Is culture impeding security?

Have you ever questioned how effective we are at doing our job, when you see all these reports coming out about servers being hacked and personal information being lost?   We are certainly aware of these reports and take them seriously.  It seems like there is a new one every day.  Recently it was announced that Target lost the personal information of tens of millions of people.  This is stunning.  Higher Education is not immune, and has its fair share of attacks.

In some cases, attacks are becoming more sophisticated, while in other cases, brute force processing power is used to find weakness.  Last week I was talking to some of my peers in the U.S. and we had an interesting discussion on why these attacks seem to be happening more frequently and what we are doing about them.

We bounced around a few ideas we had heard elsewhere, and three things surfaced:

The culture of hoarding:  We simply keep too much information.  We need better record retention strategies and we need the policies in place to make sure people follow them.  In our information age, the days of trusting that individuals have the skills, judgment, and capacity to manage this are long gone.

The culture of frugality:  We need to invest more.  In higher ed we sometimes lag in having the proper governance structures in place to be able to make the tough decisions on where resources are needed and what the priorities are.  It is hard to commit new investments when funding is being cut and tuition is regulated, but we need to look at the whole picture.   Information Technology is an integral part of the university and we need to stop treating it as a cost centre.  Our investments need to be strategic and effective.  In some cases this means looking at the cloud, which means we need to overcome the perception that information in the cloud is less secure.  This is not necessarily true and in many cases cloud security is significantly better and more cost effective than what we do today.

The culture of service:  This was the one I found the most interesting and one I had not thought a lot about.  We are moving more and more to a culture of service and trying to deliver whatever our community needs.   As we do that, we may not be emphasizing security as much as is probably needed and we are likely compromising. The stress on this service culture is partly to build up trust and to avoid too much shadow IT in the organization.   Some of that shadow IT is healthy, but we do need to ensure we invest where the value ad is and make certain that security is well understood and implemented.  On top of this, the university ‘network’ has also been thought of as a fairly free and open environment and that adds to the risk and means we need to be more diligent.

Back to the question of whether we are doing our jobs.  Simply put, yes. I know we take the threats seriously, have many mitigations strategies in place and invest a lot of resources. I also feel that the cultures of hoarding, frugality, and service are making it a more challenging endeavour.   We need to engage the community, build a better understanding of the risks, make sure proper policies and tools are in place and back this up with effective investments.  We need to consider all options, because this is only going to get more challenging.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>