IT Briefing June 20, 2013Goizueta Business SchoolRoom GBS-234

20-JUN-13

IT Briefing Agenda

• ServiceNow Update & Demo• Service Desk Update

• ColdFusion 9 Update• Office 365 Update• Core Router Update• Security Update

• Luc Dalla Venezia• Sharon Gregory, Anne Marie

Alexander, Kathy Hayes• Kevin Chen• Scott Swann• Mike Politinsky• Brett Anderson

2

20-JUN-13

ServiceNow Update

Luciano Dalla VeneziaIT Service Mgmt Specialist II, ITSMO,

Integration

3

20-JUN-13

Which is better?

4

OR

20-JUN-13

5

20-JUN-13

6

20-JUN-13

Highlights & Next Steps

• Users without Roles will go directly to new Self-Service page

• There is a link for ITIL users– Under Self-Service Application: ESS-Homepage

Timeline:• Current Sprint Activities – next 2 weeks

– Complete final development– Develop communication and marketing

7

20-JUN-13

ServiceNow Update

?Questions

8

20-JUN-13

Service Desk Update

Sharon GregoryManager, Service Desk, Enterprise Services

Anne Marie AlexanderManager, ID Management Team, Integration

Kathy HayesBus Analyst II, Faculty Services, Academic

Technology Services

9

20-JUN-13

10

Password Resets

Self-service

20-JUN-13

11

Password Resets

Desktop – 6,41925.72%

Voice Service – 4,07516.33%

Password Resets – 4,10116.43%

Total Tickets Created by Service DeskSeptember 2012 – May 31, 2013

24,953

20-JUN-13

Teamwork – Tier 2 to Tier 1

13

Blackboard

UTS Client Services

Vidyo Desktop Paging/Mobile Messaging

Law School Service Desk

AmCom Mobile Connect

Unified Messaging

Lync

More Coming Soon

20-JUN-13

Teamwork

• http://youtu.be/0Q8DriPCX2o

14

20-JUN-13

Knowledge Centered Support

15

Knowledge

“Knowledge is the key that unlocks all the doors. You can be green-skinned with yellow polka dots and come from Mars, but if you have knowledge that people need instead of beating you, they'll beat a path to your door.” Ben Carson, Think Big: Unleashing Your Potential for Excellence

(gifted neurosurgeon famous for his work separating conjoined twins)

20-JUN-13

16

??

?

???

??

20-JUN-13

ColdFusion 9 UpdateMigration to the New Architecture

Kevin ChenSr. Manager, Integration Operations, Integration

17

20-JUN-13

18

The Migration is Done

20-JUN-13

• All CF sites migrated to the new architecture in April

• 113 ColdFusion sites

• All CF tags and functions working

• ColdFusion7 servers decommissioned in May

19

20-JUN-13

The Hero is….

Gerry HallWeb Hosting

UTS

20

20-JUN-13

ColdFusion 9 Update

?Questions

21

20-JUN-13

Office 365 Faculty/Staff/EHC

Scott SwannProject Manager II, PMO

22

20-JUN-13

Office 365 Faculty/Staff/EHC

• UM – Voicemail in the cloud• Archiving in the cloud• 2013 Blue Version• 2-Way Trust• First Wave implementation

– UTS project team, then the rest of UTS– Emory College– Oxford– Theology– GBS– LAW

23

20-JUN-13

Office 365 Faculty/Staff/EHC

?Questions

24

20-JUN-13

Core Router Update

Mike PolitinskyManager, Network Engineering, Infrastructure

25

20-JUN-13

Migration of Wireless to New Core Routers

26

20-JUN-13

27

20-JUN-13

IT Security Update

Brett AndersonSr Information Security Specialist, Information Security

28

20-JUN-13

IT Compliance Initiatives

2012-2013 Compliance Initiatives

• HIPAA Security Assessments – Used an automated Compliance Management tool

(Archer)

• PCI Data Security Assessments– Used SSC-approved web tool called Navis

29

20-JUN-13

HIPAA Security Assessments – WHY?

30

ü Criminal PenaltiesØ $100-$50,000 / violationØ Possible Prison time (1-10 years depending on the situation)

ü Authorizes state attorney general to bring a civil action in federal district court against individuals who violate the HIPAA rules.

20-JUN-13

HIPAA Security Assessments – WHY?

31

20-JUN-13

HIPAA Security Assessments – HOW?

32

20-JUN-13

What is ePHI?

33

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is aggressively enforcing the HIPAA Privacy and Security Rules regulating the use, disclosure and protection of health information Protected Health Information (PHI).Protected Health Information (PHI) is any information, whether oral or recorded in any form or medium, that….

(1.) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse and;

(2.) Relates to: ü past, present, or future physical or mental health or condition of an individualü the provision of health care to the individualü past, present, or future payment for the provision of health care

(3.) And can be used to reasonably identify an individual____________________________________________________________________________________________ ePHI is protected health information (PHI) that is created, stored, transmitted, or received electronically. All protected health information (PHI) is subject to HIPAA regulation.

ePHI

Geographic Subdivisions(smaller then state)

Phone Numbers Fax Numbers

Electronic Mailing Addresses

Social Security Numbers

Medical Record Numbers

Hea

lth P

aym

ent

Info

rmat

ion

Patient Name +

RxNumber +

Patient Name +

Address + Drug NameHealth Plan Beneficiary

NumbersMedical Device identifiers &

Serial Numbers

Certificate / License Numbers

Biometric Identifiers

Full Face Photographic Images

Vehicle identifiers & Serial Numbers

Internet Protocol (IP) Address Numbers

Any other unique identifying number, code etc

Web Uniform Resource Locators (URLs)

Device Identifiers & Serial Numbers

Account Numbers

Dates related to an Individual(other then year)

Doctor > Patient

Test Results

Health Plan

Lab Results Emailed

Examples

18 Identifiers

+

+

Social Security # +

Health information + IP Address of Individual’s Home

Patient Name + Reason for Visit

Pat

ient

Id

entif

icat

ion

Bra

cele

t

Demographic information about a patient contained in EHC (power chart / millennium)

Patient Note + Stored on PDA or Mobile Device

Photo of Patient

=

20-JUN-13

HIPAA Security Assessments – ePHI?

34

ePHI

ePHI Inventory• Applications• Servers• Workstation

Logical Storage

• Shared Storage• Backup Storage

Physical Storage• Hard Drives• Smart Cards

In ScopeSearch & Secure

20-JUN-13

HIPAA Security Assessments – Results

• 100% Participation – 328 unique Assessments– Thousands of servers, workstations, network devices,

mobile devices, and facilities inventoried and assessed• Where were most of these findings?

– Security management processes, audit controls, and training

Largely Successful!

35

20-JUN-13

PCI Security Assessments – WHY? Ø The Payment Card Industry Data Security Standard (PCI DSS) is a set of

requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment

Ø Essentially, any merchant that has a Merchant ID must adhere to these standards

Ø The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of Payment Card Industry (PCI) with focus on improving payment account security throughout the transaction process

Ø Emory is a Level 2 – We process > 1 million credit card transactions / year

Ø Major fines associated with non-compliance

36

20-JUN-13

PCI Security Assessments – WHY? Ø What is Cardholder Data and what can you do with it?

37

20-JUN-13

PCI Security Assessments – How? Ø Office of Debt and Cash Management in conjunction with Enterprise Security

conducted PCI Assessments.Ø Merchants were required to provide information regarding how they process

credit cards. This resulted in a required Self Assessment Questionnaire (SAQ).

38

20-JUN-13

PCI Security Assessments – How? Ø Office of Debt and Cash Management in conjunction with Enterprise Security

conducted PCI Assessments.

Ø Merchants were required to provide information regarding how they process credit cards. This resulted in a required Self-Assessment Questionnaire (SAQ). (4-5 month process)

Ø Depending on how you process depends on your PCI Compliance requirements.

Business Process + Technology Components = Level of Compliance

SAQ ASAQ BSAQ C

SAQ CVTSAQ D

39

20-JUN-13

Security Update

?Questions

40

20-JUN-13

Thank you for coming!

41