Experience is an invaluable commodity to bring to your new job – even if a particular experience is, well, unlikely to reoccur on your current gig.
“For a short time, I was attached to a special operations unit,” says Vito Rocco, 51ԹϺ’s recently named – and first-ever – chief information security officer. During his Army days, Sgt. 1st Class Rocco spent some deployments in Afghanistan and Kuwait.
After his fellow soldiers kicked in the door of a target during an operation, he would spring into action. “I would go in and pick up all the laptops and the cell phones, gathering all that digital evidence,” he says. “You can’t really trust the door-kicker to secure a laptop.”
Such literal data-security measures are unnecessary on our peaceful campus, but there are other concerns for which the 10-year veteran of the 51ԹϺ office of information technology is responsible – mainly, keeping our systems secure.
Though 51ԹϺ hasn’t had a serious breach or ransomware attack, minor breaches do occur. On occasion, data has been inadvertently sent to the wrong person due to mistyped information. But the possibility of major attacks always looms.
“We do our best to defend against those kinds of attacks, but no defense is flawless. Any enemy, given enough time, will find a hole in the defense. It’s one of those things that keeps me up at night.”
With good reason given that, as the COVID-19 pandemic worsened, so did cyberattacks on universities. Remote learning — with its millions of new access points such as laptops, tablets and smartphones – opened up new opportunities to hackers.
Universities as Targets
Hackmageddon.com, a site that tracks such attacks, reports that the education sector accounted for 7.5 percent of globally reported attacks in the first quarter of 2020, rising to 10 percent in the same period in 2021. Emsisoft, an anti-virus software company, noted that at least 26 ransomware attacks involved colleges and universities in 2020. And ransomware attacks cost colleges and universities an average of $112,000, as per Sophos, a security software and hardware company. However – the total cost to resolve an issue by fortifying systems, Sophos says, is $2.7 million per incident, nearly $1 million more than the $1.8 million price tag in the private sector.
All this was enough for the FBI to issue a warning to educational institutions about a ransomware surge.
“To some extent, we’re soft targets,” says the Pittsburgh-reared Rocco, 43, who had served as 51ԹϺ’s interim IT security chief since August 2020. “We have a culture of openness and sharing, which is very much in opposition to securing and locking things down.”
That higher-ed tendency has cost some institutions dearly during the past two years:
- In 2020, the University of California, San Francisco, forked over a $1.14 million ransom after attackers targeted its School of Medicine – and data from its research team testing a possible coronavirus vaccine.
- In 2021, rural Lincoln College in Illinois was forced to shut down after a cyberattack, reportedly originating in Iran, encrypted files critical to enrollment, admissions and fundraising efforts. The predominantly black, 157-year-old college paid a ransom of “less than $100,000” but, combined with the effects of the pandemic, could not survive.
- In 2022 so far, security breaches have been reported at North Carolina A&T State University; Nebraska’s Midland University; and in California’s North Orange County Community College District and Ohlone Community College District.
“A lot of people think that when you talk about securing something that you’re locking everything down,” Rocco says. “But the challenge is finding a way that people can still do the thing they need to do while keeping data and computer systems safe.”
How? By adhering to the “CIA Triad”
CIA: Confidentiality, Integrity and Availability
No, this CIA has nothing to do with spies and that secretive facility in Langley, Virginia. Rather, it stands for Confidentiality, Integrity and Availability.
“Making sure the data is secret; making sure nobody has access to it who shouldn’t so data isn’t changed unintentionally or maliciously; and making sure you can get to your system when you need to,” Rocco explains.
“That’s what we strive for, the three tenets of security, finding the balance between C, I and A.”
51ԹϺ, Rocco says, is “on par” security-wise with similarly-sized universities. Yet as a group, universities still lag behind in private sector measures deployed at banks or brokerage firms, which have huge assets to protect.
However, universities worry about being compromised regarding files on enrollment, grades, budgetary information, class size and attendance, and student and staff personal/financial information.
Another fear: being hacked for data that top-tier research institutions like 51ԹϺ produce. “There can be a lot at stake here if there is a security incident,” Rocco says.
Decentralized & Remote Data Systems
Most institutions generally function through decentralized systems – with many academic departments retaining individual control over their own security systems and data. In effect – dozens of techno-fiefdoms.
“We’ve suffered from some of that at 51ԹϺ,” Rocco says. “We’re trying to correct that. We have redundant servers on campus, or services that maybe don’t get the correct support. Over the last couple of years, we’ve gotten a lot better at communicating with our adjunct IT areas.”
Rocco supervises one of 51ԹϺ’s IT governance groups, the Cybersecurity Team, which includes representatives from central IT and adjunct departments. “We set priorities and communicate about security,” he says.
After the pandemic seemingly permanently shifted America’s work habits – with many employees and students toiling from home or off-site locations – 51ԹϺ also has to rethink its cyber borders, which are potentially more porous now. Having all employees gathered in one central building, with all servers within it and fortified by firewalls, is outdated.
“It’s that Old Castle doctrine of security --- with the big walls and the moat outside and once you get inside the walls, (the security) is kind of soft and squishy,” Rocco says, noting that employees can be working anywhere from a local Starbucks to other states to other countries.
“Controlling that access without leaving data open to attack is challenging. We’ve done some things to address remote work, but there is always more that can be done.”
And is being done.
Upcoming Cybersecurity Initiatives
This summer, OIT will expand authentication methods, including the use of access codes via text messages, as well as authenticator apps that constantly cycle to avoid detection.
“Some of the things we’re working on right now, the big one is multi-factor authentication,” Rocco says. “That is the big thing we’re going to be putting around all 51ԹϺ systems. Almost anything you log onto with an ACE ID, like My51ԹϺ or Workday (both on and off-campus) and Rebelmail.”
Also expect increased use of VPN (Virtual Private Network), a temporary encrypted connection to 51ԹϺ’s network across the Internet, allowing for the secure transfer of data.
Communication on these changes will begin this summer, with implementation scheduled for mid-fall semester.
Increased 51ԹϺ user education – beyond the online security courses now required for all users – is another priority for Rocco.
“Most companies these days are phishing their own employees, to see who clicks on the link,” he says, referring to fake emails sent to induce people to reveal private information. “It’s not a point of embarrassing people or calling them out, but making employees aware of what these attacks look like.”
And while many colleges are infamous for failing to adequately back up their systems, Rocco says he is confident in 51ԹϺ’s procedures. “We back up our servers,” he says.
“A lot of that is improving to cloud-based applications (Google Mail, Google Docs, Workday) because the backup is being done by the cloud or on the provider level. We have backups on all our servers. If everything went down tomorrow, we could rebuild from backup and be fairly successful.”
The IT Guy
IT security is the “it factor” that powers Rocco’s passion. Even his pop-culture tastes lean a little toward his lifelong work. “There was a British show called ‘The IT Crowd,’ a comedy centered around these three employees of the IT office for some nameless corporation,” Rocco says. “They would answer the phone: ‘Hello, IT – have you tried turning it off and on again?’”
We’re all familiar with that refrain.
And for all his expertise, he knows what that earns him at home, particularly when family devices stall, freeze or otherwise misbehave. As he acknowledges with a chuckle: “My family still thinks of me as Geek Squad at Best Buy.”
