1. Planning for the Inevitable: IT Crisis Preparedness Linda Sharp CoSN Project Director IT Crisis Preparedness SchoolDude University 2009

12. Security Planning Process SchoolDude University 2009 Outcome: Security Project Description  goals  processes  resources  decision-making standards Phase 1: Create Leadership Team & Set Security Goals Outcome: Prioritized Risk Assessment A ranked list of vulnerabilities to guide the Risk Reduction Phase Phase 2: Risk Analysis Outcome: Implemented Security Plan Risk Analysis and Risk Reduction processes must be regularly repeated to ensure effectiveness Phase 3: Risk Reduction Outcome: Crisis Management Plan A blueprint for organizational continuity Phase 4: Crisis Management

13. Security Planning Grid SchoolDude University 2009 Security Area Basic Developing Adequate Advanced Management Leadership: Little participation in IT security Aware but little support provided Supports and funds security Aligns security with organizational mission Technology Network design and IT operations : broadly vulnerable security roll out is incomplete mostly secure seamless security Environmental & Physical: Infrastructure: not secure partially secure mostly secure secure End Users Stakeholders: unaware of role in security Limited awareness and training Improved awareness, Mostly trained Proactive participants in security

16. Disaster Planning SchoolDude University 2009

26. The worst case scenario . . . SchoolDude University 2009 No Plan!

61. Consortium for School Networking SchoolDude University 2009 www.cosn.org www.cosn.org/itcrisisprep

62. Thank you Sponsors SchoolDude University 2009