High-level context for a Research group IT Risk assessment

• Similar to CIT Security office Security Assessment and disaster recovery
• Offer to do this
• Enable Computing Rep to do this
• Just inform, assess, not enforce anything

Benefits

• Cost (what do we mean by this?)
• Image (what do we mean by this?)
• Prevent loss of science
• Pre-audit – be in compliance when audit happens

What would be included?

• Physical access to systems, data
• Accounts management
• Backup
• Data recoverability
• Intrusion detection
• Critical operations
• Emergency preparedness
• Machines
  • Inventory
  • Individual assessment
  • Age / potential for failure
  • Applications and os updates
  • Virus likelihood
• Clusters
  • Accounts management
  • Remote access / ports
  • Failure recovery
  • Backup & Archive
• Network / remote access
• 3rd party issues --access, recovery, restriction, location / country of storage
• Personal machine risks
  • Infections spread to CU Machines
  • Wipe out CU Data
  • Users steal data