The University of the Arts London is one of the top ranked universities in the world for art and design, attracting students from around the globe to specialist courses in art, design, fashion, the performing arts, photography, video game design and more.
In total, over 23,000 students attend what is Europe’s largest specialist art and design university. The university’s roots go all the way back to 1842. Now in the 21st century, digital technology has become a core component of how students learn and hone their skills.
For students who are tasked with designing video games, for example, the need for internet-connected technology is obvious. But increasingly, the adoption of Internet of Things devices means that a wide range of students rely on connected devices. For example, even the sewing machines used by students of fashion are networked.
Nevertheless, even the students on more analogue courses will expect to be able to use their laptops, smartphones and other devices while on campus, as well as to access various course resources.
Securing devices in a university setting is a unique challenge, and it’s Keith Joy, head of digital and technology infrastructure at the University of the Arts London, who is ultimately responsible for ensuring staff and students stay secure, while also not being hindered from doing their work.
In this conversion with Infosecurity, Joy details how he approaches the unique challenge of ensuring the university’s networks across six campuses stay secure, as digital technologies, and cyber threats, continue to evolve.
Infosecurity Magazine: How do you meet the challenge of managing the cybersecurity of digital and IT infrastructure for over 25,000 students and staff?
Keith Joy: There are a lot of areas to consider as a university. We’ve got a remit to make sure that people have got the ability to be creative, to discover and push the boundaries. We have to allow them to do that while also keeping them secure.
It’s about striking that balance between more freedom that you would probably get in the corporate world, through to the more relaxed approach of a university, but still having to protect the students and staff.
We’ve been building cybersecurity principles into everything that we do as an organization as we’ve been introducing new platforms and technologies and even new connectivity between sites.
We are very much focused around making it secure and keeping it secure. That stems from basic things like keeping server patching up to date through to the perimeter and that firewall layer, which is where our partnership with [cybersecurity specialist service provider] SEP2 has helped us out.
Email security and phishing, that’s obviously something we think about too. Plus, we’ve got quite a broad set of internal systems that we use for our vulnerability and patch management and external systems that we use for penetration testing web and email security.
IM: What are the key cybersecurity challenges you are thinking about at the moment?
KJ: One of our big focal areas, and this is true across the university sector, is around the user management and user accounts. We know from recent publicly disclosed breaches that social engineering and getting access through passwords and identity is one of the easiest ways for malicious actors to breach the organization.
From a university perspective, with 24,000 students, if I say we have a turnover of about a third of those user accounts every year, someone in the corporate world might have a similar level.
But for universities, all of that happens during the months of September and October at the start of term, or June and July when students are wrapping up at the end of the academic year.
We have this sudden influx of 8000 new students turning up every year. We need to make sure they can log on to our network probably, so the user administration side of it is high on our agenda all the time.
We make sure we provide that secure level of access while also making sure we’re not too relaxed just to make things easier for people. Password complexity still has to be there, but we allow students to set up their own memorable phrases for password resets at the time of the rollout.
Then once you’ve got past the authentication stage of identity, you’ve got the access stage as well: once someone can login into the network, what do they have access to?
As you can imagine, with six colleges, we have thousands of course options with different modules. We need to plug the students into our teaching and learning systems to make sure they can get to the right content for the right course that they are on.
There are all those integrations needed along the way to make sure the student has got the correct permissions for the areas they need to access.
IM: There have recently been several high-profile cyber incidents involving victims in the higher education sector. What actions have you taken to boost security with this in mind?
KJ: We take a very pragmatic view of it’s not if, but when for a cyber-attack. What form it will take, we don’t know. But it’s about making sure we’ve got the right functions in place, with our Security Operation Center (SOC) in place to monitor our logs with the correct details being captured and staying on top of patching, vulnerability scanning. We have all that baked into our monthly cycle to make sure as best we can we have protected ourselves.
We’re not naive enough to think that we’re invulnerable. I don’t think anyone is because new exploits get identified all the time. And people can be targeted and socially engineered.
We’re never content to sit back and say we’ve done everything we need to do. We’re always keeping an eye on trends. And we maintain good relations with people like SEP2, because they can help explain what is happening out there.
We’re compiling as many sources of data as we can so that we can take that pragmatic view to see what we might be vulnerable to or if there are changes we need to make. You can’t put your feet up in this world.
“We’re not naive enough to think that we’re invulnerable… We’re never content to sit back and say we’ve done everything we need to do.”
IM: How do you approach the unique challenge of managing the security of thousands of devices used by staff and students across the campus, especially when students will be using their own personal devices?
KJ: There are two kinds of devices. There are managed devices: laptops and desktops in classrooms, or those the staff are using. We build and control what software goes on them and what users can access. We have that element of control around them.
Then we have the bigger portion of devices, which are used by the students and that is a bring-your-own-device (BYOD) situation.
Back in 2013 when I started, we used to say one device per person was probably over-egging what we needed to cater for on our Wi-Fi. Now we’re scaling our Wi-Fi for five devices per person.[DP1] Because by the time someone might have a phone, a tablet, a laptop and perhaps wearable tech, if we account for five per person, we have some headroom in our network.
These are devices that we can’t manage, so we build network segmentation into the equation. Users can login into that network with their credentials: that way we might not know the device, but we know who they are, so they can perform some actions. Like accessing a printer from their personal device, for example. As long as the student is authenticated on the network, they can access the print service.
Then there’s other devices like smartphones and tablets that are segmented into a network which only has internet access. Or they are in a specific part of the building, where the students are doing a particular type of work, so may need a specific type of access.
“We used to say one device per person was probably over-egging what we needed to cater for on our Wi-Fi. Now we’re scaling our Wi-Fi for five devices per person.”
We try not to overcomplicate the segmentation, because that’s when mistakes happen. We need to find a balance between making the network useable while putting in a maximum layer of control as much as possible.
We also have some halls of residence that the university manages. When the students are sitting in their rooms, they want the same sort of Wi-Fi experience they would get at home.
So, we have a setup that gives them a user defined network space, which allows them to create their own Wi-Fi network for their room, which they can link their games consoles, smart speakers, smart TVs to without us having to create lots of convoluted polices for each of the thousands of rooms in our halls.
Finding that balance of giving people the connectivity they need while keeping them secure is an interesting challenge.
IM: What is the most significant challenge in cybersecurity at the moment?
KJ: It’s identity. That’s the space that carries highest risks and the simplest vulnerabilities. Especially around breaches through phishing emails, particularly with how AI can make them much more effective now. So, from an entry point, identity remains the single weakest point for many organizations.
Those phishing emails, the social engineering, those ways of persuading people to give up personal information and the tools and methods used to do so have become a lot more intelligent.
IM: What has been the biggest success of cybersecurity in recent years?
KJ: I think user awareness has grown. With a lot of cyber-attacks against big names hitting the mainstream news, I think public awareness of cybersecurity has heightened somewhat and makes people question more. I think without that, a lot more people would be susceptible to it. People are questioning more and that’s good for cybersecurity practitioners: we’re no longer shouting into the wind, people are thinking about it more.
IM: What is one piece of advice you would offer to other cybersecurity leaders?
KJ: Talk to each other and share information across the sector. Don’t be afraid to say what you see going on. Even if it’s stuff you are successfully blocking, say if you’ve seen more of what you usually see, or if you’ve seen unusual alerts. Those conversations can be very helpful.
Image credit: DrimaFilm / Shutterstock.com
