Higher education institutions are "particularly vulnerable" to security breaches
Higher education institutions are particularly vulnerable to security breaches because they have a range of personal data in one place and relatively weak cyber security, thanks to the premium placed on information-sharing. Campus Technology reports that hiring a chief information security officer who is adept at networking and communication is critical. Cyber insurance is also seen as a weapon to help against attacks, and the underwriting process may assist an institution in becoming better prepared so that an attack is less likely to occur (an insurer will not issue a policy unless the applicant demonstrates a sufficient level of cyber security). 
IT Security

Why Higher Ed Needs to Step Up Its IT Security Game

With colleges and universities becoming an ever more tempting target for hackers, there is a growing demand for c-level leadership in the realm of cybersecurity. But do institutions know what to look for in a CISO?

The latest statistics on information security incidents are downright frightening.

Nearly 80 percent of organizations today suffer cyberattacks, some repeatedly, according to the "2015 U.S. State of Cybercrime Survey" from Pricewaterhouse Coopers (PwC), CSO magazine, CERT and the U.S. Secret Service. Furthermore, the typical organization now experiences 3.8 insider security incidents on an annual basis, claims a recent security report from SpectorSoft.

And as alarming as those numbers obviously are, they do not take into account the number of incidents — from both external and internal threats — that remain undetected or go unreported.

Statistics like these also illustrate why IT security is becoming an increasingly important topic on campus. While healthcare, financial services and the retail sector grab the lion's share of data breach headlines, colleges and universities remain a very tempting target for hackers. The reason: all of the personal, financial and healthcare data collected on students, faculty, administration and staff, all conveniently housed at a single source.

With that in mind, Jane LeClair, chief operating officer at the National Cybersecurity Institute at Excelsior College in Washington, DC, recently stressed the need for higher education to step up its game around IT security. And she urged colleges and universities that haven't already done so to embrace the role of the chief information security officer, or CISO.

LeClair appeared at the Campus Technology 2015 conference in Boston speaking on the topic "Cybersecurity at the C-Level: Preparing Future Leaders.' While she discussed the need for more cybersecurity professionals at all levels of the organization, she stressed the growing demand for a single accountable IT security individual that can hold his or her own with other top executives in the organization.

Wanted: C-Level Security Leader

The role of chief information security officer (or chief security officer) is still merely a "wish list' item for many organizations. But the ranks of high-level security leaders are growing. That is fueled in large part by the constant media headlines of large data breaches and stolen personal information, and the potential liability to an organization.

As LeClair noted, "The CISO is an evolving and increasingly challenging role. The individual is responsible for all security-related matters, including regulatory compliance, risk management, technology controls, disaster recovery and raising the awareness of security at the C-level.'

The last point is perhaps the most important, LeClair stressed: security awareness. That is, a formal program for teaching employees and students about security risks they may create internally; and educating top officials on what all the data is that the school collects, where and how it is stored, how and by whom it is accessed, what the associated risks are, and what protections are in place.

Along with that comes an assessment of what the cost to a college or university might be should data be compromised — including actual financial costs and damage from a public relations perspective. And most importantly, what are the risks to the actual students and employees who may be victimized.

The unfortunate reality is that many organizations have a false sense of security, according to recent research from IT security firm BitSight. That includes many colleges and universities, which may count themselves among the organizations that should be safe from harm.