Universities are generally designed such that people following their natural incentives will get security wrong. Universities tend to have both central staff, and departmental IT staff distributed amongst them. It works in the sense that departments with larger needs can fund their own hires, but they&#x27;re often understaffed, underfunded, and report to (and are hired by) people who&#x27;s general requirements are that systems operate either long enough to submit a grant proposal, publish a paper, lecture in front of class or submit final grades. Anything security related, like rolling out patches, is likely to interfere. This hypothetical won&#x27;t fly:<p>&gt; &#x27;Oh gee, we rolled out the latest version of firefox and now your lab&#x27;s instructional java applet won&#x27;t run. Sorry we didn&#x27;t test that before going live. But we patched this weeks&#x27; bug. See you this time next week!&#x27;<p>I figure until cybersecurity causes more outages than security lapses, the departmental system will continue to underinvest in security practices and overproduce botnets.<p>Because of that division, central IT folks working in security have few levers they can pull or dials they can twist. It&#x27;s been shown that universities have the most expensive password policies among policies observed. Think about that: you can execute a six figure trade using a password less secure than what you need to download a lecture video in Blackboard.