University Business - September 2009 - (Page 38)

DATA principal security strategist with IBM Internet Security Systems. Unfortunately, security isn’t the only thing placing demands on technology oﬃce budgets at colleges and universities. Yet at least the economic situation hasn’t wrecked havoc on IT budgets. While general budgets across campuses are suﬀering, IT budgets will remain ﬂat, predicts Nicole Engelbert, the lead analyst of education and vertical markets technology for Datamonitor, an online data, analytic, and forecasting service. “IT is too mission critical at this Safe Computing 101 ‘You can’t just put a ﬁrewall up and think you are protected.’ —Bryan Mehaffey, Ave Maria University point and is generally seen as a key tool for doing more with less.” She also predicts that breaches in higher ed aren’t going away anytime soon. “ e fundamental problems are more human than technical,” she says. Student demand for “anytime, anywhere” access to information is forcing people to change the way they think about network security, Corman notes. “ e old guard is about protecting the network by closing it oﬀ, while the new generation wants change. Security has to shift from the reason you can’t to the reason you can.” At the same time, the nature of threats to networks is also changing, partly because institutions are better about addressing some aspects of security—such as not allowing unsecured personal computers on campus—and partly because the motivation behind the threats is diﬀerent. Combating hackers who are just having “fun” can make a campus IT director’s life diﬃcult. “Some people creating viruses are doing it as a hobby,” says Bryan Mehaﬀey, vice president of technology at Ave Maria University (Fla.). “I have a budget, but they can go as long as they are interested.” Layers of protection are necessary to stop attacks, which might each require a separate solution. “You can’t just put a ﬁrewall up and think you are protected,” Mehaﬀey says. However, not all viruses are created just for fun. For the ﬁrst 20 years of cyberattacks, people wrote viruses to gain prestige and notoriety, but for the last ﬁve years politics and proﬁt have been the motivation, Corman explains. Hackers have always taken advantage of the open access and ample storage available on university networks to cover their tracks. Since cybercrime has become a major money-making opportunity, it is more important than ever for institutions to secure their networks, Corman says. “ e stakes have gone up, the activity isn’t as benign. at creates an obligation and an opportunity to clean up your network.” 38 | September 2009 reat Assessment In addition to securing the network, the eﬀort to educate users on safe computing practices must continue. “I believe what we are fundamentally lacking is a ‘stop, drop, and roll’ type of cyber-education,” Corman says, referring to the famous ﬁre safety instructions. He suggests including safe computing practices in 101-level classes and teaching programmers how to write code properly, not quickly, as good places to start. e sentiment is echoed by Steven Song, a security business manager with Cisco. Adversaries are always launching more sophisticated attacks, while user education might not be keeping pace. “People know not to open attachments from unknown sources, but links aren’t viewed with as much skepticism,” Song says. Some institutions are already working on the initiatives the president called for. CyberWATCH is a consortium of higher education institutions, businesses, and government agencies in Maryland, Virginia, and Washington, D.C., with the mission of improving the quality of the IT security workforce through the sharing of curriculum and professional development opportunities. A partnership between the public and private sectors has long been necessary because of the commercial solutions being used to protect networks, explains Brian Darmody, associate vice president of Research and Economic Development at the University of Maryland. As a member of CyberWATCH, the University of Maryland created a digital forensics lab that other consortium members can access remotely for real-time demonstrations, notes Gerry Sneeringer, UMD’s director of IT security for the oﬃce of information technology. “Our institution focuses on the research end of the equation,” Steps to Take universitybusiness.com http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - September 2009

University Business - September 2009
Table of Contents
Editor's Note
College Index
Company Index
Advisory Board
Behind the News
Viewpoint
Money Matters
Human Resources
Data Lockdown?
Getting Press
Multicampus Planning: Behing the Scenes
Radial Reformer
Community Colleges
End Note

University Business - September 2009