Evolving Security to Meet Students' Digital Expectations
University IT leaders are tasked with managing and maintaining a network of sophisticated systems and networks. Here's how one institution is working to ensure that sensitive information is protected.
Colleges and universities today are facing an unprecedented number of cybersecurity threats. One might say they are a magnet for malicious activity: A report from IBM X-Force found that attackers are drawn to the education sector because of the large amount of personally identifiable information on students, faculty and organizations that higher education institutions collect.
Addressing these challenges can take its toll on IT staffers, who find themselves working overtime to fight everything from phishing to perimeter security, often with limited resources. Campus Technology spoke with David Waldron, the vice president for IT at St. Edward's University, to find out how he deals with such complex issues at his small institution in Austin, TX. Waldron has more than 20 years of experience working at colleges and universities to address their IT needs.
This interview has been edited for length and clarity.
How has the higher ed IT landscape changed since you started working at St. Edward's in 2009?
David Waldron
The demand for technology and technology-related services has increased dramatically over the course of my career. I spend much less time thinking about technology per se, and much more time thinking about building and maintaining a strong, versatile and nimble IT organization and about increasing the capacity of that organization to serve the university and to support its mission. More and more of my time is devoted to organizational design, organizational development and the acquisition and development of talent. All these topics are of utmost (and increasing) importance. I also spend a great deal more time thinking about institutional mission and strategy and the roles that technology can play in institutional success. The rapid pace of technological change and rapid change in the environment the university inhabits makes it imperative that the IT organization anticipate the university's future needs and adapt to meet them.
With universities offering more online services to students and faculty, how do security issues factor in?
Students now live a digital lifestyle. They expect to have a learning experience that transcends the classroom and the campus. They expect personalization and the freedom to make choices, enabling them to participate in their education in a way that's not affected by geography. As we navigate figuring out how to offer all of these services and experiences to our students via technology, it's critical that we also keep security top of mind.
Our biggest challenge with identity management is how to manage the identities of all of our students as they become increasingly more digital, no matter where they are accessing our resources and services from. We want to ensure that even our students abroad are able to access online resources and courses conveniently and securely.
St. Edward's adopted Okta to manage the identities of students, faculty and staff accessing our resources and services, and to increase our capacity to best serve our growing number of constituents, ensuring they can easily access university resources from wherever they are. The demand for technology and technology-related services is rising rapidly across the university. The IT organization has to work to meet that rising demand with existing resources. One of our key priorities has been automating and streamlining the services we use, and Okta has played a powerful role in this, helping us to manage identity across our many software applications and thousands of accounts.
For example, St. Edward's uses critical applications like Google's G Suite for work and collaboration, Box for storage, Canvas for learning management and Banner for resource planning. Through the Okta Integration Network, these tools are easy to access and provide a simple experience for our IT team to onboard and offboard students. Without Okta, we'd be devoting so much more staff time to solving IT challenges and less time focusing on the expansion of high-quality services in support of education.
What are some of the challenges that your team faces when it comes to protecting student data online?
Protecting our students' data and personal records is a top priority for St. Edward's. The main challenge we face around protecting student data is managing the identities of our students as they increasingly expect a digital experience and the ability to seamlessly and securely work from anywhere. At the same time, our IT team isn't growing and our student population is becoming more distributed so securing student and instructor information becomes even more complex.
How is your team working to solve those challenges?
We've moved the majority of our applications to the cloud to provide our students and instructors with the digital, distributed experience they now expect. To ensure these new technologies are also enabling a secure experience, we've adopted more efficient identity management services to ensure student's passwords and personal information are protected regardless of where they are logging in from and the device they are using. Beyond technical measures, we have [also] focused on improving password and security policies to align with industry-recommended best practices.
Because of the increased complexity of the threats we face, our university has established cross-functional teams dedicated to identity management and cybersecurity. These teams identify and manage risks using our risk register. They also oversee the university's cybersecurity roadmap and the implementation of projects and initiatives on that map. They are actively engaged in establishing and re-establishing cybersecurity priorities as risks evolve. The register and the roadmap are both informed by engagement with external experts, including experts who conduct assessments of various aspects of our security posture.
How do you ensure that everyone on campus gets information on how to protect their personal information online?
At St. Edward's, we've taken steps to teach students, faculty and staff on how to protect their data. We believe transparency is the best policy, so our users can understand how their data is being collected, stored, used and protected. This gets complex when every software app has its own set of privacy policies, so we advise users to always be cautious of where they input personal data. We provide regular cybersecurity awareness training to employees — some of this training is mandatory. We heavily promote online safety to the entire university community via multiple channels including social media. [In October we] engaged in a great deal of activity in conjunction with National Cybersecurity Awareness Month.
How has your job and work evolved to meet the demands of students and staff who expect to be connected to the internet 24/7?
Evolving expectations have required the deployment of a broader, more sophisticated set of technologies and services. In turn, this has required that my IT staff to possess more sophisticated skill sets. The time of talented, dedicated staff is the scarcest resource within higher education IT organizations. It must be allocated with that scarcity in mind. This has a wide array of implications. One of them is that we allocate staff time to the highest value uses. Tasks that are low value or that can be automated, outsourced or eliminated must not be allowed to consume staff time. We also must position staff members to contribute as widely as possible to high-value activities. We've moved toward a matrix organizational structure in an effort to facilitate this.
What advice do you have for other universities that are looking to invest in identity management services?
Today's universities are faced with multiple challenges as they work to appeal to students' evolving expectations, navigate smaller or flat IT budgets and respond to the escalating demand for services. When students are deciding which university to attend, they want to be set up for success and a huge part of that is having access to the most up-to-date technology and being able to access necessary resources anytime, anywhere. Universities need to take this into account when thinking about how to serve their growing, diverse and more widely dispersed constituencies, while also making the most out of limited IT budgets.
My advice to other universities is to make sure your IT team isn't becoming a bottleneck for students and faculty. Technology has been evolving rapidly in the last few decades and it can be difficult for educational institutions to keep up. In order to keep up with the technology demand, St. Edward's IT team had to reduce the amount of time we spent on managing accounts and data integrations. I believe much of the work that the IT team does is about enabling the rest of the university to function more effectively.