6 Best Practices for Managing an Online Educational Infrastructure

Retailers, healthcare providers, and social media platforms may be the first organizations that come to mind regarding consumer data security. However, other organizations — including institutions of higher education — are also tasked with the responsibility of protecting their customers' sensitive and valuable personal information from cybercriminals.  

Because increasing numbers of students opt for some level of distance learning, today's institutions of higher education are collecting vast amounts of virtual data. And as in any industry, universities must keep pace with rapidly changing technology to help thwart malicious hacking attempts and protect student information. 

This is especially important for universities that serve primarily nontraditional students — for example, adults taking online classes. To improve validation of the student population, universities collect and store information ranging from physical addresses, email addresses, Social Security numbers, birth dates, and more. Protecting all of this data warrants a cybersecurity strategy that exceeds students' expectations for a quality learning experience that extends further than typical security.

We have experienced protecting all of this data first hand at University of Phoenix. Last year, the university taught approximately 123,900 students, the majority of which were working adults who primarily took their classes online. These students may live states or even countries away and must trust their information with an institution they may have never physically seen or visited.

While the basic principles of security create the foundation for an efficient experience, protecting data can be the unseen — and often unnoticed — component of a satisfactory college experience. A conscientious balancing act comes into play when the quality that a student sees and experiences — namely, availability, and accessibility — are considered. Personally identifiable information (that is, information to identify and contact a student) must be accessible for the student to review and update at all times but simultaneously remain secure from unauthorized access and unintended use. Any information that identifies a person (for example, a photo, name, or email address) is considered sensitive data and should be handled as such.

This creates a delicate balance between accessibility and security. To reach this equilibrium, the network must be resilient and self-healing to provide availability to students where and when it is needed. When it comes to managing an online security infrastructure for an educational institution, here are six important cybersecurity components to keep in mind.

1. Create a Hierarchy When Logging Data
Security logging of systems, applications, and network devices is critical when investigating suspicious activity, from attacks to user activity. With tens or even hundreds of thousands of students enrolled in online courses at any given time, the number of logs that are generated at an online institution can become daunting. Based on the amount of security an organization has to have for its system, a balance must be struck between generating loads of logs and analyzing the most important data. It’s important to focus on the logs that are most likely to give you data and information that could reveal suspicious or fraudulent activity.

2. Establish a Risk Baseline for Network Monitoring
A risk baseline must be established so analysts can differentiate between normal and suspicious activity on the network. Establishing what is normal, ordinary, and healthy behavior on the network is crucial, making it easy to flag any excessive or exceptional behavior and quickly understand if there is a current threat of or an actual cyberattack.

3. Integrate Effective Identity Management Solutions
Identity management should provide a pleasant user experience while protecting sensitive student information. Identity management is a constant balance between security and convenience. An organization could have the most secure network in the world, but it will not be used if it is too difficult to access. The best solution is multifactor authentication, to prove a valid user by password, using a coded token, or through a fingerprint or an iris scan. The most secure systems require all three of these elements and accomplish the goal of establishing the user without making the process too onerous.

4. Involve Students in Communication and Training
A security awareness program must be well communicated to keep students informed about attacks targeting people (phishing, for example). This typically takes the form of an annual training program that users must complete so that organizations have a record and a confirmation of users understanding the security basics, including but not limited to phishing, passwords, etc. When users have accounts that are safe, the organization has fewer ways for hackers to enter its system.

5. Layer Your Defense for Optimal Protection
Defense should be in layers because no single solution can defend against everything. Each layer must be appropriate for the data and systems it's protecting. Different kinds of cyberattacks need different solutions. Multiple layers of defense provide varied solutions. It also is important to communicate with the Community Emergency Response Team (CERT) and all security vendors. This will provide the most up-to-date information and alert professionals to bigger attacks that may be happening across the nation and worldwide.

6. Expect Failure — and Have a Backup
Systems sometimes fail, which requires a documented and tested incident-handling process to meet and exceed minimum recovery time objectives. It seems like common sense, but when systems fail, an organization needs to have a backup plan. For example, if a server goes down, there should be a plan in place to take care of users. This should include overall instructions, what information they are able to access, and the recovery time on fixing the system. In some cases, there may be a need to have secondary equipment available for use and alternate ways to access data servers.

Related Content: