How To

Six Essential Steps to Secure Academia

Networks in the academic world mirror the Wild West, where data protection is an uphill battle. CISO Stan Gatewood explains how he pulls it off in six essential steps

By Bill Brenner, Senior Editor

September 12, 2008 — CSO —

Computer networks in the academic world are a lot like the Wild West: It's hard to tell the good guys from the bad, and the sheriff's ability to maintain order is severely limited.

The long list of data security breaches reported since early 2005 is heavy with the names of such academic institutions as San Diego State University, Ohio University, the University of California at Berkeley; Boston College and Tufts; George Mason University; the University of Northern Colorado; and Purdue University, among many others.

It's a world all too familiar to Stan Gatewood, CISO for the University System of Georgia's Board of Regents.

Georgia's system is much the same as other university settings. Maintaining open access to information is paramount, whether it's a Web page students use to access class schedules, an e-mail portal faculty use to communicate assignments or a database researchers rely on to store and access highly sensitive information.

Meanwhile, students, professors, outside contractors and others are constantly showing up on campus with their own computers -- some secure, others full of unpatched flaws and still others that are used to probe the network for weaknesses to exploit.

The information at risk in this environment is immense: financial aid and health records, credit card numbers used in the college bookstore or cafeteria, proprietary information relating to sensitive research being done on campus, and so on.

"We deal with tremendously unique and varied access needs, and the biggest challenge is identity management -- properly identifying and classifying individuals," Gatewood says. "It's tremendously hard to coral everyone and balance their needs with the security needs in one area."

There's also a growing challenge with mobile security, since students and faculty never stay in one place but still need access to the campus network. They need identity and access credentials that will move with them, he says.

While no security program is 100-percent successful in meeting these challenges, Gatewood lives by a six-point plan that has served his institution successfully thus far. In a recent interview, he outlines those steps:

Step 1: Risk management
No matter how much he learns about information security, Gatewood says the main lesson always comes back to an organization's ability to manage risks and threats. He advises security pros in academia to hammer out a formal risk management program outlining how to lower risk to an acceptable level. "You have to inventory machines, pinpoint high-risk, medium-risk and low-risk systems, then consider the specific risks to each," he says. "You need to be able to express the risk with actual numbers. You need to inventory each identity, categorize and rate them; then deal with countermeasures." Developing a risk management plan cannot be done with a set-it-and-forget-it mentality, he says. Organizations must start from scratch and repeat the process every year, and getting upper-management support is essential.