Campus Security Report Card: C for Effort

Click here to receive your FREE subscription to Campus Technology

Home > Campus Security Report Card: C for Effort

Security Research

Campus Security Report Card: C for Effort

10/30/2007

By David Nagel

Colleges and universities have done little over the last three years to improve information security. Hindered by lack of staff resources and funding, security efforts remain largely unchanged, while incidents of breaches--including the theft of personal information from within and without--continue to plague campuses. And, what's more, the integration of physical and IT security is still a reality in only a small minority of schools.

For these reasons and more, higher education institutions received, on the whole, a C average in the 2007 CDW-G Higher Education IT Security Report Card, the latest annual study from CDW-G and O'Keeffe & Co., which measures responses from higher education IT professionals to gauge the state of security on college campuses.

Network Infrastructure Security
On the whole, according to the report, IT security is in about the same position it was in last year, although there has been a 10 percent increase in the theft, loss, or exposure of data. Fifty-eight percent reported IT security "incidents," identical to the results from last year's study. But 43 percent reported lost, stolen, or exposed data, up 10 percent. Seventeen percent reported loss or theft of personal information about staff members, up 12 percent from last year; and 16 percent reported loss of theft of personal information about students, up 7 percent from last year.

Yet the vast majority of the IT professionals surveyed (93 percent) said they considered their network infrastructure "very safe," "safe," or "moderately safe." Only 7 percent said their network infrastructures were "not safe" or "fairly vulnerable."

Risks and Barriers to Security
So what do campus IT professionals consider to be the biggest threats to information security? Perhaps unsurprisingly, "sensitive data residing on unprotected or vulnerable computers" ranked No. 1 (with an average risk ranking of 3.68 out of 5). This was followed by (in order):

Intruders gaining access to high-profile, highly sensitive information or research results (3.59);
Downloading of unauthorized material (3.48);
End user sharing of authorized access (3.44);
Identity theft of a community user (3.32);
Increased use of laptops or other portable networked devices (3.3);
Vulnerability of wireless networks (3.16);
Malicious use of the network to attack other targets (3.1); and
Weak security credential policies (2.99).

What are the barriers to improving security on campuses? IT professionals this year cited the dearth of staff resources as the No. 1 barrier, followed by lack of funding, issues related to the culture of higher education, and the lack of defined security policy.