University of Washington

From the UW Chief Information Security Officer The UW Office of the Chief Information Security Officer promotes a culture of information security and privacy. Services are designed to help UW units understand risks by analyzing and forecasting threats to information security, researching applicable information security and privacy laws, providing education on safeguarding institutional information, consulting on incident management, and managing policies and strategic solutions for UW���s institutional information. More info ciso.uw.edu In reflecting back on all our hard work during 2012, I would like to recognize the support and confidence provided for us by Kelli Trosvig, Vice President and CIO, UW Information Technology. The whole CISO team is grateful for Kelli���s clear and constant concern for the information security and privacy issues that we wrestle with every day. Her encouragement, trust, and support has been a significant factor in the success we���ve enjoyed in meeting our goals. The Office of the CISO understands the extraordinary value of and the opportunities provided by evolving information technology. Those opportunities ��� such as improving the student experience, gaining efficiencies in operations, and enabling advancements in research ��� are enlivening and inspiring. Nimble mobile technology, powerful hand-held devices, and ever-faster network speed are creating the expectation for access to anything, from anywhere, at any time. As we enjoy this increasing accessibility, we must be mindful of important concerns and challenges related to protection of privacy, regulatory compliance, and keeping business operations safe from disruption. It is the job of the Office of the CISO team to understand these challenges and to help the University community successfully navigate them. This keeps us busy. Our staff members strive to stay informed, engaged, and active throughout the entire University. We thrive on challenges; challenges are our job. We wouldn���t trade jobs with anyone. Kirk Bailey, UW CISO Table of Contents Asset-Based Risk Management.............................................................................................................. 1 Credits 2012 Stats, Seminars, and Accomplishments................................................................................... 2 Data Loss......................................................................................................................................................... 3 UW Office of the CISO Social Media Guidelines............................................................................................................................ 3 PROJECT COORDINATION: Melissa Albin-Wurzer UW Security and Privacy Policies........................................................................................................... 3 WRITING: Melissa Albin-Wurzer, Kirk Bailey, Geolocation and Location Services...................................................................................................... 4 Suzanne Blais, Zephyr McLaughlin, Ann Nagel, James Poland, Daniel Schwalbe, Braden Vinroe EDITING: Melissa Albin-Wurzer, Kerry Kuenzi, Encryption...................................................................................................................................................... 4 In the Shadows: The Black Market Value of Your UW NetID........................................................ 5 Becky Skiver Thompson Passwords....................................................................................................................................................... 6 PHOTOGRAPHY: Melissa Albin-Wurzer, Portable Storage Media............................................................................................................................. 6 Braden Vinroe Business Travel.............................................................................................................................................. 7 UW Creative Communications FSO and CISO Collaboration.................................................................................................................... 7 DESIGN: Karin Mellskog 2012 Consulting........................................................................................................................................... 8 2013 Goals and Seminars......................................................................................................................... 9 A

• Cover