Social Security Number Replacement

1
Social Security Number Replacement

• Efforts are underway in support of the immediate
  focus by the University Administration on the
  elimination of the Social Security Number (SSN)
  in all but those systems and processes that
  require this identifier.
• -- Sr. VPs Mace, Burgess and Landrum

2
Mitigating SSN Use

• SSN use poses tremendous security risk
• Understand your risks and responsibility
• Begin elimination of SSN ASAP
• EITS has initiatives underway to assist

3
Stages of SSN Mitigation

• Determine which systems and processes may use
  SSNs
• Examine these to quantify use, purpose and risk
  factors
• Communicate this to department and university
  leadership
• Address risk appropriately

4
Supporting Initiatives
5
Identity Management

• Provide comprehensive record of identities
• Reduce the number of IDs handled
• Tools to assist in removal
• Web interface to translate SSN to other
  identifiers
• A database for translation
• Connectors to automate translation
• Verification of users over the phone

6
SSN out of the Core

• Remove SSNs from Mainframe Systems
• Discover, Assess and Remediate
• Discovery Phase Pilot (Payroll-W2)
• Create Plan and Implement
• SSN-CAN Translation table

7
SSN out of Distributed Systems

• Remove SSNs from Distributed Systems
• Identify the use of SSN in Distributed Systems
  (ASSETs)
• Generate a prioritized list
• Formulate plans to mitigate SSNs from High-Risk
  Systems

8
ASSETs

• Report servers with SSNs in ASSETs by June 15th
• Provide to SSN Use Committee to prioritize risk
• Risk will be communicated to University leadership

9
SecureUGA

• CAN the SSN Awareness Module
• ASSETs Training Classes
• SSN Discovery Tool Training
• IDM Tools Training

10
Support by stage of mitigation
SecureUGA
ASSETs
SSN out of Distributed
ID MGMT
SSN out of Core
SSN out of Core
11
Scope by System Classification
12
Roles and accountability

• Dean/Department Head
• Responsible for Unit risk
• Define security roles within the unit
• Unit IT Leadership
• Execute departmental security program
• Unit Security Liaisons
• Identify Report SSN Risk
• EITS
• Provides supporting infrastructure tools
• Assistance Middleware Team, Application
  Solutions Group

13
Timeline

• ASSETs go-live May 15th
• CAN the SSN module May 26th
• Training classes Dates forthcoming
• ASSETs data entry Jun 15th
• IDM tools available Aug 1st