ABC’s of Securing
Educational Networks
Presented by
Jonathan Bitle
Technical Director, Qualys, Inc.

Data Protection Challenges for EDU
• Network Design
– Student (Open)
– Faculty
– Operations
– Research/partnerships
• Budget, or lack thereof…
• Time
• Headcount
2

Data Protection Challenges for EDU
3
COMPANY CONFIDENTIAL

Anatomy (of an EDU exploit) 101
• REPORTED: April 9th, 2009
• INSTITUTION: Penn State
• DEPTH: 10,868 Social Security Numbers
• SECURITY EFFORTS: Malware detection per host
Privacyrights.org
4

Economics 101 - Security vs. Clean-up
• Industry estimates of cost per customer record for clean-
ups
– $90 to $305 per customer record
– Costs vary depending on whether the breach is “low-profile” or
“high-profile”, regulations, and state privacy requirements
• Forrester estimated the cost at $70-$80 per record
– This is just for discovery, notification and response including:
Legal counsel
Call centers
Mail notification
5

Knowledge is power…
• Identification
• Separation
• Prioritize/Classify
• Audit
• Educate up and down
• Remediate
• Monitor
• Too much?
6

Keys for Success
• Automation
• Integration/API
• Simplicity
• Delegation
7

Q&A
Thank You
Jonathan Bitle
jbitle@qualys.com