The Importance of Visibility
Preparation to securing your campus environment
- By Mike Spanbauer
- August 01, 2021
Let’s face it - the technology environment of a typical campus
brings with it a unique set of situations and challenges that
even the most seasoned technology manager may not fully
appreciate. Matching that uniqueness is the fact that most
educational facilities run on limited budgets with a lean
amount of staff, where each wears various hats throughout the
What this all means - besides possible sleepless nights - is that in
order to be truly secure, one must be focused on getting their security
posture just right, being as prepared as possible for every eventuality
and putting faith in that preparation if disaster strikes.
The Campus Situation is Unique
As they say, situations may vary, but on a typical campus the application
stack chosen by the university is narrower than one would flnd
at an enterprise, but the potential scope of applications and resulting
traffic includes all manner of software from enterprise to consumer.
There are different types of productivity applications in use by different
groups; sometimes different departments use their own preferred
type of applications, and it’s impossible to fully account for everything
that a student may bring into the environment. There is robust use of
cloud tools like Google Suite and Microsoft Office 365 - and despite any
school-wide “preferences,” applications in use are never 100% standard.
At most modern educational institutions, a majority of the applications
in use today are web-deployed. Traditionally there have been
some point-of-sale applications at bookstores, tuition payment applications
and locations where personal employee data is stored, all
which need to be protected from breaches or attacks. There has been a dramatic rise in the amount of these applications over the past five
years, however, as the rapid adoption of cashless transaction systems
has enabled the student to accrue expenses for everything from food,
to laundry, to supplies and even tuition.
Depending upon the amount of academic research being done by
a college or university (and who is funding it), there may be entire
departments with their own servers, protocols and compliance needs.
Some will be tightly managed, others less so. These days, much of this
work has moved from an on-premises setup to hybrid data centers, or
even to a full cloud setup.
In addition to what’s used by professors and staff of the school,
there’s the student body, which brings in everything from gaming
consoles, to connected devices, to the entire spectrum of patched and
unpatched Macs and PCs to the network. That doesn’t even begin to
mention the amount of mobile devices that each student, employee
and professor has connected to the school’s systems. Estimates put
each person at connecting at least two devices to the network, with
the total number of devices being 2X that of workstations and personal
computers. These devices come in all shapes and sizes, represent several different generations of hardware and software, all with
their own levels of security.
In an enterprise environment, the technology managers can dictate
what is brought in and allowed to connect, and what isn’t. In the college
environment, this simply isn’t possible. Recognizing and preparing
for this fact is the first step in protecting your campus network,
applications and systems.
Technology (and Security) Knowledge Varies Wildly
Another important thing to remember is that all of a college’s constituents
- students, visitors, researchers, professors and employees –
bring with them incredibly varied levels of technology understanding
and experience. Some may have a high-level of knowledge and will be
very secure in everything they do, and others, less so.
Sometimes an action by an ignorant insider can represent a more
significant threat than a sophisticated attacker. Someone who downloads
an application, a movie or music that they think is “free” in fact
ends up infecting the device and exposing the rest of the environment
to an attack. Or, the threat could originate from the person that
doesn’t ever update their device or PC, or the professor that opens
every email they receive regardless of the sender.
It is often said that university campus networks make for the best
security soak sites. A college campus is a microcosm of the real world,
and just like the real world, understanding of technology usage and
effective security measures vary widely.
Defending the Campus Attack Surface
Once the expansive potential attack surface is understood, it’s time to
take the correct steps to protect it. There are several key strategies to
have in place in order to best use time and resources, and provide the
maximum protection possible.
There is never a way to protect against everything, or to predict
every problem, but by focusing on understanding the environment
and being prepared if there is an issue, one can ensure they are in the
best possible position to succeed.
Planning. The most important aspect of operating a successful
security organization at a college or university is to actively plan for
as many potential situations and threats as feasible. An administrator
needs to model regular activity, and crisis activity, down to the minute of each team member’s actions. That way, when there is a crisis,
they are ready.
At the same time, this planning is not just for crisis situations. It is
also to ensure a team sticks to decided-upon protocols and actions for
everyday security management. What is the workflow for making software upgrades? For software updates? How does the team add new
users and give them access to specific applications and information?
Plan out what normal activity looks like, as well as what abnormal
activity looks like. That way it’s clear when something is abnormal
and malicious. Reviewing plans on a regular basis is just as important.
One needs to ensure everything is up-to-date, make any needed
adjustments and update the process plans and workflows to make
sure they’re current. This is money and time well spent, as it helps
when an incident happens to get out of reactive mode into proactively
solving the issue.
Planning out the workflow and playbook for each action for the
entire organization, and then relying upon those detailed plans is the
only way to ensure the campus is operating at peak eThciency (important
with a small amount of staff) and that it’s ready for any eventuality.
Policies. A part of this requires strong, consistent definitions for
security incidents at the core of planning and preparation activities.
It is up to the security team to decide upon the proper alert work-
flow, and when an incident or anomaly needs to be flagged to the
team. Deciding exactly what’s dangerous, what’s interesting and
what’s not is critical to success (and the sanity of the team).
An organization can’t set its tolerance too high, or they’ll end up
letting all sorts of malware, malicious code and ransomware into their
system; and if the tolerance is too low the team will constantly be
chasing down false positives and ghosts. The problem is never getting
too many or too few alerts – it’s most often the lack of planning and
discussion at the start, or a lack of consistency in approach and defi-
nition of what is normal and what is not.
All new elements introduced to the environment need proper
action plans around what is expected and what would be an abnormal
behavior. Be sure to test all new software out beforehand, in order to
make sure it will roll out and go live as expected, as no one likes surprises.
It’s hard to think of a single example where a security surprise
ended in a promotion.
Having already had the right conversations and made the right
plans to effectively react when an incident happens is crucial. This is
even more critical to get right with leaner teams that are wearing
Preparation. Without a strong workflow and the right preparation
in place, all the automation or advanced tools in the world won’t help.
Teams and people need to work together. Events affect everyone in
the organization. To operate correctly, a team needs to be prepared
well, and know how to instinctively play their roles.
With plans and policies in place, teams need to rehearse critical
events and see where there might be issues to correct in their workflows and planned responses. Was something missed? Better to find it
now, before it’s too late.
Being prepared also means that having the proper security controls
and tools in place to enable everyone in the team to do their jobs effectively
each day. This means having full visibility, being able to inspect
items of interest, and knowing when (and how) to act on what one finds.
Visibility. It is critically important to operations - especially in the
campus situation where there are likely fewer resources and overworked
staff to ensure active visibility into the network and applications.
It’s only possible to protect what can be seen.
With pervasive network visibility in place, it’s possible to see the
entire environment and manage all its assets. It is important to have
the ability to monitor normal, legitimate network traThc and activity,
allowing a view of the network when it is performing the way it is
intended to. That also enables setting the stage for what is considered
abnormal, or at least out of the ordinary, making it easier to identify
and address potential issues before they become full-on emergencies.
Controls. Every security organization needs to build some basic
controls that will allow them to control the blast radius, i.e., to handle
the extent of the damage if the campus network and/or applications
face a cyberattack.
There are different types of controls - some are simply brute forcetype
controls, shutting down everything for a moment of time while
it is determined what the problem is and how to stop it. Alternatively,
there are controls that combine network visibility with specifics to
surgically control an application or a machine (or more) to isolate
and shut down just the problem areas. Both are effective (and often
needed) options to have available.
This also serves as a reminder to make sure that the proper controls
are in place to manage day-to-day security operations, not just when
there is a crisis. Is it possible to see across applications, identify and act
upon anomalies? Is the system set up so that only those that should
have access do, and are the only ones allowed to make changes?
Make sure that controls behave the same across the entire environment.
There should be a consistent operational security and control
set, regardless of whether operations are on-premise, hybrid or fully
in the cloud. Be sure that settings have been checked and rechecked
to prevent a missed checkbox from unintentionally causing problems.
Lastly, remember to not have only a single administrator account
active. Credential management is an issue, sure, but it is more important
to be protected in case there’s an issue and it’s not possible to
access the main account anymore. Credential management program
suites can be a friend. Employ unique credentials and use the programs
Compliance and certification. Be sure to have a solid certificate
management program running that can help make sure the organization
knows where applications are from - and that they are who they
say they are (signed, and from trusted publishers). Without that, at the
very least make sure there is a technical signature trail, and know what
each does, who has authority to publish, who has permissions, where
they are running. That will be critical information if there is an issue.
Compliance is also important to factor into the security makeup.
Many campuses contain research facilities - and many have a deep set
of data and security compliance requirements in order to receive
funding from a government or private sector investment, while others
demand a certain level of data and information protection. In
many cases, colleges and universities with these requirements find
themselves using this high-level of security as the starting point for
determining what needs to be invested in and rolled-out campus
wide. Remember not to make this be the final consideration when
reviewing your security needs.
Future-proofing Your Security
Technologies and an institution’s need to provide and support them
change rapidly, such as in 2020 with the rapid, immediate need to provide online learning. One constant that remains, however, is the
need for strong security to protect the network, its information and
While it’s impossible to know exactly what’s around the proverbial
corner technology-wise, there are things one can do to be ready. The
most important when it comes to security is, once again, having the
proper plans and processes in place to evolve as security and technology
Establishing operational simplicity, with consistent policies and
controls will enable an organization to be ready, and allow them to
easily adapt for the next big thing. If one knows what to look for and
maintains the consistency of how to define an attack or security issue
that needs attention, then they will be prepared.
The Importance of Peer Networks
Time and time again the truth rings true that there is simply no substitute
to planning. By choosing great technology and solutions,
investing the time and effort needed for planning and working with
great partners, one can quickly mitigate the risk of any attack being
successful or having lasting effects on their school.
That said, very rarely has something been done that wasn't done
before. In the case of campus security, there have been others who
have likely recognized a pattern that just popped up or have recently
dealt with a similar issue. It is important to establish a peer network
in the campus security world. Network with peers in other colleges
and universities that have similar roles; that way, when instances
occur, individuals can bounce things off one another. This is especially
important when running a small organization where folks have
A good peer network enables someone to get responses from others
that have seen it all before. It’s also a great opportunity to become
involved and share expertise with others.
There are Resources to Help
In addition, there are several freely available resources out there that
can help in one’s role. The National Institute of Standards and Technology
is a great place to start, as they offer several reference materials
and frameworks that can be helpful to build up and enhance an
Vendors and partners should also be trusted to lend a hand in
these situations and offer advice on how to correctly set up systems
and respond to incidents.
It Is Not Possible to Do Everything
It is critically important to spend one’s cycles wisely. It’s impossible to
do everything - and that’s OK. Work to be prescriptive and descriptive
in the actions taken.
Of course, there is always more one can do, but by having great
tools, the right processes and comprehensive visibility in place, it’s
possible to establish a counter-force to having a lean staff and few
resources, which should help everyone to be able to sleep at night
This article originally appeared in the July / August 2021 issue of Campus Security Today.