Skip to main content
Research & Education Networks Information Sharing & Analysis Center Indiana University

Taming the Technology Thunderbolt: How Higher Ed Can Avoid Gen AI Cyberattacks

Posted on by Jennifer Pacenza

By Julie Moog, Managing Director for TIAA’s Cybersecurity and Fraud Management Organization 

Note: Thank you to TIAA, one of REN-ISAC’s amazing partners, for helping to bring the highest level of cybersecurity awareness and information to our members and the public.

Our world changed in 2023 because a thunderbolt technology came into our lives like no other we’ve ever seen. You know which one, ChatGPT, a type of generative artificial intelligence (AI) that you can ask to write a 5,000-word article on any topic and it will send it to you within seconds. Or a college term paper, or blog, or executive summary, or software code.

Wow.

Stunningly powerful, without question. It’s fundamentally going to change how professors teach and students learn in profound ways not as yet fully understood. It’s ratcheting up the potential for a larger number of more harmful and difficult to detect cyberattacks, on a much broader scale with more sophistication, against everyone involved in higher education from administrators to professors to students and employees. For many years to come.

Nothing has come along in quite some time, if ever, that has the potential to upend the very foundations of teaching and learning and how colleges and universities protect themselves from cyberattacks.

What You Will learn

In this article we’re going to share a brief explanation of what generative AI is, why it’s so powerful, and the latest statistics illuminating its rapid adoption. From there we’ll get into prevalent generative AI cyberattacks and threats and how you can detect and avoid them.

We’ll then sharpen our focus on higher education with updates on the latest  programs focused on use of this technology. We’ll also address trends in student use, several of which are concerning, with associated insights, data, and actions to consider. We’ll wrap up with important actions you may want to consider to help avoid these new types of cyberattacks.

(more…)

NIST Recognizes REN-ISAC’s Role in Sector Collaboration

Posted on by Jennifer Pacenza

In “Cybersecurity for Research: Findings and Possible Paths Forward,” the National Institute of Standards and Technology (NIST) published the results of a study to uncover the cybersecurity challenges and risks, current methods and resources, and recommendations for future work found in higher education cybersecurity. According to the survey results, collaborative engagements, like those available through the REN-ISAC, provide resources and opportunities for addressing common cybersecurity challenges and risks.

NIST identified the major challenges facing our profession. First, there is a lack of cybersecurity awareness among researchers and institutional administrators. This leads to another major challenge, a culture clash between cybersecurity staff and researchers, administrators, and other university professionals. In addition, research institutions are facing IT security workforce and budget challenges. There are not enough skilled professionals in the field and turnover is high. Limited budgets have institutions struggling to maintain staffing and services, as well as keep up with the rapid pace of innovation.

In the face of these challenges, collaboration is key! The REN-ISAC is named among the top groups helping to bolster awareness, engagement, and collaboration across higher education research and cybersecurity communities. Our professional communities provide opportunities for information sharing, innovation, and efficient problem solving. The REN-ISAC also provides information and collaboration with Federal Government entities through our involvement with CISA, the FBI, and the National Council of ISACs (NCI). Those partnerships not only enable us to pass on national level security threat information to our members but also to advocate for our professional sector at the federal level through events like the NCI Day on the Hill (coming in October).

To learn more about what REN-ISAC does for higher ed cybersecurity, please visit our website.

REN-ISAC: The Untold Story

Posted on by Jennifer Pacenza

Learn the untold story of the REN-ISAC from former Indiana University President and REN-ISAC founder Michael McRobbie on Thursday, September 7. McRobbie will mark the 20th anniversary of the REN-ISAC with a presentation on “The REN-ISAC: The Untold Story” cohosted by the Center for Applied Cybersecurity Research (CACR) and Luddy School of Informatics, Computing, and Engineering.

While the REN-ISAC was officially founded on February 21, 2003, the creation of the ISAC for the research and education sector started years prior. In 1997, IU was impacted by its first true modern cybersecurity incident. This event inspired McRobbie and other security and technology leaders to invest heavily in key initiatives leading to the establishment of the REN-ISAC, a complex story that has largely gone untold until now.

For the past 20 years, the REN-ISAC has served as the official cybersecurity and threat intelligence sharing community for higher education. It grew from less than 20 US institutions in its founding year to now over 750 institutions across the globe. In addition to providing for members, the REN-ISAC supports the higher education community at large by acting as the Computer Security Incident Response Team (CSIRT) for the sector.

We hope you will join us live or online for what is sure to be an interesting historical overview of the founding of the REN-ISAC. Visit our website for more history of the REN-ISAC.

Anthony M. Newman appointed as the Executive Director for the REN ISAC

Posted on by ctconron

After a national search that included engagement of the REN-ISAC Steering Committee and staff, Anthony M. Newman, MBA, CISSP has been appointed as the Executive Director for the Research & Education Networks Information Sharing & Analysis Center (REN ISAC) starting August 21.

Anthony brings with him than 20 years of experience in higher education, government, and consulting. His most recent role was the Chief Information Security Officer at Purdue University. With his knowledge and expertise, we are confident that he will greatly enhance the value we provide to our members in the research and education community.

“I feel incredibly honored to step into the role of Executive Director at REN ISAC,” Anthony expressed. “Together we will work diligently to strengthen cybersecurity within the research and education community creating a resilient environment.”

Throughout his career, Anthony has consistently demonstrated abilities in strategic thinking by successfully driving forward initiatives, leading high-performing teams, effectively managing risks, and yielding organizational improvements. We have no doubt that his commitment and excellence will contribute to REN-ISAC’s mission to strengthen cybersecurity within the research and education community.

“As we continue to prioritize cybersecurity and innovation, Anthony’s extensive expertise in strategic planning and organizational leadership makes us confident that he will successfully continue advancing the REN-ISAC. We are excited to have him actively engaged in the community in this role,” noted Rob Lowden, Vice President for IT and Chief Information Officer at Indiana University, host organization for the REN-ISAC.

 

Member Spotlight: Empathy is the Key to InfoSec with Frank Barton

Posted on by Jennifer Pacenza

If you are a REN-ISAC member, then you probably know Frank Barton. Ever since joining in 2019, Frank has been an active member who asks smart questions during webinars, offers friendly responses to email threads, volunteers for project groups like the Technical Advisory Group (TAG), and was recently voted onto the Steering Committee. But that is just who Frank is. Whether he is volunteering for his kids’ BSA Scout Pack and Troop or working with faculty as the IT Systems and InfoSec Administrator for Husson University, Frank is an almost inexhaustible well of good will and positive energy.

So it was no surprise that when I asked Frank “what is most important for today’s infosec professional,” he answered, “Empathy.”

“One of my pet peeves,” says Frank, “is that when people talk about infosec, they see it as a technological goal,” but it is more than that. It is a community collaboration goal. “Our job is to have the empathy to help people help themselves.”

(more…)

Meet the 2023 REN-ISAC Steering Committee

Posted on by Jennifer Pacenza

The REN-ISAC Steering Committee is key to our community’s growth. They provide guidance and oversight for REN-ISAC’s strategic direction, serve our members through committees and task forces, represent REN-ISAC at professional events, and help disseminate information about REN-ISAC products and services. 

After holding our 2023 Steering Committee elections, new committee members Frank Barton, Isaac Straley, and John Virden joined Russel Fulton, Jodi Ito, and Joel Rosenblatt as our six member-elected leaders.* Get to know your elected REN-ISAC representatives. 

(more…)

REN-ISAC’s Milford Participates in FBI Academic Research Security Conference

Posted on by Jennifer Pacenza

The REN-ISAC’s Kim Milford (Executive Director) had the pleasure and privilege of representing our membership community at FBI Academic Research Security Conference hosted by Harvard University earlier this month. After being welcomed to the daylong event by John H. Shaw (Vice Provost for Research, Harvard University) and Joseph R Bonavolonta (Special Agent in Charge, FBI Boston), attendees participated in three sessions exploring the event’s theme, “Safeguarding the U.S Research Enterprise: Transparency, Integrity, and Reciprocity.”

The first session “In Focus: Cybersecurity” was a rich discussion on research and education’s complex and unique cybersecurity needs. Panelists Milford, Michael Corn (University of California San Diego), Douglas Domin (Federal Bureau of Investigation), and Brandon Wales (Cybersecurity and Infrastructure Security Agency)—led by moderator Klara Jelinkova (Harvard University )—discussed issues of compliance, intrusion response, mitigation strategies, and threats. The group also emphasized the use of public/private partnerships to encourage productive research while also protecting that research and the individuals, groups, and organizations it affects.

(more…)

REN-ISAC Fall Webinar Collection

Posted on by Jennifer Pacenza

The REN-ISAC Webinars team has been busy this fall creating quality webinar content, hosting eight webinars over the past three months. Catch up on the sessions you missed.

Becoming a Cybersecurity Awareness Month Champion with Chris Hilinski from TIAA (public)

pDNS and Intro to Scout with Kelly Molloy and Daniel Schwalbe from Domain Tools, LLC (public)

Every Step Matters – 5 Things You Can Do Right Now to Start Your Zero Trust Journey with George Finney from Southern Methodist University (public)

Using SES and BIND to Roll Your Own DNS Firewall using RPZ with Frank Barton from Husson University (public)

It’s not DNS; There’s no way it’s DNS; It was DNS with Johannes Ulrich from SANS (public)

How REN-ISAC Enhances the Higher Ed & Research Cybersecurity Postures with Jen Pacenza from REN-ISAC (public)

SANS Security Awareness Walkthrough with Keeton Ellis from SANS (public)

Cybersecurity Best Practices with Matt Hinman and Michael Kosak from TIAA (members only)

Please note that member login is required to access the member’s only videos. In addition, recordings for all sessions labelled PUBLIC are available to all, member and non-member alike. Find one you like? Feel free to share.

Thank you to all who presented, attended, and participated in a busy webinar season. We hope you enjoyed REN-ISAC’s 2022 Webinar Series; we look forward to bringing you more rich content next year. If you have webinar suggestions or want to volunteer to present, please contact us.

REN-ISAC Team members to present at the EDUCAUSE Annual Conference 2022

Posted on by ctconron

To round out National Cybersecurity Awareness Month, REN-ISAC Executive Director Kim Milford and Assessment Program Manager Susan Snyder will be presenting at the EDUCAUSE Annual Conference in Denver, being held from October 24-28. The EDUCAUSE Annual Conference showcases the best thinking in higher education information technology and the REN-ISAC is proud to be a strong partner and supporter.

If you’re attending this year’s conference, be sure to mark your calendars:

SANS/REN-SAC Educational Institutions Partnership Program Braindate

Susan Snyder

Tuesday, October 25 | 1:00 PM |

We will share info about deep discounts on top-ranked SANS Institute security training & resources, including free preview accounts for test driving SANS’refreshed Security Awareness Training & Phishing tools

https://educause22.braindate.com/topics/91938/

REN-ISAC Cybersecurity Peer Assessment Service Braindate

Susan Snyder

Tuesday, October  25 | 3:00 PM |

Join REN-ISAC to learn more about strengthening your cybersecurity posture through NIST Cybersecurity Framework-based Peer reviews!

https://educause22.braindate.com/topics/91931/

Shark-Tanking For Creative Exploration, Team Building, and Fun (Poster Session)

Kim Milford

Wednesday, October 26 |  10:15 AM–11:00 AM and 3:00 PM–3:45 PM | Board 109, Poster Area, Exhibit Hall B-E

The REN-ISAC hosted a staff exercise based on television’s Shark Tank, where assigned groups innovated service ideas, then presented them to the group. Several “sharks” asked the presenters questions, then decided whether the project should move forward. The REN-ISAC used a gentle approach (more wren than shark). This session explores the benefits of the exercise and provides tools and tips for others who want to implement a similar program/exercise.

HECVAT Strategic Discussion

Jon Allen, Nick Lewis, Kim Milford

Thursday, October 27 | 1:00PM–1:45PM MT | Mile High Ballroom 4A-C, Ballroom Level

The higher education information security community and HECVAT working group have collaborated for over six years to build the successful HECVAT. Our session this year is a facilitated discussion to ask for your ideas about where to develop HECVAT in the future. We will also go over where we need you to get involved to build more resources for the community and the service providers that support us.

Get Your Cybersecurity Program in Shape with Expert-Based Reviews featuring

Susan Coleman Snyder, Niranjan Davray, Mike Gioia, Kim Milford

Thursday, October 27 | 4:00PM–4:45PM MT | Mile High Ballroom 4A-C, Ballroom Level

The REN-ISAC offers cybersecurity assessments to research and educational organizations. With experience from dozens of assessments over many years, many aspects can be applied to all organizations?and learnings can be passed along. This panel session includes both assessors and assessees and is focused on practical advice to help you improve your cybersecurity program.

 

 

 

 

 

The journey to Zero Trust

Posted on by ctconron

The idea behind Zero Trust that it’s almost impossible to truly tell a bad actor from a good one when it comes to cybersecurity threats.

So, as a security framework, the mantra behind Zero Trust is essentially “trust no one.” That means that before giving permission to access data or applications, etc., all users must authenticate and then routinely re-authenticate to continue access.

The traditional way of granting access has been based on the idea that once a “solid perimeter” was created around a system to keep the “bad people” out, access would be granted one time.

But as systems and resources become more interconnected or possibly exist outside the perimeter, giving implicit trust could allow malevolent actors to access and siphon sensitive data. The edge to a network or system no longer works as a metaphor since networks can be local, in the cloud, or a hybrid. Therefore, treating “resources” as one entity with one access point is problematic.

REN-ISAC is hosting a webinar on the topic of Zero Trust open to both members and the public, “Every Step Matters – 5 Things you can do right now to start your Zero Trust Journey with Palo Alto Networks,” on October 5 as part of National Cybersecurity Awareness Month.

About the webinar:

As the proverb goes, “a journey of a thousand miles starts with a single step,” so does your zero trust journey. Join SMU CISO George Finney, in a discussion with David Cumbow, Education Architect at Palo Alto Networks, on the changing nature of cybersecurity and why zero trust is so important to the future of your institutions. Their discussion will center around what zero trust is (and is not), the importance of building a Zero Trust strategy, and the top five things you can start working on right now. After attending this session, you will be ready to start making that journey a reality.

The 5 things:

• Build a cross-functional team that can implement Zero Trust throughout IT

• Understand what “aligning with the business” really means and how Zero Trust can help

• Focus on Identity as the cornerstone of your Zero Trust strategy

• Start using “Protect Surfaces” to bring focus to your Zero Trust implementation

• Start “Logging Everything” to help tailor your controls

About the speakers:

George Finney is a Chief Information Security Officer that believes that people are the key to solving our cybersecurity challenges. George is the bestselling author of several cybersecurity books, including the upcoming book “Project Zero Trust” and the Book-of-the-Year Award-winning “Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future.” George was recognized in 2021 as one of the top 100 CISOs in the world by CISOs Connect and has worked in Cybersecurity for over 20 years and has helped startups, global telecommunications firms, and nonprofits improve their security posture.

David Cumbow is the Palo Alto Networks Principal Solutions Architect focused on State/Local Government and Education organizations throughout the US with experiences across the whole I.T. ball field. David used to be a customer for 6 years, where he previously worked as the networking and security leader at Moreno Valley USD. He left the district in 2016 and joined Palo Alto Networks to become a Systems Engineer, Engineering Manager, and now Principal Solutions Architect.

 

 

 

 

 

 

Skip to toolbar