Business Motivators
The client was a state college system with 37 campuses scattered statewide.
- The Presidents Critical Infrastructure Protection Board released its National Strategy to Secure Cyberspace. This plan specifically identified institutions of higher education as part of the cyberspace security problem.
- Under the national microscope, it became clear that they had no coherent information security program.
- EDUCAUSE, the higher education lobby responded to the CIPB report with an information security action plan that was heartily endorsed throughout academia.
- Committed to supporting the EDUCAUSE response, the client had neither means nor strategy to participate in the EDUCAUSE initiative.
- An industry specific information protection regulation, FERPA, as well as a state date protection act became regulatory requirements.
- With possibly serious liability concerns, the client found their diligence indefensible.
- Academic freedom and privacy issues between librarians, students, and government agencies were becoming increasingly hostile.
- The client had no mechanism to address improper usage of state information assets, yet had liability for results of improper usage.
The Challenge
- Each campus was autonomous, with its own CIO in charge of information technology.
- CIO's varied wildly in competence, sophistication, and enthusiasm.
- Every move was put under the "academic freedom" microscope.
- There was continual risk of lawsuits, accusations, and censure.
- Security activities assigned to employees were scrutinized and challenged.
- A strong union required appeasement.
The Solution
An Information Security Management System (ISMS) was designed and implemented to serve as the basis for the Information Security
Program. The resultant ISMS included:
- A management framework that was sensitive to the cultural and political environment unique to higher education.
- A risk assessment methodology that was both defensible, and compatible with state audit requirements.
- Information security standards that clearly defined enforceable and auditable requirements.
- Strategic plans that showed alignment with EDUCAUSE goals and a going forward roadmap.
- Incident management capabilities aligned with state guidelines.
The Result
The deployment of the ISMS resulted in the information security program obtaining the following benefits:
- A minimum baseline of information security throughout the system.
- Clear guidance to information technology employees and users.
- Empowerment through structure.
- Defensibility through demonstrated diligence
- Regulatory compliance
- Auditability
Note: HotSkills, Inc. launched Orange Parachute in 2007. This case study may predate the Orange Parachute name and launch, but the work was completed by the same consultancy.