1. Educause/Internet 2 Computer and Network Security Task Force
Copyright Gordon D. Wishon, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.
Educause/Internet 2 Computer and Network Security Task Force

2. Higher Ed Computer and Network Security -- The View from the Campus
Gordon Wishon
University of Notre Dame
Educause/Internet 2 Computer and Network Security Task Force

3. The Challenges of Security in Higher Education
Diversity of the Higher Ed Industry
Complexity of Service Offerings Drives Complexity of Architectures
Cultural Challenges
Educause/Internet 2 Computer and Network Security Task Force

4. Diversity of the Higher Ed Industry
3500+ Colleges and Universities
> 1000 Community colleges
< 100 major research universities
125+ University Medical Schools
400 Teaching Hospitals
150+ Institutional members of Internet2
Educause/Internet 2 Computer and Network Security Task Force

5. Complex Service Offerings
The University is an Educational and Research Entity
The University is a Corporation
The University is an ISP
Educause/Internet 2 Computer and Network Security Task Force

6. Educause/Internet 2 Computer and Network Security Task Force
Cultural Challenges
Loose confederation of autonomous entities
Lack of control over users
Academic “culture” and tradition of open access to information
Complex trust relationships between departments at various Universities for research (e.g. Physics community)
Creative Network Anarchy – anyone can attach anything to the network
University research lab computers are often insecure and poorly managed
Dorm Networking: little adult supervision
Educause/Internet 2 Computer and Network Security Task Force

7. Why US Higher Ed Computer Networks are Attractive Targets
Excellent platforms for launching attacks
Wired dorms (insecure Linux PCs, PC Trojans)
High bandwidth Internet (Fract T3, T3, T3+)
Sophisticated computing capacity (scientific computing clusters, even web servers, etc.)
Unsophisticated user population
“Open” network security environment (no firewalls or only “light” filtering routers on many high bandwidth WANs and LANs)
Many college & university networks are insecure
Too few security experts; weak tools; most institutions have no InfoSec office.
Few policies regarding systems security
Dearth of funding
Educause/Internet 2 Computer and Network Security Task Force

8. Targets of Opportunity on US Higher Education Computer Networks
Sensitive Data
Credit Card #s, ACH (NACHA) bank #s
Patient Records (SSN)
Student Records (SSN)
Institution Financial Records
Investment Records
Donor Records
Research Data & Other Intellectual Property
Educause/Internet 2 Computer and Network Security Task Force

9. Increasing Visibility of Security Issues in Higher Ed
Increasing concerns about liability: E-Commerce site recover damages from institutions implicated in future DDoS attacks?
Insurance companies begin to rewrite liability policies, separate ‘cyber’ policies to require info security vulnerability assessments & changes?
Federal funding agencies to require firewalls, security?
HIPAA is a “forcing function” in academic Medical Centers, Campus Health Centers
FERPA, COPPA, DMCA, Privacy legislation
Threats from terrorist activities, protection of the national infrastructure
Recent Incidents: Massive Virus Attacks, Intrusions Leading to Potential for Identity Theft, Liability
Educause/Internet 2 Computer and Network Security Task Force

10. Educause/Internet 2 Computer and Network Security Task Force
Five Point Action Statement
Endorsed by Higher Ed leadership organizations (ACE, NASULGC, etc.)
Evaluating Higher Ed Information Sharing and Analysis Center (ISAC)
NSF Grant
Commissioning of Papers, Reports, Case Studies
Meetings of Security Experts, Policy Experts, and User Community
Summit on Computer and Network Security in Higher Education
Participating in development of National Strategy to Secure Cyberspace
Chapter Devoted to Higher Education
Higher Ed Response to “Questions” (
Educause/Internet 2 Computer and Network Security Task Force

11. Educause/Internet 2 Computer and Network Security Task Force
Higher Ed ISAC
Real time information sharing mechanism
Security consulting
Vulnerability assessment
Emergency notification
Internet 911 services for academia?
Educause/Internet 2 Computer and Network Security Task Force

12. Educause/Internet 2 Computer and Network Security Task Force
Action Statement
Make IT security a higher and more visible priority in higher education
Do a better job with existing security tools, including revision of institutional policies
Design, develop, and deploy improved security for future research and education networks
Raise the level of security collaboration among higher education, industry, and government
Integrate higher education work on security into the broader national effort to strengthen critical infrastructure
Educause/Internet 2 Computer and Network Security Task Force