EDUCAUSE | Risk Management

Podcast: Community Source Software: The Beginning of the End, or the End of the Beginning?

gbayne — Thu, 05 Jun 2008 16:46:16 -0500

This hour and seventeen minute podcast features a panel discussion from the EDUCAUSE 2008 Enterprise Conference in Chicago. This lively discussion, "Community Source Software: The Beginning of the End, or the End of the Beginning?," includes:

Laura McCain Patterson, Associate VP, Information Systems, University of Michigan-Ann Arbor
Richard Spencer, Acting CIO and AVP IT, The University of British Columbia
Brad Wheeler, VP for IT, CIO, and Professor, Indiana University
Session moderator: Andrea Di Maio, VP Distinguished Analyst, Gartner, Inc.

Community source is designed to coordinate the work of different user IT organizations sharing the same purpose and requirements. An alternative to commercial applications and custom development, it gives users control and shares risk across peer organizations. Although several such public sector communities exist and yield great promises, many struggle with achieving critical mass and a viable business model. This panel compares and contrasts community source with more traditional software sourcing options and explores critical sustainability success factors.

Podcast: Addressing Complex Security Threats Through Risk Management

gbayne — Fri, 16 May 2008 13:25:56 -0500

This 40 minute podcast features a keynote address by Rebecca Whitener, Former Vice President of Enterprise Risk Management and Chief Risk Officer at EDS. Her speech, "Addressing Complex Security Threats Through Risk Management," was recorded at the EDUCAUSE 2008 Security Conference in Arlington, Virginia.

In this session, we address the current cybersecurity issues that are challenging higher education leaders today as they try to stay on top of the risks associated with attacks on information systems from internal and external sources. Emerging enterprise risk management (ERM) methodologies are examined as a source of guidance for creating an effective risk-based approach for managing current and future threats.

New Risk Assessment Resources Available

vvogel — Fri, 14 Mar 2008 11:57:10 -0500

The Security Task Force Risk Assessment Working Group wishes to inform higher education information security practioners of a few recent resource updates which are now available from the Risk Management section of the IT Security Guide.

The Information Security Risk Assessment Consultants list provides a listing of vendors known to have conducted some form of IS risk assessment for at least one higher education institution. The only way a vendor can get onto this list is to be placed there by an EDUCAUSE member institution that has engaged the consultant. Each entry on this list provides a link to the institution which has provided the vendor reference. The list can be a starting place for schools that are seeking a consultant; referencing institutions may be willing to provide additional information about the vendor and the consulting engagement when asked.

The list of Risk Assessment Tools provides links to various tools which can aid with a risk assessment. The tools are a mix of some sold or licensed by vendors, some provided by colleague institutions, and some from associations or standards groups.

The existing PDF version of the Information Security Governance (ISG) Self Assessment Tool for Higher Education has been enhanced by the addition of a Microsoft Excel version which (1) separates each section onto individual worksheets for increased flexibility of analysis and entry and (2) provides for automatic summarization on the separate scoring worksheet.

We hope you find this information useful. If you are able to provide additional information or references for the Risk Assessment Consultants list or the Risk Assessment Tools list, please send an e-mail to the Security Task Force.

Registration Now Open for February CAMP: Bridging Security and Identity Management

cluckett — Thu, 13 Dec 2007 11:17:07 -0600

Designed for both management and technical staff, the Campus Architecture and Middleware Planning (CAMP) workshop, "Bridging Security and Identity Management," February 13-15 in Tempe, Arizona, will address practical approaches for addressing issues surrounding three themes:

Privacy and compliance
Threat and risk mitigation
Scalability

Each of these requires a bridge between security and identity management. Explore the program and register before January 11 to take advantage of low early-bird rates.

Note: Those arriving Tuesday morning or earlier may wish to participate in the Net@EDU Identity Management Working Group meeting occurring from 1:00 to 5:00 p.m. before the workshop begins. All are welcome to attend (admittance is complimentary).

E07 Podcast: An Interview with Cedric Bennett - Security Concerns and Risk Management

gbayne — Thu, 01 Nov 2007 14:14:03 -0500

In this fifteen minute podcast, we feature an interview with Cedric Bennett, Emeritus Director for Information Security Services at Stanford University. Mr. Bennett also serves on the EDUCAUSE/Internet2 Computer and Network Security Task Force. We interviewed him at the EDUCAUSE 2007 Annual Conference in Seattle, Washington, where he was presenting a session entitled, "Stop, Drop, and Roll: Prevent and Douse Cyber Incidents".

2007 Enterprise Conference: The Adaptable University

gbayne — Fri, 15 Jun 2007 17:20:48 -0500

This podcast features a keynote address from the 2007 Enterprise Conference in Chicago, Illinois. Our speaker is H. David Lambert, Vice President for Information Services and Chief Information Officer at Georgetown University. His speech is titled “The Adaptable University” and runs approximately 53 minutes.

Institutions of higher education have become increasingly concerned about their ability to maintain critical services to faculty, students, and staff in the event of a major disruption. As we build or buy new information systems, enhance new facilities, and design new programs, we must be concerned with business continuity and creating resilient, adaptable institutions that consider academic sustainability in every aspect of the enterprise.

New Business Continuity Planning Page Posted at EDUCAUSE Connect

cluckett — Thu, 24 May 2007 15:17:06 -0500

EDUCAUSE has identified links concerning business continuity that may be useful to the higher education community on the new Business Continuity Planning resource page, including EDUCAUSE Review and EDUCAUSE Quarterly articles, federal government policies, and university resources.

ECAR Releases New Study on IT and Business Continuity in Higher Education

cluckett — Thu, 29 Mar 2007 17:54:06 -0500

The latest EDUCAUSE Center for Applied Research (ECAR) study, “Shelter from the Storm: IT and Business Continuity in Higher Education,” looks at IT unit readiness to foster and support the functioning of colleges and universities that are challenged by disruption. Responding to a well-documented increase of interest in business continuity and disaster recovery issues among higher education chief information officers (CIOs), ECAR designed the study to inform executives about how institutions approach continuity issues and to identify practices that are associated with good business continuity outcomes.

The study methodology included a literature review; consultation with a select group of CIOs and business continuity experts for the purpose of identifying and validating research questions; a quantitative survey of IT administrators (mostly CIOs) at 340 higher education institutions; postsurvey interviews with 15 executives and IT staff members involved in business continuity; a quantitative survey of institutional business officers (mostly CBOs/CFOs) at 247 member institutions of the National Association of College and University Business Officers (NACUBO); and four case studies looking at business continuity planning and operations Florida State University, New York University, Pace University, UC Davis, and UCLA.

The study is available to ECAR subscribers and through purchase, but the key findings and roadmap are publicly available. Visit ECAR on the Web.

Business Continuity Planning at George Mason University

vvogel — Wed, 13 Sep 2006 14:02:23 -0500

Learn more about George Mason University's executive enterprise risk management approach in the September 2006 University Business article, "Business Continuity Planning", by Joy R. Hughes (Security Task Force Co-Chair), et al.

E2005 Podcast: A Successful Tool to Create Positive Change

podcaster — Tue, 28 Mar 2006 17:39:53 -0600

This 53 minute recording provides coverage of the 2005 EDUCAUSE Annual Conference Session entitled A Successful Tool to Create Positive Change: Result of an IT Risk Assessment and Benchmark at Scandinavian Universities.