CSG Meeting, January 12, 2016

2016 Top 10 Strategic Technologies

Enhance ability to detect sensitive data stored on servers not designed to protect sensitive data.

Deploy of full commercial Security Information and Event Management System

2016 Top 10 Strategic Technologies Citation: Grajek, Susan. Higher Education’s Top 10 Strategic Technologies for Research report. Louisville, CO: ECAR, January Available from

Deploy (more) multi-factor authentication for all users

Deploy (more) multi-factor authentication for users who access other people’s sensitive data

Security Metrics Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, Available from

Enhance web application vulnerability scanning

Routine vulnerability scanning of network devices

Training and Awareness Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, Available from

Enhance or make mandatory annual security awareness training

CISO Role Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, Available from

Where Does the Person with Primary Infosec Responsibility Report? Citation EDUCAUSE Center for Analysis and Research, 2015 Strategic Information Security Issues Infographic. Louisville, CO: ECAR, April 24, Available from information-security-issues-infographic

Where does the CISO report?

2016 ECAR CISO Research A sneak peak at demographics from our forthcoming research:  The average age of CISOs is 47.  Three quarters of CISOs are men.  CISOs are employed in nearly equal numbers at private institutions and public institutions.  A majority of CISO positions (87.50%) are located in Central IT units.  Two thirds of CISOs came to their current position from within higher education. Of those that came from higher education, 81% were hired within their current institution.  About one third were hired into a newly created role. Citation: EDUCAUSE Center for Analysis and Research, unpublished data from forthcoming 2016 research on the IT Workforce.

2016 ECAR CISO Research A sneak peak at CISO KSAs from our forthcoming research:  CISO education levels are:  Bachelor’s degree (53%)  Master’s degree (34%)  Doctorate or other terminal degree (8%)  The top three contributors (or potential contributors) to CISO professional growth are 1.attending conferences focused on higher education IT 2.engaging in informal peer networking 3.engaging in formal peer networking.  The top three most important skills for CISO success are 1.the ability to communicate effectively, 2.strategic thinking and planning 3.the ability to manage complex projects and the ability to manage other relationships within one’s own institution (TIE). Citation: EDUCAUSE Center for Analysis and Research, unpublished data from forthcoming 2016 research on the IT Workforce.

Where does the IT Risk Management program report?

Who Leads the IT Risk Management Program? Citation: Bichsel, Jacqueline, and Patrick Feehan. Getting Your Ducks in a Row: IT Governance, Risk, and Compliance in Higher Education. Research report. Louisville, CO: ECAR, June Available from

Where Does the IT Risk Management Lead Report? Citation: Grajek, Susan. Higher Education’s Top 10 Strategic Technologies for Research report. Louisville, CO: ECAR, January Available from