Campus IT and emergency officials face up to a variety of security threats


The recent rampage by a knife-wielding attacker at The Ohio State University was a stark reminder of the security threats facing college and university campuses across the U.S. As campuses become more attuned to risks, they are looking to technology to support their security programs.

The threats to campuses aren’t just physical. Their information systems also are at increasing risk, oftentimes to more unpredictable threats, university IT specialists say.

“Colleges are typically seen as ripe testing grounds for new malware, a place to test out botnets because of the amount of bandwidth and varying degrees of management around classroom computers and lab computers,” Hunter Ely, information security and policy officer at Tulane University in New Orleans, told EdScoop.

U.S. campuses are vulnerable to more atypical risks, Ely said. “We have a large Chinese student population and they tend to bring ‘interesting’ malware form China — something that has infected their machine there and then they bring it here and we discover it,” he said. “So we see a lot of threats that a lot of other verticals don’t see because of the various and diverse group of people we bring on campus, the openness of the network and the speed and size of the network.”

Tulane uses Louisiana’s state optical network, which has experienced “massive” denial-of-service attacks this year, Ely added. “That has affected us,” he said.

Ely said that phishing scams pose a particular challenge for campus IT managers.

“We have an increasing issue around spear phishing and phishing more generally,” he said. “Going forward, we need to do more in protecting the assets closer to the asset. In other words, we need to rely on firewalls to do their job but also rely on layers of security, particularly around two-factor authentication into our main systems, and more stringent security policies around those systems. Phishing is still and will continue to be one of the biggest issues that we face.”

Tulane offers online computer-security training for students. “It’s not mandatory, but it’s available,” Ely said. “We also do a tech day every year in the fall, where we give out prizes and talk about cyber security awareness month and about the variety of tips that go with that. We also have a Twitter account that’s pretty active and it seems like there’s fair portion of the population that likes interacting with us on that.”

Enhanced campus communications

Technology is “absolutely” critical to mitigating security threats and responding to emergency events on universities campuses, said Ely, whose role is to help architect and design technical solutions for security problems.

“We had a meeting [recently] to talk about how we can put into place a system that will allow us, for example, to lock down all of the exterior doors on campus with the push of the button and that requires technology,” he said.

To enhance its campus security posture, Tulane is using tools from Rave Mobile Safety, a firm that provides communications software designed to improve emergency preparedness and faster response to security situations.

Rave Guardian is a mobile phone application intended to enhance safety on campus through real-time interactive features that create a virtual safety network of friends, family and Tulane’s Campus Safety office. Any student can download the app and create a profile that includes their vital information.

Guardian includes a “panic button” that gives users a direct, immediate connection to Campus Safety with GPS location and personal profile information. Another feature is “tip texting,” which enables anonymous, two-way crime reporting via text and images.

“It allows our students to go from point-to-point with a virtual escort and gives them peace of mind,” said Norris Yarbrough, Tulane’s vice president for emergency preparedness and response. “It’s been well received by the community and it’s used all the time.”

Campus-safety officials have also deployed Rave’s Emergency Alert Notification System, which uses a spectrum of communication modes — including cell phones, landlines, email, text and social media — to send emergency alerts in seconds to entire campus populations.

Yarbrough said that Tulane officials were impressed by the system’s speed and reliability in delivering messages. “It’s an easy-to-use platform, but the biggest single driver was really speed and reliability,” he said. “That changed the game fairly substantially for us.”

While the Ohio State incident prompted “heightened security awareness” among emergency officials at Tulane, they decided that the situation in Columbus didn’t warrant alerts to Tulane students, Yarbrough said.

“We were in touch with our federal and state law-enforcement partners every day to see if there was any chatter or noise that might have increased because of that event,” he said. “The information we were getting back did not warrant any type of message to our students other than what they were already getting through social media.”