University cybersecurity: Different, but still the same
Connecting state and local government leaders
Academic environments are built around sharing information, but securing their networks — and the mobile devices that use them — calls for the same layered approach other organizations use.
Universities are shoring up their cybersecurity strategies amid a rising wave of attacks on their networks. Schools from the University of North Carolina to the University of California at Berkeley have doubled the size of their IT staffs and/or budgets in order to address the problem.
A challenge many say university IT managers face is striking a balance between protecting sensitive information while allowing the open sharing of information characteristic of educational institutions. “A university environment is very different from a corporation or a government agency, because of the kind of openness and free flow of information you’re trying to promote,” David Shaw, Purdue University’s CISO, recently told the New York Times
But although a university network may be set up differently than a government agency’s, when it comes to security, “I’m not sure if they really do differ,” said Will Pelgrin, president and CEO of the Center for Internet Security and former chief cybersecurity officer for New York State.
CIS works with universities as part of its cybersecurity programs for the public and private sectors. Pelgrin said there are differences in how university admins handle their infrastructures — such as separate administrative and student-focused networks — but security is largely a matter of dealing with the same essential challenges any other organization faces: understanding the environment and finding a secure way to deliver services.
And as with any other enterprise, that means a layered approach, combining security policy with technologies such as firewalls, antivirus and intrusion detection software. And an increasingly important step is deploying encryption of all those laptops, tablets and smartphones on campuses. “We’ve become such a mobile society,” Pelgrin said. “Data used to be static … and now we carry most of that information on us on a 24/7 basis.”
Encryption, however, is a potentially knotty issue, because the burden ultimately falls to the users. And that puts the emphasis on education. “Training and awareness is really essential,” Pelgrin said. After all, students and faculty members may want to protect their own intellectual property just as the university wants to protect sensitive information, and research teams want to protect new technologies. So they need to understand the importance of good cybersecurity hygiene and how it can protect information while allowing them sharing it. “Students and faculty need to realize that the steps are not to limit their right to free expression but to enable them to do it,” he said. “Cybersecurity can really be an enabler.”
On the administrative side, college and universities have bought in, exploring ways to boost security while maintaining a robust academic environment. “The old folklore that universities didn’t want to have cybersecurity because they wanted to have free speech,” doesn’t hold, he said.
It’s an evolving mission, and universities and other organizations are considering newer methods as well, such as using hosted services in the cloud to provide security, and big data techniques and analytics to detect, and possibly even anticipate, malicious behavior.
As for sharing documents and data with colleagues at other institutions, Pelgrin recommends the Traffic Light Protocol, a simple but effective method for sharing information that is not classified. TLP is used widely in Europe and has been adopted by the U.S. Computer Emergency Readiness Team and the Multi-State Information Sharing and Analysis Center, which Pelgrin founded.
A person sending a document marks it with one of four colors: red, amber, green or white, each one designating the limits on what recipients can do with it. Red means the document is only for the recipient. Amber means they can share with other people in their organization, but only on a need-to-know basis. Green means it can be shared with other people and organizations within a community, but not through publicly accessible channels. And white means it’s available for unlimited distribution, such as posting on a website, though subject to copyright controls.
It relies on the honor system (and it’s not cybersecurity, strictly speaking) but Pelgrin pointed out that the vast majority of people within an academic, state government or other community want to do the right thing. “In 10 years of using this with the Multi-State ISA, we’ve never had a breach of confidentiality,” he said.