Six essential steps to secure academia

Computer networks in the academic world are a lot like the Wild West: It's hard to tell the good guys from the bad, and the sheriff's ability to maintain order is severely limited.

The long list of data security breaches reported since early 2005 is heavy with the names of such academic institutions as San Diego State University, Ohio University, the University of California at Berkeley; Boston College and Tufts; George Mason University; the University of Northern Colorado; and Purdue University, among many others.

It's a world all too familiar to Stan Gatewood, CISO for the University System of Georgia's Board of Regents.

Georgia's system is much the same as other university settings. Maintaining open access to information is paramount, whether it's a Web page students use to access class schedules, an e-mail portal faculty use to communicate assignments or a database researchers rely on to store and access highly sensitive information.

Meanwhile, students, professors, outside contractors and others are constantly showing up on campus with their own computers -- some secure, others full of unpatched flaws and still others that are used to probe the network for weaknesses to exploit.

The information at risk in this environment is immense: financial aid and health records, credit card numbers used in the college bookstore or cafeteria, proprietary information relating to sensitive research being done on campus, and so on.

"We deal with tremendously unique and varied access needs, and the biggest challenge is identity management -- properly identifying and classifying individuals," Gatewood says. "It's tremendously hard to coral everyone and balance their needs with the security needs in one area."

There's also a growing challenge with mobile security, since students and faculty never stay in one place but still need access to the campus network. They need identity and access credentials that will move with them, he says.

While no security program is 100-percent successful in meeting these challenges, Gatewood lives by a six-point plan that has served his institution successfully thus far. In a recent interview, he outlines those steps:

Step 1: Risk management No matter how much he learns about information security, Gatewood says the main lesson always comes back to an organization's ability to manage risks and threats. He advises security pros in academia to hammer out a formal risk management program outlining how to lower risk to an acceptable level. "You have to inventory machines, pinpoint high-risk, medium-risk and low-risk systems, then consider the specific risks to each," he says. "You need to be able to express the risk with actual numbers. You need to inventory each identity, categorize and rate them; then deal with countermeasures." Developing a risk management plan cannot be done with a set-it-and-forget-it mentality, he says. Organizations must start from scratch and repeat the process every year, and getting upper-management support is essential.

Page Break

Step 2: Policy and compliance management Academic institutions have to comply with many regulations and industry standards, from HIPAA to the PCI Data Security Standard. Gatewood says a formalized group policy and compliance program is essential, and must outline the ramifications of not complying with the rules.

Step 3: Strategic planning and leadership No organization can achieve security on the fly. To that end, Gatewood is a big proponent of strategic planning and having specific people take the lead in specific areas. "You must map out specific goals and how you will get there -- we're starting here and going to point B, C, and D. Here is the roadmap to get to where we need to be, not just for IT but at the strategic level." Meanwhile, he adds, "You need someone at the helm who is experienced, educated and driven."

Step 4: Community awareness training and education University security leaders must educate contractors, staff, students and faculty on security awareness, where the dangers are, the what, why and how, Gatewood says. Universities need an official program that speaks to those points.

Step 5: Proper incident response and reporting Security pros must always remember that things are going to happen despite the best-laid plans. When that's the case, organizations need to be able to respond in a standardized way. There must be a high degree of confidence that an individual will respond to an incident properly without fear of their job or how bad they'll look, he says. The plan needs to account for the risk level and criticality of the incident at hand.

Step 6: Contingency planning. This step goes hand in hand with Step 5, Gatewood says, adding, "Bad things happen. No one at the University of LA thought something like Hurricane Katrina would happen. You have to know what to do when these things take place, make sure you protect the human element, and that you have backup systems.

Academic security pros speak out

The challenges Gatewood outlines and the steps taken are similar to those experienced by others in the academic world. CSOonline.com surveyed several administrators on their biggest concerns. Here are some of the responses:

Kevin Hardcastle, information security officer at the Washington University School of Medicine: "In my case, I provide information security and risk management for the medical school campus which has a completely different focus from our main academic campuses. Not only do we have various regulatory requirements to consider, we also must be able to allow the free flow of information not covered by those requirements. I quickly see a move back to the basics: establishing clear data classification, building layers of security and policies based on those classifications and a constant communication plan. Human factors will always be the most challenging aspect of this job. You cannot just throw a tool in place to solve smart people behaving badly.

Page Break

Slade Griffin, security engineer at Sword & Shield Enterprise Security: "I spent almost 10 years working in both secondary and higher education. The challenges presented are numerous and no one thing can currently be blamed. I would say the most persistent challenge for IT security personnel is culture and the resistance to change. More than once as an IT security framework was being developed necessities got bogged down in the "endless meeting" cycle. Much talk of change would often result in no change at all in order to accommodate a very small portion of the population. Attempts to make rules exceptions often spiraled out of control until IT security was moved out of the umbrella of network operations where the CIO, or equivalent, did not face a conflict of interest concerning security and convenience. On the other hand I have also seen IT security personnel attempt to become big brother with no accountability to any person or group other than themselves. Overcoming the challenges in academia is a delicate balancing act which must be situationally dictated to the given environment."

Bryan Murphy, information security analyst at Michigan State University: "I have found that governance and policy are difficult to implement. If a specific policy is approved its "enforcement" section is always a fluffy copy/paste from the union handbook. Teeth are difficult to build in given academic freedoms and staff unionization."

Matthew Lye, senior computing support officer at Griffith University in Australia: "I've found the largest problem is you don't have a large degree of control over user desktops in academia when compared to a business environment. As a result you end up with very little ability to protect users from themselves in regard to data leakage. ID management tends to be reasonably standardized and easier to control as long as they don't keep using post-it notes to keep their passwords and IDs on their monitor or whiteboard."

Peter Anderson, CSO at Computer Systems Center: "I don't know if ID management solely address the data leakage issues within academia. I can only speak to where academia collides with national security. The fundamental problem of controlling access to highly sensitive information and potentially highly destructive technology while allowing the academics to publish their research and collaborate amongst their peers has been long standing. Balancing the "publish or perish" mentality of academics and the classifying information demands of the US Department of Homeland Security (DHS) is a cultural problem that has plagued this community for a long time. Identity management coupled with a suite of technologies such as access management, entitlements, and digital rights management can provide capabilities that limit and control the sharing or collaboration amongst the peers in a protected manner. These tools working together will drastically limit the leakage or the second-hand sharing that tends to take place."