Building Robust, Secure and Compliant IT Systems in Education

Educational institutions often have systems distributed over multiple locations. With less centralization comes reduced control over systems and people. Human engineering hackers can sometimes rely on insiders to gain access to systems and/or data, and in distributed settings, there may be an increased potential for hacking or data breaches.

Some educational institutions have a culture of BYOD — bring your own device — and it’s music to a hacker’s ears. After all, schools often lack strict control over the types of software and hardware used by faculty and students.

Perhaps the biggest challenge for senior IT executives in educational settings is striking a balance between enrollment growth with data protection and openness. It’s a difficult tightrope to walk, and the costs of mistakes such as data breaches are extremely high.

Both students and teachers expect and require remote access to IT systems, and this need increased dramatically during the COVID-19 pandemic. However, allowing remote logins to critical systems requires extremely strong firewalls, password security, cybersecurity and other protective measures. It may also require training, brochures or other measures to ensure that users maintain appropriate security protocols in their day-to-day use of systems.

Educational institutions may be less sophisticated about cybersecurity than corporations, and this can lead to difficulties in maintaining system integrity for senior IT leaders. As educational facilities have fewer financial resources, hackers presume they’re not well-protected, making them a target.

When it comes to security issues in educational institutions a number of questions arise:

• How might strong security protocols be maintained in distributed learning environments with non-standardized hardware and software?
• How do we ensure that IT systems remain compliant and secure when upgrading to a hybrid or cloud environment?
• What are the best ways to reconcile a culture of openness and sharing for learning purposes with appropriate data protection and privacy measures?

No matter which security protocols are in place, educational institutions will always be a target of nefarious actors. Cyberattacks on schools are a frequent occurrence. Since January 2016, there have been almost 1,000 incidents in the United States, according to the K-12 Cybersecurity Research Center.

At the post secondary level, attacks can be even more frequent. Kevin Morooney, the former VP of Information Technology at Pennsylvania State University, noted that the institution faced an average of 20 million attacks per day, an amount “typical for a research university.”

Universities are repositories of particularly valuable data. Whether the data is exploited by threat actors for military, corporate, scientific, competitive or other reasons, post secondary institutions must be particularly vigilant about keeping their systems fortified against such threats. In doing so, they must also remain compliant with regulations governing educational institutions in their state.

With IT teams stretched to the limit, remaining up to date with current regulations can seem overwhelming. Educational institutions are subject to strict compliance rules, and there are plenty of hoops to jump through.

Governments, colleges and universities are subject to a multitude of federal and state statutes regulating data privacy, from consumer reporting laws to FERPA, FISMA and HIPAA. If they have a payment portal of any kind, then they’re also subject to PCI-DSS compliance regulations.

The education industry faces tremendous challenges related to maintaining compliant systems with strong cybersecurity measures. Senior IT leaders must find ways to meet user needs and expectations while providing seamless and secure computing experiences.

If your systems are not prepared to withstand the toughest challenges, the consequences can be severe.