(gentle strumming music)
- Let's just suggest that there are a litany of issues
facing higher education when it comes to cyber security.
First and foremost is the sheer volume
of digital assets that we collect, produce,
distribute, share, manage.
Many of those assets have extraordinary value
to individuals, not only within the education community,
but outside of the education community.
The sheer volume of intellectual property that we produce,
it's not just valuable to those of us in higher education,
clearly, but also to nation state actors.
- Really, the bad actor attacks
and the threat environment that's out there,
the security operations teams at our universities
are very busy because they're just continually
being subject to attack and I think
just trying to make sure that we're
staying on track with that is very, very difficult.
- The ongoing threat landscape is growing more complex.
Threat actors can actually buy
attack kits on the black market for pennies on the dollar
and do extraordinary damage to us.
- And what's happened is, is that the bad guys
have shifted from wanting that kind of information
to sell for identity theft and they've
shifted to a more nefarious kind of role
and what that role is,
is general information about you, specifically
and thus the rise of the chief privacy officer, right.
So that information they're using,
say to tip elections or to go after
even particular issues.
That kind of weaponization of social media
like we saw in 2016 is a paradigm shift.
- Internet of things devices are great,
but they are really pushing the barrier
far more towards convenience over security.
When the Internet of of things devices
are used by individuals that cannot or won't patch
and apply security updates.
In many cases, a lot of the vendors don't
make them available to consumers
just because the device is
so inexpensive in the first place.
So those devices are on the Internet
for convenience purposes and our students
want to control their electric lights, you know,
they wanna have an electronic doorbell
on their dorm room or a video doorbell
and these are devices that really are
outside of the administrative domain
of our control and we really don't know
what they're doing on our network.
So we can mitigate that risk only to a certain extent,
but they can also be leveraged for distributed
denial of service attacks.
- And the other thing on the information security side
that just is continuing to grow
is our compliance obligations.
We're just starting to see every year another step up
in terms of a new obligation that we have
when it comes to compliance, you know.
Whether it's our local compliance
on our campuses or with our board of trustees,
to our state and our state auditors
and our regulatory compliance and then the national level
with all of the different compliance that comes there.
It just is continuing to grow
and both the security operations area
with that widespread threat actor
and you know, threat vectors that come in
as well as the compliance,
just keeps those departments enormously busy.
- It's growing increasingly more difficult
to hire security professionals
to get them properly trained,
to retain them in our environment.
When you compare the need for really qualified people
with the threat landscape,
we have a very complex task to work with.
- Additional security threats for higher ed.
include password reuse, that's a big one
in that I may choose a really strong password,
but if I reuse it on 10 sites,
if it's breached on one site,
I can use it on all the other nine
and that's a huge issue.
Really it's a security awareness education piece
that is, we don't really make it easy for our users,
like for, historically for years, we've chosen passwords
that were hard for users to remember,
but easy for computers to crack
and especially as computing power increases today,
we really need to have users understand
why they need a better password
to prevent these kinds of attacks.
- The other one I'd say is cloud.
You know, from a technical perspective,
the move to the cloud is, you know,
freeing, that's gonna really enable
a lot of optimization of resources in a lot of institutions.
On the other hand, if you don't do it smartly,
we're all gonna suffer some massive breaches
at the end of it if we don't do it
in a way that makes sense.
- The larger you are, the more you're scoped
to content with research as one of your core missions.
The more complex you are,
it's not just teaching and learning,
it's research and it's also community service
which means we're an open environment.
We welcome people from all over the world
and yet, it is highly likely that
someone is going to cross our path
who may not look at us as their best friend, so to speak.
So we have to worry ourselves about, you know,
some of the potentiality of a threat actor
crossing our path because they took advantage
of our open environment.
(cheerful gentle music)