University Business - September 2007 - (Page 64)

The good news is that the cost to implement a new security training program is minimal, says Bixler. “The real cost is maintaining the content and keeping it current,” she says, since they already have the tools available to deploy it. Possible Patches Conducting an audit is certainly one way to systematically identify where the security weaknesses are and what kind of training can be done to address them. But some universities seem fairly clear about their own weaknesses and are looking for solutions, or patches, to correct them. One major security gap that many universities mention is the unauthorized download of sensitive data to laptops or through unsecured data lines, potentially exposing that data to misuse by outsiders. That threat was identiﬁed at Coppin State as a key issue, so six months ago the university proceeded to buy and install Pointsec for PC, which provides data encryption. The university’s policy now requires that anyone using a campus-provided desktop or laptop must use Pointsec for protection. Pointsec not only encrypts and decrypts all laptop data and ﬁles, but also information on removable media, such as USB devices. But just as important, the software requires a login ID and password to boot the laptop—Pointsec is loaded ﬁrst. Without it, the laptop cannot be turned on, nor can the hard drive be removed and used—they are useless. Coppin State is still in the process of rolling out Pointsec campuswide, starting with its high value users, including the IT staﬀ. Installation and training required to implement Pointsec involves one hour to load the software and a half-day investment on the part of an IT staﬀ member, followed by 30 minutes of one-on-one training of system users. “We have been pretty successful so far,” says Doddanna. A seven-step plan for protecting conﬁdential data To aid higher ed institutions in implementing policies, processes, and technology to safeguard conﬁdential data, EDUCAUSE/Internet2 Security Task Force working groups developed the following roadmap: 1. Create a culture that is aware of security risks and threats. 2. Deﬁne institutional data types. 3. Clarify roles and responsibilities for safeguarding conﬁdential data. 4. Reduce access to conﬁdential data. 5. Establish and implement stricter controls for safeguarding such data. 6. Provide awareness and training. 7. Verify compliance routinely with established policies and procedures. For resources and guidelines for each of these steps, visit https:// wiki.internet2.edu/conﬂuence/display/secguide/conﬁdential+data +handling+blueprint and download instructions and case studies. be one of them. “You get security training as a new employee [at Embry-Riddle] but someone who’s been here for a few years doesn’t Training Buzzwords ever get retrained,” she says. “And that’s a huge weakness.” When describing the security training their institution currently Bixler hopes to implement a new online training process as provides, or is in the process of implementing, many campus IT part of a new employee training program she is designing that will leaders use the words “awareness” and “reminder.” Recognizing that provide a means of tracking which faculty and staﬀ members have one-time campuswide training sessions are not enough to secure completed the training and which haven’t. sensitive personally identiﬁable informaThe university currently has no way to verify tion, most colleges and universities are that someone has actually gone through the scheduling follow-up training for employtraining, she explains. ees who may need a refresher regarding While the system audit will certainly Blackbaud, www.blackbaud.com/ their role and responsibilities as it relates pinpoint processes, policies, and proceproducts/industry/highered.aspx to SIS data. dures that need improvement, Bixler is also Campus Management, www. “The biggest risk at many organizations working toward a change in the university’s campusmanagement.com is not the core system, it’s the employees,” culture and attitude toward data security. Datatel, www.datatel.com/results/ says Bixler. “Security is everyone’s job.” enrollmentmgt/ “Identity theft is a foreign concept to [most EDUCAUSE, www.educause.edu faculty and staﬀ]. They don’t think it could Marcia Layton Turner is a freelance writer happen to them,” she says, and so they unOracle, www.oracle.com/industries/ education/highered.html and the author of 14 business and consumer derestimate the importance of the security books. She lives in Rochester, N.Y. training Bixler wants to introduce. Resources 64 | September 2007 universitybusiness.com https://wiki.internet2.edu/confl uence/display/secguide/confidential+data+handling+blueprint https://wiki.internet2.edu/confl uence/display/secguide/confidential+data+handling+blueprint https://wiki.internet2.edu/confl uence/display/secguide/confidential+data+handling+blueprint http://www.blackbaud.com/products/industry/highered.aspx http://www.blackbaud.com/products/industry/highered.aspx http://www.campusmanagement.com http://www.datatel.com/results/enrollmentmgt/ http://www.datatel.com/results/enrollmentmgt/ http://www.educause.edu http://www.oracle.com/industries/education/highered.html http://www.oracle.com/industries/education/highered.html http://universitybusiness.com

Table of Contents for the Digital Edition of University Business - September 2007

University Business - September 2007
Contents
College Index
Company Index
Advisory Board
Editor's Note
People Watach
Sense of Place
Viewpoint
Human Resources
Money Matters
Financial Aid
Community Colleges
Una Fuerza to Reckon With
The Right Stuff
Making an Impact
Going VoIP
Training Your Staff to Protect SIS Data
Summer Conference Report
Business Technology
What's New
Calendar of Events
End Note

University Business - September 2007