In the past two years our university system of 11 public colleges and universities has seen some significant changes in the way we go about the business of IT, focusing on two main areas: systemwide consolidation and heightened security measures.
The first was prompted by legislative mandate. The 64th Legislative Assembly called for a solution to more than two dozen “Data inconsistencies” found throughout the system. For the most part, many of these had to deal with definitions and reporting, although many required technical action to be taken by our IT teams.
For instance, solutions for finance, human resources and certain student services needed to be centralized to be considered standard. The rollout of both time and labor modules under our PeopleSoft system helped further standardization needs. For Core Technology Services (CTS) employees themselves, an additional standardization tool was found with the Work Management System, which allows teams to coordinate work throughout the system. Finally, work by the document imaging team in implementing Perceptive Content software solutions throughout the system helped unify data, and won the team a Kofax Inspire Higher Education Best Practice Leader 2017 award.
"We implemented intrusion detection systems at all the campuses, as well as multi-factor authentication for dozens of our key systems"
These types of consolidation bring the added bonus of long-term efficiency since we have 11 main campuses and several satellite campuses. The implementations needed to make sense at the campus level, but also fall in line with the State Board of Higher Education’s needs for the system of institutions.
This functional consolidation has been challenging as our budgets have decreased. After the state’s economy took a downturn due to significantly reduced commodities prices, the NDUS took three rounds of financial adjustments. What that’s meant for us in CTS was finding as many efficiencies as possible as nearly every one of our staff had to take on additional responsibilities.
On security, we’ve been improving on yearly security audits, but that road is always interesting. In the digital age it’s hard to not take an aggressive stance on security, especially when there are tens of thousands of student records and as many personnel files that require safe-keeping. We have employed a “Defense in Depth” strategy and also updated many of our policies, procedures and standards throughout the system to better align with the threat landscape.
Additionally, we implemented intrusion detection systems at all the campuses, as well as multi-factor authentication for dozens of our key systems. The former has aided us greatly in identifying and preventing potential threats across the system. The latter was first implemented for privileged users with access to restricted data and most recently went live for all users systemwide concerning accessing financial statements or other human resource-associated systems.
We have also improved our enterprise vulnerability management, log management and endpoint systems to create efficiencies while providing improved visibility and correlation capabilities. One issue that we will likely continue to run into throughout the system is usage of operating systems that can fall outside those authorized, but we have found that nearly all of these are employed by researchers with specific needs, or by computer science students learning new systems on their own. By and large, those don’t typically create problems and can be adequately secured with alternate controls.
All of the changes and growth we have seen the past few years would not be possible without the hard work of our CTS staff and the support of our campuses, university system and state. It is an exciting time to be involved in IT and I look forward to continuing our collaborative efforts to help the North Dakota University System reach their strategic objectives.