project Roles & Responsibilities Matrix

• Working Cloud Brokerage Platform• Azure & AWS Enterprise Cloud Services • Operational Run Books• Broker Client Training / Onboarding• Training Curriculum• Cloud Operations Organization Design

• Financial Reporting• Security Reporting• Provisioning of Cloud Environments• Performance Management

Out

com

es

• Agreed Upon Solution Design• Prioritized Implementation Roadmap• Cross Functional Alignment Between Work Groups

• Functioning State Cloud Broker Capability• State Capability Awareness for Agencies• Cloud Governance and Transparency• NIST 800-53 Moderate

• Cloud Operational Excellence• High Agency Satisfaction Levels

Strategic Implementation Operations

Cloud Platform Roadmap

Questions?

statewide it, infosec and privacy update · \爀屲exchange online, and is designed to improve...

Documents