 So good morning, everybody. Thanks. Good morning, everybody, who's virtually attending. So my name's Jason Pufall. I'm the CISO for the University of Connecticut. And, you know, as I go through this, I've done this presentation a few times. We've been doing this program for the better part of two years now. So if you've got questions as we kind of progress, feel free to raise your hand. I'm happy to engage in more of a dialogue and just talk for an hour. So feel free. I'll sort of set the stage of how, you know, why we started this. About two years ago, the foundation, the University Foundation approached me and said that they had about $5,000 in a fund that was donated with the express purpose of training students in some fashion, right, as it relates to information security. So I had a funding source to sort of kick this off in a really specific directive. I sat down with a few people, student affairs primarily, and started brainstorming about what we may want to do. And it was pretty quick for us all to decide that, you know, we didn't want to just send out, you know, email and do a couple of videos. And some of the things that I think we've traditionally done with fairly mixed success. So we kind of said, well, you know, in what way do the students engage most regularly? You know, social media certainly seemed to be the most, kind of the most obvious, right? So what we decided was we would try to build something that at least took advantage of that, right, and leveraged social media to get our message out more effectively. But at the same time, we wanted that to be, you know, meaningful, right? We wanted this experience to be as interactive as possible. If we're going to put the effort into it, we wanted it to be something that we could repeat. So to this point, we have done it four times, I believe, not three times, I'm sorry, in total. So we've run it a variety of times. And we're trying to actually try different ways to see which is most successful. And I'll go through that as I work through the presentation. I think one of the things that does make this unique is that it's fairly innovative, right? We're trying to educate people through an online game that can actually assess to a degree what they've learned, leverage social media to get the word out into a broader audience. But then also sort of bring this into the physical space and have the students engage in an actual scavenger hunt. The game is primarily held online. We have not developed a mobile app, but it's mobile-friendly, right? So any device works fairly well with it. And we have a kind of a variety of what we call incentives. We weren't officially allowed to call them prizes for whatever reason. So we've got a variety of incentives that we have. The grand incentive of the first prize is $500 gift certificates to the UConn co-op. Typically, right? I thought it would be the user for books with some hope. Then there's a second and third place, and then a variety of other sort of giveaways throughout the contest. That's just a look at the front page of the website. It's improved over time. We've engaged a group on campus. We've got a digital media program on campus. So we've actually engaged the students in that program to help us with some of the marketing, some of the website design. I'm hopeful that in the upcoming semester they'll be more heavily involved as it relates to sort of the game design itself. I think the game, while it works fairly well, has a few flaws that I think we need to work out. And I'll speak to those as we go through it. I don't think I'm... there we go. So this is just an overview on what the game looks like in really simple steps, right? So you want to picture the game itself, essentially as two stages, right? There's the initial question-and-answer piece that's done online, right? So we send out a message to all the students who have actually enrolled. We've got all that information because we actually... we leverage our university, you know, NetID obviously for access. So we've got the people who play. So we send out email if they actually provide us their social media identifier, right? We'll communicate them through that as well. But typically, that's probably 50-50. Not everybody wants to do that right out of the gates. We'll send them an information that that week's question has started or that day's question has started. Give them an opportunity to read through it, do the question-and-answer, and then they'll have an opportunity to essentially post or tweet or whatever to Facebook or Twitter a pre-canned message that we'll set up, right? So if the module that week is related to password management, after they complete their initial question-and-answer, they'll be presented with a dialogue box that'll say, you know, please use strong passwords, right? Create strong passwords. That'll get posted out. And ideally, right? Our hope here is that those people who aren't playing the game actually have an opportunity to see some basic security awareness messages, right? Once they get that, they'll be presented essentially with the second stage of that module, which is the scavenger hunt portion, right? An actual on-campus scavenger hunt. The hope there, and quite honestly, I don't think it's truly materialized this way, but the hope is that we'll have hordes of kids running around looking for things creatively placed on campus. You know, hordes might be a little bit aggressive. I think we have a couple of people strolling about looking for things, but I certainly wouldn't say our engagement has been that significant yet. And then they find the place, the location that we're asking them to go to. They'll locate whatever the poster is. We put a poster everywhere. They can use a QR code to either scan in to verify that they've been there, or they can actually type in the message there. And again, another opportunity for them to tweet or post to Facebook what the security message will be. So I think that's the high-level concept of the game. You'll see at the bottom there that we've got a variety of vendors. What we've done is partner now with some of the local businesses to sort of draw them in. And I'll speak to sort of why we've done that and how that's gone over time. So that's just a picture of somebody standing in front of I think Husky Pizza, if I recall, having found the poster and preparing to scan it in. To date, we've covered topics generally around this. I think we've added a couple. We just ran another one-week version of the game in April, I think it was April 14th that it started. So we've actually added a couple of here. But we really tried, the focus for us really specifically was identify topics that were relevant and useful to students in their everyday lives. So it wasn't about me as a CISO trying to find things that I felt the university would be beneficial in teaching. I really wanted to make this as practical as I could for the students. So a lot of it really is behavior on or as it relates to social media. What to post, what not to post. The understanding that when you take pictures and you put them up there, that gives you location-based information. How to do some basic password management. How to understand, how to interact with the financial websites that they may or may not be going to. How to identify phishing. Things that are relevant in everyday life. The feedback has been pretty good, I would say so far. Honestly, the criticism that we've had has been that our questions typically have been probably too easy. So we really went down the road initially of a true and false style question and answer. I think the questions are just too easy. We've got designs on making them more complicated, but we really wanted to go through a couple of iterations of this to see what our engagement would be and get a sense. It was really interesting when people were saying that they wanted the game to be more challenging. I think what it was is your top people really wanted a way to differentiate themselves from the people that they're actually competing with rather than make this as easy, kind of as easy as we have done so far. So that's really going to be a key for us going forward is trying to make this game more challenging. Make the locations that they need to find probably more challenging if possible and kind of go from there. I think the reason I put this up here is every time I've spoken about this, one of the major questions that we do get is what are you training people on and how do you identify what the questions were? We reached out to students for a lot of these. So we've got a fairly significant student staff for just student-based technical support. We've got a student affairs run organization. I think they've got almost 130 students who work for them who specifically do technical support. So they're the ones who engage with students every day. They're the ones who have a sense for where their challenges are. So we really reached out to them. Certainly we guided them. There's some things that I specifically did want to include, but the reality is a lot of this was generated specifically from student engagement. This is really a framework. The application itself allows us to embed essentially whatever content we want in it. So we've developed some of our own videos that we created. I think we have maybe four or five videos that we created in-house that are very specific and relevant to the content that we want to train on, that references and leverages UConn and the store's location so that it drives it home that we've actually done it. We've certainly leveraged content that we found online. I mean, there's tons of stuff out there, right? Some of it's fun and engaging. Some of it's kind of dry and boring. We've leveraged both. But it's a really good framework for us to be able to embed information and actually distribute that. And I don't think, I think I took the slide out, so I'm going to go back up one more. One of the things that actually was handy for this was there was a zero-day Internet Explorer issue at one point. And we were running the game while that was going on, and we actually leveraged that as an opportunity for at least those individuals that were playing it to basically have a question and answer around zero days and something specific to that actual vulnerability. So wherever we can, we leveraged this as an opportunity to get even additional information out, and that's actually worked fairly well a couple of different times. Another nice thing that we did, and I don't believe I have it up here anymore of VPC. So we've got a pretty large deployment, a VDI virtual desktop deployment for students to use so they have access to course specific software. And as that organization, there's a half dozen people and they're responsible for delivering that service. They leveraged Husky Hunt to actually get more access to students so they could actually distribute their messages out as well, right? With some basic Q&A around how do you interact with it, how do you download the client and install it? So as much as this is a security framework, as we've gone through the last couple of years, we've had people ask us to use our medium as a way to deliver their message. And quite honestly, I'm perfectly happy to do that because if I can increase engagement and if I can increase people's interest in this game, then I have a better opportunity to deliver my message ultimately anyway, so it's completely worthwhile. I talk fairly quickly sometimes. Anybody have any questions so far? Okay. So we've also, like I said, we partnered with the Asian group, which is that digital media group on campus. I think there's about 50 students in that program right now. And as you expect, 10 of them are incredibly engaged and 40 of them aren't so much. But the reality is it's 10 people who are actually looking to try and improve upon the design that we've created to date. So it's really been great for us. Where I think we fell short, the security office fell short, the first year was really in the scavenger hunt portion, right? It's a lot of work to manage. It takes a fair amount of time to walk around, to put your posters up, to create the locations that you want and then all the associated clues to get people there. And I think what we found was that it didn't really aid that much in delivering our message, right? So I thought it would be quite honestly that my original thought was, you know, that's going to be the coolest part of the game, right? Everybody's going to want to run around and do the scavenger hunt and they're going to go out Thursday night before they go out drinking and they're going to do the scavenger hunt and it's going to be great. And they didn't, right? We also, which you don't expect, right? We had a hurricane on one of them, which promptly blew all of our posters off of everywhere we put them. So, you know, students would walk around and, you know, they'd find a poster on the ground and scan it there and they'd find one somewhere else on campus and scan it there. And the people who didn't find it, right, were all angry because they didn't get their points. So you kind of realized that that was more work than I think we had initially anticipated. But the great news was after we ran this the first year, our Husky One Card office approached us and said, you know, we're really trying to drive people out to the businesses that accept the Husky Bucks program, right? They've got their student ID, they can essentially add money to it and they can go buy pizza and things like that. So they said, can we be the people who actually leverage your scavenger hunt portion and drive people out? So they now manage that fully. So all I'm responsible for at this point really is the security content for that first part of the program. They deal with all of the vendor relationships. They deal with identifying who actually wants to participate. They'll manage whenever possible to get the posters out there. You know, we certainly work with them if they need help. But typically, once they arrive at the location, we'll still have a security message. But largely that part of the program is designed to kind of teach students what's available to them, both on-campus and off-campus, where they can use some of the features of the card, kind of what the card does. That's really been helpful for us for sort of for two reasons. The first is it took that second half of the game, it allowed us to keep doing the scavenger hunt, but it also took the burden off of us. And they were actually looking to do essentially a scavenger hunt style program. There's an app that allows you to do some scavenger hunt stuff. So it also enabled us not to have a competing scavenger hunt going on. So I think it also would have just driven people away from what we were trying to do. So ultimately, I think we've created a better product because of that. We've reduced some of our work. And I think we've reduced it and have actually lessened our effectiveness at all. So, you know, I think it was a win across. Every one of the partners, I'll call them partners, right? Every one of the vendors that we leverage does some sort of a giveaway for the first, you know, somewhere between, say, 10 and 25 people who arrive. So our goal is, you know, get this message out and then start getting people there as quickly as possible. And, you know, they time it, right? The burger place, we would announce it roughly noon, right? Because it wouldn't make sense to do that 8 a.m., right? So we try to pay attention to the people that we've got. That's clearly pretty effective. You know, people will do a fair amount of work for a free burger or for a coffee or whatever the case is. It's really interesting when we did Big Y, which is a grocery store, about five miles from campus. And the whole purpose of them doing the grocery store was to educate the students that there was a bus system that brought them down to, you know, sort of another part of town where there was things. People were irate that they had to get on the bus and go somewhere. I never expected the public outcry that I got by asking them to take a bus ride, you know. So I'll do it again. I mean, I don't think that it's not that important. But it was really interesting to see, you know, the things that I think will work versus with the reaction that students have, right? They simply didn't want to leave campus. But the vendors have been really helpful. And I think it's enabled us to do a variety of different incentives throughout the program as well, right? So rather than everything simply being something that was fun, you're either out of that original security fund that I spoke about, or, you know, since then I've obviously funded it a little bit differently. But it gives me another opportunity to create prizes for people. I think, with the exception of the pizza place, everybody said that they would do it again. At the day of the scavenger hunt, people arrived at the pizza place, and they promptly turned them all away and said they actually didn't want people there, so they didn't want to participate. So there's a variety of hurdles that you, you know, that you kind of have to work through as the game goes on. So we actually just had somebody stand outside with the poster rather than putting it on their window and dealt with it that way. But you've got some awkward things, you know, that happen that you just don't expect. So there's two pieces of this that were a fair amount of work, right? The initial application development. And actually, I'm going to point to this at the end, but I'll bring it up now as well. All of this is available if anybody wants it, right? The content that we've created, we've got packaged and it's available. The application is open source, and it's fairly, should be fairly straightforward to implement if anybody wants to, so you can take advantage of that. There'll be references at the end to the GitHub site, so you can grab that. It was designed with the idea that we, that we can distribute this. So that's really the entire intention of this, is to give you an idea of how it works and hopefully entice you to play it. And I'll give you some of the ideas of, the ideas I have for longer-term opportunities here. But I don't want to trivialize it. It's a fair amount of work, right? I can give you the application, that part's done. What I can't do for you is, you know, market it and distribute posters and get the awareness out there. And that's work. To give you a sense for it, right? We do some of the traditional stuff, right? We send email out, we put updates on that, kind of the university central listserv that then turns into a web page, right? We get information out there. How broadly, how broadly consumed that is, I can't really say. We put table tents on every single dining hall table, typically the week before the event starts. So we kind of feel like there's a captive audience there. Clearly the campus newspaper, any kind of fair or event that exists, we'll typically do that, so we'll engage with our fraternities and sororities as they go through, you know, whatever, you know, whatever events that they have we'll plant people in the student union to get people who, as they're passing by. We put placards at the bookstore so that as people who are buying books are kind of in there, they see it. We did have, yeah, we had an advertisement on the, kind of the movie theater screen, you know, as movies were to begin, but it's work. And, you know, it's really interesting. When I get through the numbers, there's a fair amount of this presentation that describes sort of the involvement they're not as good as I would think. Considering the amount of effort that we've actually put in to try to raise awareness for it, it's amazing how few people we actually get. You know, it's multiple hundreds. It's not like it's 10, but it's, you know, we're a school of, you know, over 30,000 people. I would expect to have, you know, my original hope for the first year with the 1,000, we hit that, but it's a huge lie, and I'll scribe why. But we haven't seen the numbers that I had hoped. It is work to get the information out. But you have to do it, right? We put posters up. This is just one example of them, but, you know, posters up all over the place, you know, again, you know, the most common location that people tend to convene, we tried to do that. But the downside is that, you know, when the game is over, you have to go take your posters down. And, you know, that takes time, too. So you have to factor all that stuff into it. I hired four students, typically each time we run it. They're fairly short. The first game that we ran was seven weeks. The second game was six weeks. And the last one we did was one week. And as I go through the numbers, it'll be interesting, I think, to you that a one-week game was nearly as effective as a six-week game. And I think the ability for students to sort of wrap their head around doing a one-week game and find a way to schedule that is much easier. So we'll speak to that as well. We paint to the rock, right? We've got a rock on campus that everybody paints. I think the rock was probably this big 25 years ago, and now it's, you know, now it's that big. You know, that was painted by that Asian group. It lasted about 12 hours before a fraternity then promptly painted over it. So, you know, that's another one of those challenges, right? You go through the effort of doing it only to see it last for 12 hours. It could have been four days, right? You certainly see things last that long. So we kind of, we didn't get the exposure there that we had hoped at that as well. We're going to try to turn this more into a class project for that Asian group, rather than have it be, you know, helped if you can. I think the goal here would be to actually identify it as one of their, you know, two or three project opportunities and see if we can get some legitimate and official engagement that way. We have a program called the Freshman Year Experience, and I think we're going to involve ourselves in that more. We do have some faculty in computer science who actually want to add this or make it a requirement for some of their classes. So we're seeing now some faculty engagement, which is really great. You know, Greek life, a few are great and a few don't care at all, but we've certainly had some engagement there which has been really nice. Some of them have actually required that for their pledges as they go through it. So, you know, there's some different opportunities there, right? And, you know, Army ROPC, it was interesting when we approached them. They just treated it like, you know, they should be mandatory institutionally, so they just had all their guys do it, right? So depending on the group you go after, you certainly get a different response. So here's a sense of what we've seen in numbers. The graph on the left here represents the first year. And, you know, I think, you know, what stands out, obviously, is that we've got more female than male players. About 1,500 people, roughly, right? This is the, whoops, this is the second year, so you can see the numbers are very different, right? So if we got about 1,500 people here and we've got, you know, about 500 there in the second year, and there's the exact numbers, the 1,500 is just not accurate. So we actually had 1,500 people sign up. What happened was, and this is another good thing to think about, I was disappointed with the turnout after, say, maybe the first or second week where I really felt that I'd see kind of a bigger participation level. So we sort of met and decided, you know, we're going to offer a referral program. We're going to let people, I think if they had referred either 10 or 15 people, right? We'd give them a coupon for an ice cream at the dairy bar. And we didn't really think it through particularly well. So yes, people referred, and lots of people joined, but nobody played at all, right? Because it was simply an opportunity for the, for one, I have to give her credit, one girl who managed, who had tons and tons and tons of friends to refer hundreds of people, get tons of ice cream coupons and then promptly have nobody actually play the game. So, you know, it's a really good example of sort of changing your directions midstream, only to realize that you really needed to think that through better, right? 567, though, is a real number. So the second year when we actually went through this, we had 567 people sign up and actually play the game. Of those, the people who went through it entirely, right? We only had 17 people that first year. We had 22, the second year. Still not staggering numbers, right? So you figure sometime within the, between the first week and say the sixth week, right, we lost the majority of our players both times, right? But 82 was better and I think it was encouraging enough for us to see even throughout the game, right? The increase in participation in general. We also saw more people play, you know, play at least a module, right? Again, not staggering numbers, but we're seeing an increase and I think people are starting to understand what the game is all about. This is probably for me one of the most interesting slides, though. So the first year that we created the game, we made it mandatory that you either had to follow us on Twitter or like us on Facebook and you had to retweet. I didn't understand really how students just did not want to be forced to do something like that, right? It's a really simple thing, right? The goal for me is to get the message out as broadly as I can. I'm really simply asking them to click the, you know, we'll say post button, right? People don't want to do that, right? They want to control the content that's on their Facebook page or that they're tweeting, right? They don't want to have somebody else controlling it for them. So there was a lot of resistance for it. So the second year we made it optional, right? You can see, right? We had fewer players and, you know, three and a half times the amount of tweets. So it was really interesting to sort of back off that and see the engagement increase and the willingness to participate increase. I think this is fairly self-explanatory, right? But this is a brief overview on the Facebook versus Twitter and you can see they're fairly close, right? Going forward, I think our goal will be to add some of the other social media outlets that people use. This was just something that we could develop fairly easily. Once we got it in place on it, we focused more on improving the game than trying to figure out how to engage people through other mediums because we know these are the most common ones right now. The social media piece reaches really important to us and that's something that we spend a fair amount of time on. There's a simply measured site and there's a variety of these things, right? There's social bro, there's a whole bunch of places that you can measure social media engagement. The basic number that we've used is people have about 200 followers between this age range, right? 18 and 21. So if you look at some basic math 184 people played at least a module and posted about 200 followers. So depending on how you want to look at it even if you say only 20% of the people actually may have looked at what people posted, we reached somewhere in the neighborhood of 7,300 people, right? Assuming that every single person they looked at it then we got significantly better engagement but clearly we know that that's not true. But we know that even with a small amount of people, a small pool of people actually playing the game, we have an opportunity now to try to reach more people and that's worth it to me, right? So we ran a game that we didn't notice, right? I think this is the six-week game. On April 14th of this year we decided to run a spring game and we debated a lot about how long to do it, right? We had gone anywhere between one week and we never made it to the sixth. We were going to do about four. We really found it challenging in the spring semester to find a four-week period where there wasn't some other distraction or spring break or something like that that would distract from the game. So ultimately we decided to do it in one week and literally do a module per day. So we're basically trying to get the same amount of content out but in a much shorter time frame, right? Let me just pop here really quickly. So we had 181 people play at least a module, right? So if you go back to the 111 with 184 we had 181 people play. The engagement was good. We had 320 tweets. 316 people versus I think it was 564 if I remember our numbers correctly. 181 users. We had 50 people play through it far enough to get to the grand prize. So really it was less work for us. It wasn't significantly. You still have to do all your advertisements. You still have to distribute your posters. You still have a lot of that work. But the amount of time that we had to concentrate on it was less. We got the same content out there. We have, I believe, as good a participation and as good a reach and it kind of ends quicker. So I think going forward we'll certainly do this in the spring. We may do a two week game come October for Security Awareness Month, right? But I don't think we'll go down the road of doing a four or six week game again because I don't think that it actually we need to. And if you look, whoops, wrong button. We've got a very similar I think it was 7300 roughly before and 7200 for a one week game. All the numbers that we see I think really tell us that we should just sort of continue down this path and try to improve a shorter version. So what went well, right? Certainly the partnerships that we've developed over the last year have been really effective. It's made it easier for us. It's reduced some of the potential competition because I knew there were some people out there trying to do it. It's certainly given the security office exposure which has been great and a broader exposure to a group of people that isn't my most significant security risk but I think being in higher ed we have an opportunity and kind of a duty to educate. My job just can't be focused on data protection and all the associated risks there to the degree that I can educate students I think that's my responsibility. So that's really been great. We're seeing growth in players which I think is a positive. More players are completing more modules so even in that one week session we had more people make it at least halfway through than we did in other times. I think partly that's due to the fact that it's a shorter game and they can keep their attention on it a little bit better. We developed some back end administration so it's now much easier to add content and modify questions and do things like that so now I can actually hand this to a student and simply say here's the five basic steps you need to do to add content or modify things and they can do that easily where before it was all my sequel back end and I needed an actual admin to do the work so those days are gone. Unfortunately I think I took my what went poorly slide out and I'll speak to that out of fairness. I think as much as much marketing as we've done I think there's got to be a better way to do it because for an institution our size and the participation that we've had I feel we must be doing something wrong. We're not reaching people effectively in us. I think one of the other issues that we've got is the program as it's designed right now doesn't extend itself to our branch campuses so we've got our main campus and stores but then we've got a decent sized population in the five other locations that I can't really reach very well so we've designed the scoring to enable those students to participate in the online portion of it and be eligible for the grand prize but the reality is there are points that are awarded for completing this scavenger hunt and so I think it provides a disincentive for those students because they realize it's going to be challenging for them to actually go through another issue that we've got and this is a and this is another this is definitely an issue you can see I'm incredibly technical so one of the other issues that we have is I lost my train of thought trying to plug my laptop back in but I'll come back to that then so I I think there's some things that we definitely have to fix though so there we go the scoring right now we're capped so there is a maximum amount of points that you can earn if you were to do everything so every time that we run this we've got a tie and we have been drawing for the grand prize we need to find a way that people can truly differentiate themselves if they want to because every time if there's 300 people or 500 people or whatever so you have a bunch of people who play a little bit and participate but then you've got a group of people who want to win and we haven't provided them a good opportunity to simply win to play the game to its completion and then actually get your grand prize based on a drawing I think is kind of a bummer and we really have to figure out how to deal with that I think we'll probably experiment with sort of random opportunities throughout the game to earn points maybe some real time based things where we'll announce at noon and if you don't answer within five minutes you won't have an opportunity to win points possibly we'll do something where points degrade so you start off with 20 potential points and if you answer within the first hour you get to full 20 and any time after that it degrades it's been more of a coding exercise which is why we haven't done it yet so we thought about this a little while ago I think that that could work and I think the benefit to us would be if you really have these random opportunities to earn points I think you'll actually stay a little bit more engaged in the game which is the hope so we'll probably look to design that in the upcoming session and hopefully we'll see some benefit out of that I might be a little bit ahead here but the site is github, Yukon ISO Husky Hunt if you're looking to download it we're going to create a wiki hopefully with all the training materials that we've actually got I'll come back to this because I think there's one so there's a couple of future plans that I want to deal with as well but I'll leave the second slide up because I can speak to all of that it was mentioned at the beginning that we created a higher ed security council in Connecticut there's about 24 higher ed institutions and my hope there is that we can actually develop so far I've had some interest I haven't had anybody commit yet I'm hoping to do an inter-university or inter-college challenge where you actually then can try to leverage some school spirit in this whole thing and say listen, represent Yukon don't just win for yourself there'll be an opportunity to win for yourself but represent the university against Yale or against Quinnipiac or whatever it is and there'll be some challenges there simply because the size differences Quinnipiac is smaller than Yukon so we'll have to do it for percentages but I see some real opportunities there to actually over the security awareness week leverage an inter-university competition I think that could really be that could really be fun especially because I think we have a head start so we're bound to win so that's one thing I definitely want to do I want to figure out a way to train faculty and staff using this so we put effort into the tool so far and we are typically opposed to mandatory training we've got some mandatory ethics training to date I've had no success in getting a mandatory security awareness training program in place but I do have a variety of support from the CFO and some of the different VPs where I think I could actually do that inter-department competition concept within Yukon so where I'm not actually forcing anybody to do it and there's downsides to that too if you start mandating and then you have people who are non-compliant you have to figure out what the ramifications of that are and I'd rather avoid that for now I'm really interested in trying to get people to do this willingly if I can get people to do this across the department actually find some sort of prize for that department which shows the greatest participation or the greatest involvement I'd like to do that so I'm hopeful that I can actually pull that off we did put on there that our future plan would be two hunts per year so we've done that I fully expect to continue down that road but I do think we'll do shorter hunts because I think it actually it certainly looks like it is as effective in its less work and that's the end of my presentation and that gives hopefully an overview and hopefully one or two of you think this is good enough that you actually want to try and download it and use it are there any questions? I don't know anybody I asked the instructors to find anybody who wanted to take it on they created it and everything was kind of like there you go I'll paraphrase that your question is how do you keep those students who are doing this as part of their class not once you're paying how do you keep them engaged after the class is done after they've received their grade this answer is going to be terrible the first session the first time that I've actually had an opportunity to work with them I don't know what your experience has been I can say that I know the faculty member wants to leverage this over multiple semesters so they treat it as a cohort in our environment so the same class is going to move across multiple years so I think the idea there would be simply that we give it to one cohort and we let them kind of run with it and I think the opportunity for me there would be I don't have to continually train people what the concept is and you know have all these new ideas that may or may not actually sort of dovetail with what I want to do conceptually once you have that one group working on it I'm hopeful they'll keep doing it so I think that's the expectation there so Thank you for your presentation I'd like to ask what have you I know this is student centric and it's a great idea what are you doing for staff and faculty what creative ideas do you have for that so the creative part is the challenging part of your question so for faculty and staff we've got the same in securing the human stuff we've broken that down into a variety of different course modules depending on what the business unit is so we definitely do that we also leverage that same training curriculum for anybody who needs access to data so we've got the data custodians group in our data classification model so depending on what your needs are we'll have people go through that training I do a lot of in-person training essentially where I'll visit schools or colleges or departments and do some specific security awareness training we there's a whole other topic but I'll spend one second on it we created a program internally called secure you secure it with the letter u the university and the goal of that really was was almost 100% focused on the end user workstation and PII remediation initially but then as the program grew it became a much larger project around sort of active directory consolidation rebinding, centralizing some of the work file services migration there's a whole variety of things that were part of that program and we became very systematic about it so every single department that we worked with part of it there was a two hour training session that either I or one of my colleagues would do and that was really valuable and I think we ended up doing maybe 30 departments to date so we've been doing it for about a year so there's a lot of in-person stuff that we do I'm hopeful that we can leverage this I think that will be the next step for me is to try to figure out a way to kind of keep information flowing but using this medium if I can so I don't know if that's very creative necessarily, probably more pragmatic but to be fair, I think staff is probably the most valuable place to spend your efforts, that's where a lot of your risk is and I don't know quite honestly if I would have started this if I didn't actually have some seed money and it felt like a shame to not take advantage of that and once we came up with the idea ideas are easy, then all of a sudden you realize how challenging it is to implement it and it took a while to get this program off the ground but it was not nearly as smooth as it is now but it's been kind of fun at the same time so are there any other questions? Yes Jason, I have a couple first, the prizes that you mentioned that you gave were they donated? Did you have a budget for that? How did you work that? So the first year we did it out of the foundation pool since then we fund the amount out of my budget from the ISO it's about a thousand dollars roughly after all is said and done so it's not a fortune and we distribute it so you've got your grand prize which is pretty significant your second prize I think is a hundred dollars so then you've got a fair amount of money to play with as it relates to ice cream and things like that and then clearly the vendors now are providing stuff and it's interesting the things that kids want I mean we had Sam's which is like the little convenience store on campus literally they gave away employee shirts so it says Sam's on it and it's red it's fairly unattractive and we had kids line it up for t-shirts and you think it's like a dollar but they really wanted it so kind of anything free we've done some of your basic fluorescent sunglasses and those types of things as sort of little treats iPhone holders general trinkety stuff we had a we didn't have a tie for our grand prize but one of the kids said I had the same points and you just drew it and that kind of stinks so the five hundred dollars for the grand prize we gave this kid an iPhone holder he said that's great so having stuff is helpful and I can tell you that my students that helped me with security awareness one year they said don't give away bookstore give away Walmart gift cards or Starbucks coffees and the coffee goes a long way too we'll keep working with Dunkin Donuts and the associated caffeine vendors so my second question is I always got dinged on online distance students how can they participate do you have any plans or any ideas about that? so there's so it's essentially for me to be the same way that I think I want to address the remote campuses right we have thought about leveraging the directors of those campus to actually distribute stuff for us but I'm pretty confident that will be challenging so we may try and move part of the scavenger hunt at least online and actually start looking for things different places on the internet which might be interesting we could just do a security awareness piece which is solely online focus and I'm not trying to do the scavenger hunt but honestly if I can avoid that I would rather I think the scavenger hunt is kind of fun so to the degree that we then maybe embed things and there's an opportunity there so if I can drive people to different locations I'll call it on the internet but likely there'll be things like university policy or residential life information or things that I think would be relevant to the students anyway I think we may actually do that and there's some opportunities for me to work more closely with our student affairs area to get some of that done so I could see some things there great thank you is there anything else? yeah no okay well I appreciate everybody's time this morning I hopefully found it valuable hopefully somebody downloads it and if you do feel free to let me know and I'm happy to answer those but thanks and enjoy the rest of the conference