EDUCAUSE - comparison of IT Risk Management Methodologies

Throughout higher education, increased emphasis is being placed on the necessity to manage IT risk/opportunity more effectively. One session compared and contrasted how Princeton and Oxford universities manage risk, reviewed experiences from many other universities, and sprinkled in the EDUCAUSE top-ten IT issues.

Only 33% of universities have adopted an IT risk management methodology....

Annual EDUCAUSE conference

The annual EDUCAUSE conference was held last week in Anaheim, California.Many of the talks are available online. An initial view of the EDUCAUSE Core Data Service 2013 survey was particularly interesting.

Cyber Security Information Sharing Partnership

The Government has launched a new partnership between government and industry to share information and intelligence on cyber security threats. The Cyber Security Information Sharing Partnership (CISP) is part of the UK’s cyber security strategy, established to help make UK businesses more secure in cyberspace. The partnership is being supported by the Security Service, GCHQ and the National Crime Agency, who will work with industry analysts to produce and disseminate information on cyber threats facing the UK. It complements the work being carried out by the National Cyber Crime Unit, which tackles the most serious, organised and complex forms of cyber crime.

The Cyber Security Information Sharing Partnership (CISP) delivers a key component of the UK’s cyber security strategy in facilitating the sharing of information on cyber threats in order to make UK businesses more secure in cyberspace. This follows a successful pilot scheme launched by the Prime Minister which included over 160 companies across a range of UK sectors.

At a UUK Round Table meeting today universities were invited to apply to be members of CISP.

Presentation to be given at EDUCAUSE annual conference on 'IT Risk Assessment'

Princeton and Oxford will be giving a presentation entitled: "IT Risk Assessment: Two Universities Share Their Methodologies" at the EDUCAUSE Conference on October 16th.  If anyone attends, either in-person or online, please submit comments.

Interesting quote from 2013 Information Security Breaches Survey

David Willetts introduced the Survey at the InfoSec Europe 2013 conference, which contains an interesting quote, “93% of companies where the security policy was poorly understood had staff-related breaches versus 47% where the policy was well understood”.

This statistic is widely used to support IS awareness campaigns, but it begs a question.   How do you ensure security policy is well understood?   Especially in a devolved organisation like the University of Oxford?

IT Risk Management Exercise

EDUCAUSE has published an article, "IT Risk Management: Try This Exercise at Your Institution" to help institutions manage IT risk threat and IT risk opportunity more effectively.   It is based on experiences at Princeton and Oxford.

I would be interested in comments...

Only 33% of universities have IT Risk Management programmes

​In March 2013, EDUCAUSE conducted a quick poll on IT risk management in the ECAR Update subscriber newsletter. The poll was intended to informally assess the higher education
community’s thoughts on this important topic. Results of the poll, which had 104 respondents, are given: http://net.educause.edu/ir/library/pdf/ECARpollAPR2013.pdf 

33% of institutes have adopted an IT risk management programme, and a further 33% are planning to implement one.

The poll was proposed by Oxford and Princeton Universities.

10 Steps to Cyber Security

Guidance from BIS; includes:  Executive Companion and Guidance Sheets.

Useful resource.

Foresight Future Identities (2013)

The UK's chief scientific adviser, Professor Sir John Beddington, has produced a new report -   Future Identities, which examines how the changes in technology, politics, economics, the environment and demographics will affect the development of society in the UK and how policy makers can best respond.

He concludes:  mobile communications, the internet and social media will combine to have a profound effect on UK society over the next decade as we enter an era of always-on hyper-connectivity.

He sees Cybercrime as a 'Technology driver for change (3.2.4) and introduces the terms 'smishing' and 'vishing' (can you guess?).  In section 4.2.6 he addresses 'crime and criminal justice'.

Eight Brilliant Minds on the Future of Online Education

Interesting report from Davos, with eight amazing speakers.

The advent of massively open online classes (MOOCs) is the single most important technological development of the millennium so far.  Do you agree?   

WEF report: Risk and Responsibility in a Hyperconnected World

A colleague has just brought a World Economic Forum report to my attention. It has a sub-title of 'Pathways to Global Cyber Resilience'.  There is an interesting emphasis on 'collective action - individual gain'. I would be interested in comments...

There are excellent pictures too!