With the explosion of the number of cyberthreats, higher education institutions are struggling to secure their IT infrastructures in the face of limited budgets and staff. Add to this the decentralized nature of these institutions, and you have a recipe for cyber disaster.
To effectively protect against cyberthreats in the face of these obstacles, colleges and universities must take a centralized, integrated approach to cybersecurity that increases visibility across your entire IT infrastructure, reduces risk, and drives efficiency. Identity and Access Management (IAM) enables all of the key components of this approach—that’s why it should be at the core of any university security program.
Unprepared and Vulnerable
While higher education institutions are great at educating the next generation of leaders, they are not always as good at securing their own IT infrastructures. In fact, more than three-quarters of educational institutions surveyed by Netwrix said they are unprepared for IT risks.
The survey found that the most neglected security areas are BYOD, unstructured data, and employee activity.
Close to half of respondents reported security incidents as a result of human behavior, while more than one-third experienced security incidents resulting from malware. Thirty-five percent of respondents said that they are dealing with tightening requirements for data protection.
In this environment of growing cyberthreats, why do educational institutions continue to be unprepared?
One factor is lack of IT staff. A disturbing 72 percent of respondents stated that they did not have a dedicated employee responsible for IT security. Another related reason is lack of money. More than three-quarters of respondents cited lack of budget as the reason they haven’t taken a more efficient approach to security.
Additionally, many institutions said they did not have enough time to properly address security or that senior management was insufficiently involved in addressing the problem.
Decentralization: The Greatest Obstacle
While higher education institutions face a number of challenges that prevent them from effectively addressing cybersecurity threats, the biggest obstacle is the highly decentralized nature of their infrastructures. University systems are comprised of large numbers of colleges, departments, and offices—meaning that the responsibility for university security is usually decentralized as well. Each college or department often has its own policies, procedures, and security tools.
This approach can make higher education institutions easy (and lucrative) targets for cyberattacks.
Wanted: An Integrated Cybersecurity Approach
To protect their infrastructure with limited IT staff, money, and time, higher education institutions must take an integrated, university-wide approach to cybersecurity that maximizes protection and minimizes cost—more bang for the buck.
With an integrated approach, the various security components work together to protect all systems, system accounts, and the data those systems hold across the entire university.
However, this is easier said than done. Implementing an integrated cybersecurity approach means overcoming decentralization and getting everyone across the university on the same page—starting with gaining the provost and board of trustees’ support for a more robust IT security program. They must understand the potential security ramifications of a decentralized approach.
Once that support is secured, you should conduct an assessment of where things stand today in your environment by using the National Institute of Standards and Technology’s cybersecurity framework as a baseline. This not only enables you to identify security gaps, but it also provides a roadmap for addressing those gaps.
Then, you need to develop a risk management plan, which includes making changes throughout the system and breaking down traditional silos.
Five Key Security Components
This EdScoop article identifies five key areas to focus on when implementing an integrated cybersecurity approach. We’ve laid them out for you here and added our take about how IAM solutions can aid your efforts in each of these areas.
1. Governance and Compliance
Higher education institutions need to develop a set of governance and compliance rules to manage their decentralized IT environments. All parts of the infrastructure need to follow the same rules, and people should know where and how to report security issues, receive training and guidance, and share information.
Modern Identity and Access Management (IAM) solutions offer comprehensive identity governance capabilities that make it possible for institutions to centrally implement and manage current business rules, policies, and procedures around identity and access controls and ensure they are consistently enforced across the entire university system. Furthermore, IAM solutions are critical for enabling institutions to maintain and demonstrate compliance.
2. Access Control
Access control is crucial to an integrated cybersecurity approach. Institutions need to put in place access control policies that lay out who has access to what information when.
Here, too, IAM solutions are critical. Modern IAM solutions were designed to help institutions define, manage, and audit granular access controls for all users, university-wide. A good IAM solution makes possible centralized and consistent configurations for viewing and managing access.
The alternative—different access control policies defined in different areas—means nothing is consistent, so any security measures you implement in one place won’t be applied to other places due to the fragmented configuration.
3. Information Protection
Data needs to be protected at every stage of its lifecycle. Data loss prevention tools should be used to identify and encrypt the most sensitive data. Endpoint protection should be used to control and secure access to cloud environments from computers and mobile devices.
From an IAM perspective, information and data protection is all about making sure that the right people have the right access at the right time. This means putting proper access controls are in place and that systems with more sensitive data require stronger authentication, have tighter access controls that establish least privilege access, and properly separate duties—all of which can be centrally defined and managed with an IAM solution.
IAM solutions also ensure identity-related data is securely transferred between sources and targets, while leveraging the appropriate required encryption methods. Additional audits can be applied to review system/data access rights, user versus service accounts (e.g., do we have orphaned accounts with access to sensitive systems/data?), and other processes for getting access to data via privileged access management functions.
4. Layered Infrastructure Protection
Layered cyber protection should be put in place that can expand the reach of defenses to multiple policy enforcement points.
Two-factor and multi-factor authentication can be used to augment or even replace passwords entirely, thus adding an extra layer of protection across all access points, including Active Directory, offline desktop, on-premises applications, cloud applications, employee and student portals, and remote access using VPN and other technologies.
Taking a layered approach also means applying the right amount of security layers only where and when needed, via risk-based authentication. A good IAM solution isn’t limited to a one-size-fits-all approach to MFA, but can dynamically require more or less stringent authentication based on risk level.
5. Cloud Security
Finally, infrastructure and cloud protection is vital. This includes providing workload monitoring and protection in public and private cloud environments. Institutions should also use trusted security controls to harden workloads against zero-day and targeted attacks.
Modern IAM solutions manage security both on premises, in the cloud, and a combination of both—which is what most colleges and universities have. It’s important to look for a solution that does this in a single system, so you don’t end up with a cloud IAM solution and a separate, on-premises IAM solution.
With a single, comprehensive IAM solution, you can define centralized policies that can be applied both on premises and in the cloud. Modern IAM solutions also ensure that proper security and access controls are already in place as your institution adopts new cloud services and applications.
Modern IAM Systems: Meeting Higher Education’s Cybersecurity Needs
Many higher education institutions are unprepared to protect their data in the face of rising cybersecurity threats. Don’t be one of them. Take proactive steps by putting in place an integrated approach to cybersecurity that includes a robust IAM solution designed to address higher education’s cybersecurity challenges.
After all, the best way to protect your institution is to ensure that people and technology work together to ensure a safe and secure educational environment.
Comments