The Ponemon Institute, a cybersecurity research firm, reported that each lost or stolen record cost educational institutions an average of $246 last year. And that’s not just with students as universities operate like a small town, with operations, research, health, finance, and transportation departments. A good SRM strategy focuses on identifying the highest impact threats. According to an article from Educause, there are three different types of threat/risk categories: High, Moderate, and Low. So where do you start to create a plan? First, think of security as a team sport. Gartner recommends to: “Implement broadly supported and effective security policies and practices at your institution by establishing a comprehensive planning and governance group. It should be composed of a variety of stakeholders, including students, faculty, finance, legal and HR, that consider programs for mitigating risk, building trust, protecting student privacy and using data in an ethical manner.” Gartner then recommends, “Objectively identify the strengths and gaps of your current security plans by using a variety of frameworks (such as National Institute of Standards and Technology, International Organization for Standardization/International Electrotechnical Commission 27001/27002, COBIT and ITIL) or third-party providers for assessing the current state of your program.” Third, you must invest in cybersecurity training for students, faculty, and staff. No matter how stable and secure your network and infrastructure is, there is always one thing to consider --- the human factor. The best example of this occurrence is through phishing or its more sophisticated counterpart, spear-phishing. Spear-phishers often disguise themselves as trusted sources or entities asking for a simple task, like paying an invoice or replying to an email. Gartner goes on to further recommend to, “adopt security and privacy policies that enable faculty, staff, and students to control what personal data is collected and on what legal grounds that processing takes place. Lastly, you must evaluate current practices and methods used for collecting and storing institutional data.
As with all matters in higher education, there are bound to be constraints when it comes to security and risk management. From limited funding to regulation and laws, to finding the right talent and governance. There are many factors to consider when implementing a security risk management plan. Yet if these factors aren’t considered and dealt with, cyber attacks on universities will become ever more frequent and damaging. Meeting this challenge requires strategic planning and cybersecurity thinking. One solution is to implement a BPM to handle workflows and internal processes. Make sure your BPM software provider has security at the top of the mind too. It should have clearly laid out plans for data encryption, user authentication, application security, internal systems security, operating system security, database security, server management security, reliability and backup, and disaster recovery. Additionally, be sure that your BPM solution has experienced, professional engineers and security specialists dedicated to data and systems protection.
