Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //


10:30 AM
Connect Directly
E-Mail vvv

6 Best Practices for Managing an Online Educational Infrastructure

Universities must keep pace with rapidly changing technology to help thwart malicious hacking attempts and protect student information.

Retailers, healthcare providers, and social media platforms may be the first organizations that come to mind regarding consumer data security. However, other organizations — including institutions of higher education — are also tasked with the responsibility of protecting their customers' sensitive and valuable personal information from cybercriminals.  

Because increasing numbers of students opt for some level of distance learning, today's institutions of higher education are collecting vast amounts of virtual data. And as in any industry, universities must keep pace with rapidly changing technology to help thwart malicious hacking attempts and protect student information. 

This is especially important for universities that serve primarily nontraditional students — for example, adults taking online classes. To improve validation of the student population, universities collect and store information ranging from physical addresses, email addresses, Social Security numbers, birth dates, and more. Protecting all of this data warrants a cybersecurity strategy that exceeds students' expectations for a quality learning experience that extends further than typical security.

We have experienced protecting all of this data first hand at University of Phoenix. Last year, the university taught approximately 123,900 students, the majority of which were working adults who primarily took their classes online. These students may live states or even countries away and must trust their information with an institution they may have never physically seen or visited.

While the basic principles of security create the foundation for an efficient experience, protecting data can be the unseen — and often unnoticed — component of a satisfactory college experience. A conscientious balancing act comes into play when the quality that a student sees and experiences — namely, availability, and accessibility — are considered. Personally identifiable information (that is, information to identify and contact a student) must be accessible for the student to review and update at all times but simultaneously remain secure from unauthorized access and unintended use. Any information that identifies a person (for example, a photo, name, or email address) is considered sensitive data and should be handled as such.

This creates a delicate balance between accessibility and security. To reach this equilibrium, the network must be resilient and self-healing to provide availability to students where and when it is needed. When it comes to managing an online security infrastructure for an educational institution, here are six important cybersecurity components to keep in mind.

1. Create a Hierarchy When Logging Data
Security logging of systems, applications, and network devices is critical when investigating suspicious activity, from attacks to user activity. With tens or even hundreds of thousands of students enrolled in online courses at any given time, the number of logs that are generated at an online institution can become daunting. Based on the amount of security an organization has to have for its system, a balance must be struck between generating loads of logs and analyzing the most important data. It’s important to focus on the logs that are most likely to give you data and information that could reveal suspicious or fraudulent activity.

2. Establish a Risk Baseline for Network Monitoring
A risk baseline must be established so analysts can differentiate between normal and suspicious activity on the network. Establishing what is normal, ordinary, and healthy behavior on the network is crucial, making it easy to flag any excessive or exceptional behavior and quickly understand if there is a current threat of or an actual cyberattack.

3. Integrate Effective Identity Management Solutions
Identity management should provide a pleasant user experience while protecting sensitive student information. Identity management is a constant balance between security and convenience. An organization could have the most secure network in the world, but it will not be used if it is too difficult to access. The best solution is multifactor authentication, to prove a valid user by password, using a coded token, or through a fingerprint or an iris scan. The most secure systems require all three of these elements and accomplish the goal of establishing the user without making the process too onerous.

4. Involve Students in Communication and Training
A security awareness program must be well communicated to keep students informed about attacks targeting people (phishing, for example). This typically takes the form of an annual training program that users must complete so that organizations have a record and a confirmation of users understanding the security basics, including but not limited to phishing, passwords, etc. When users have accounts that are safe, the organization has fewer ways for hackers to enter its system.

5. Layer Your Defense for Optimal Protection
Defense should be in layers because no single solution can defend against everything. Each layer must be appropriate for the data and systems it's protecting. Different kinds of cyberattacks need different solutions. Multiple layers of defense provide varied solutions. It also is important to communicate with the Community Emergency Response Team (CERT) and all security vendors. This will provide the most up-to-date information and alert professionals to bigger attacks that may be happening across the nation and worldwide.

6. Expect Failure — and Have a Backup
Systems sometimes fail, which requires a documented and tested incident-handling process to meet and exceed minimum recovery time objectives. It seems like common sense, but when systems fail, an organization needs to have a backup plan. For example, if a server goes down, there should be a plan in place to take care of users. This should include overall instructions, what information they are able to access, and the recovery time on fixing the system. In some cases, there may be a need to have secondary equipment available for use and alternate ways to access data servers.

Related Content:

Jamie Smith is the Chief Information Officer for University of Phoenix. Smith holds a Bachelor of Arts in Business Administration from Iowa State University and has served as a board member for Junior Achievement and the Memphis IT Council. Larry Schwarberg is the Chief ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Moderator
1/22/2019 | 2:55:07 AM
Spread it wide
I like knowing that all this information in storage is becoming more accessible. I think that there are a lot of people in this world who actually have so much potential, if only they were able to gain access to such materials and tools to increase their knowledge on various topics. This is just a stepping stone...
User Rank: Strategist
1/22/2019 | 1:16:50 AM
Evolve with technology
Educational institutions should apply the same level of security onto their systems like those of establishments within other industries regardless of their different backgrounds. Though the data that they mainly carry does not contain highly sensitive info like finances and medical, but confidential data still needs to be protected nonetheless. Any lapses cannot be tolerated in today's rapidly evolving technological era.
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-06-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12887. Reason: This candidate is a reservation duplicate of CVE-2019-12887. Notes: All CVE users should reference CVE-2019-12887 instead of this candidate. All references and descriptions in this candidate have been removed to preve...
PUBLISHED: 2019-06-25
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.
PUBLISHED: 2019-06-25
Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browse...
PUBLISHED: 2019-06-25
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
PUBLISHED: 2019-06-25
HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6329.