iProtect - Sempra Energy Information Protection

	Vigilance Award for Information Security
	"Protecting things of value from harm."
	2007 Recipients Greg Brown Greg Brown has been selected for the VIGILANCE AWARD for Information Security as a result of his efforts to take action to significantly reduce information security risk and to actively promoting an information security-sensitive culture. As a software developer on Smart Meter, he goes above and beyond his current responsibilities to ensure that application development and integrations are secure, including compensating controls when a particular solution won't completely solve the problem. He ensures that end to end security is achieved. He provides information security assistance to other portions of the Smart Meter program outside of his scope or responsibility. He helped select Technology security vendors, security SOW reviews, security evaluations of technology solutions, etc. Greg has led security collaboration forums consisting of multiple organizations and project teams to discuss security topics and share materials developed across team boundaries. He continually promotes security to other Smart Meter teams and educates them on the important roles non-security professionals play. For example, he integrated into the Smart Meter business architecture team the Information Owner role (responsible for classifying company information) which they originally did not perceive as their responsibility. He has also helped them define processes to identify Information Owners and perform information classification correctly. Josh Gerber Josh Gerber, an IT Architect, has been selected as a result of his efforts to recognize an opportunity to protect company information security assets, take action to significantly reduce an information security risk, and actively promote an information security senstive culture. Josh understood that Smart Meter security issues represented significant seriously threats to our customers, company, San Diego, and the country and these threats were compounded by multiple software components (LAN, HAN, CPU) and remote disconnect functionality, which, if unchecked, could be used to cause wide-scale blackouts. After alerting his management, he took the initiative to investigate these issues and communicate them to employees and vendors. He made contacts in this specific security area in order to begin a dialogue with security experts in the field. He convinced Smart Meter management to hire experts in the security field. He co-authored a white paper on the threats to raise awareness of the issues. He held special security meetings with each vendor finalist to ensure they understood our concerns and would take action to alleviate them. Josh went against conventional wisdom to support increasing the amount of security review of our Smart Meter solution. He has also reached out to other utilities and raised awareness with SCE and PGE. Dave Inglehart Dave Inglehart has been selected for his work to recognize an opportunity to protect company information assets, take action to significantly reduce an information security risk, and to actively promote an information security sensitive culture. Dave is a Senior Infrastructure Technologist who is involved in most all projects concerning the use of Active Directory (AD). He asks security-specific questions of every project that relies on AD in order to ensure they provide the appropriate protection necessary to protect the company's enterprise infrastructure. He asks hard questions and provides secure solutions. When a client wanted to integrate with AD in a particularly insecure fashion, he approached it from a "big picture" information security perspective and did not allow them to jepardize the company's enterprise infrastructure. He volunteered to work with the client on a soluton that would minimize the company's risk while allowing the client to meet its bsuiness needs. Dave recognizes when projects require attention from Information Security and coordinates those efforts with IS. Dave promotes the value of information security and brings disparate teams together to solve security-related problems. He carries that information security mindset to every project he works on, frequently speaking to information security topics when talking to other groups. Murali Vasudevan Murali Vasudevan has been selected because of his ability to recognize an opportunity to protect company information assets, take action to significantly reduce an information security risk, and actively promote an information security sensitive culture. During the implementation of consolidator functionalities for the eServices applications for both SCG and SDGE utilities, Murali played a major role in ensuring that protecting residential customer information was the highest priority. Murali is an avid advocate for secure online applications. He leads by example, taking action to reduce information security risk for both newly developed functionality as well as operational aspects of systems already in production. Murali defined and implemented BMC security rules to protect the My Account Online Bill Pay applications from threats by making sure the BMC tool reviews log files and database records and notifies IT support groups of suspicious activities. Murali keeps himself informed of security trends and then applies and promotes this knowledge to his design and implementation work at Sempra. He never hesitates to share his knowledge of latest practices in web application security with his team to ensure systems are less vulnerable to security attacks. Murali conducts design and code reviews with developers and makes sure that they follow robust design and implementation from a security perspective.

	Contact Information
	For further information, please contact Christopher Vera.