Managed Services Archives

How Can a Phishing Attack Lead to More Fatal Cybercrimes Like Ransomware, and How Can Educational Institutions Keep Them at Bay?

Posted on April 13, 2023April 13, 2023 by Brad Hudson

As phishing attacks continue to threaten individuals and organizations, educational institutions are particularly at risk due to the sensitive information they handle. This article will explore the connection between phishing attacks and ransomware and discuss practical strategies for educational institutions to protect themselves from such threats.

One of the biggest threats that all internet users face is phishing. Phishing schemes attempt to trick individuals into providing their personal information, such as login credentials and credit card numbers, to cybercriminals masquerading as legitimate sources. Not to mention, the consequence of falling for these schemes can be dire.

However, things can get much worse. Cybercriminals are also on the prowl for even more damaging attacks, such as ransomware hacks. Ransomware attacks can lock down critical information to prevent users from accessing it unless they pay the ransom demanded by the attackers.

Unfortunately, educational organizations are even more susceptible to these attacks due to the sensitive information they possess, such as student records, financial reports, and research data. This reality puts even more pressure on educational institutions to stay vigilant and proactive to avoid security breaches.

To ensure the safety and integrity of such sensitive data, educational institutions need to take proactive measures to avoid phishing and ransomware attacks. A robust security system is crucial in ensuring the confidentiality, integrity, and availability of sensitive data stored on the organization’s systems.

Reasons Phishing Attacks are Rampant

In 2020, phishing emails and websites were the most common entry points for ransomware, with over 610,000 unique phishing websites identified. The concerning trend has continued into 2023, highlighting the ongoing threat posed by phishing attacks in the current digital landscape. But how does phishing run rampant throughout the digital world? The following sections have an answer.

1. Use of AI-ML-based Tools by Attackers
Phishing attacks have become increasingly sophisticated with attackers’ use of AI-ML-based tools. These tools allow attackers to automate and personalize their attacks, making them more convincing and harder to detect. For instance, attackers use machine learning algorithms to create compelling phishing emails that mimic the writing style and language used by the victim’s contacts, making it easier to dupe the victim to fall for the scam. And with the advancement of AI-related tools widely available on the market, the malicious attacks of threat actors have become more efficient, effective, and profitable.

2. Availability of Phishing Kits
Phishing kits have empowered threat actors by providing them with professionally written, pre-built tools that enable them to launch phishing attacks with minimal effort or expertise. These kits, available for purchase on the dark web, contain thousands of lines of code and can be easily configured based on the attacker’s campaign. Following such an approach allows threat actors to launch campaigns quickly and effortlessly, making it difficult for defenders to keep up with the rapidly changing threat landscape.

3. Inadequate Security Awareness
The most significant vulnerability malicious actors exploit is the inadequate employee training on security awareness in some institutions, particularly in phishing and ransomware. This deficiency is the primary reason why such attacks continue to succeed. It can severely undermine employees’ ability to recognize phishing attacks and respond appropriately, resulting in devastating consequences. Failing to address this training and security gap leaves organizations vulnerable to threat actors who are too eager to exploit it.

Understanding the Connection Between Phishing and Ransomware

Phishing has emerged as the primary vehicle for delivering ransomware, making it the most significant cyber threat to organizations in recent years. 78% of organizations experienced at least one ransomware attack in 2021, with 68% attributing the cause to direct email payload or second-stage malware delivery. In addition to that, IBM’s Cyber Resilient Organization Study identified the top three causes of ransomware as phishing (45%), malicious websites (22%), and social media (19%). Phishing and ransomware are closely related because phishing is one of the root methods for delivering ransomware.

The success of a ransomware attack often depends on the attackers’ ability to deliver the malware to the victim’s system, which is why they frequently use phishing emails as a delivery method. The social engineering schemes, carefully crafted to appear legitimate and customized to specific targets, making them difficult to identify, and the sheer volume of emails received by individuals, especially students, has made it challenging for them to scrutinize incoming emails and note suspicious red flags, increasing successful phishing attacks.

Why are Educational Institutes Easy Targets for Phishing and Ransomware Threat Actors?

With limited IT resources, some educational institutes may be unable to keep up with patch management and other maintenance processes that keep systems safe from exploits. The inadequacy of cybersecurity countermeasures limited IT resources, and the pressure to deliver educational services make schools and educational systems an attractive target for malicious actors.

All educational institutes are not adequately immune to phishing and ransomware attacks, as revealed by an 18-year-old student named Bill Demirkapi at the recent Def Con hacker conference. Demirkapi revealed that his school’s software, including Blackboard’s Community Engagement software and Follett’s Student Information System, contained multiple vulnerabilities that could be exploited using SQL injection and XML inclusion attacks to steal PII (Personally Identifiable Information) or even manipulate grades.

Here are some recent ransomware attacks on school districts to showcase how all educational institutes are not safe:

- Louisiana Schools: Three school districts in Louisiana were targeted by a ransomware attacker in July 2019. It crippled several phones, IT systems and the state-activated emergency cybersecurity powers to bring in the National Guard and cyber experts.
- Columbia Falls School District: The school district was threatened by malicious actors with a data lockup expecting a ransom of $150,000. The attackers declared they would expose student names, addresses, and grades if they didn’t receive the demanded amount.
- Syracuse: The New York City schools were hit with a ransomware attack that locked down one of their computer systems. The district paid the ransom, partially covered by insurance, but they were still locked out of their servers even after paying the ransom.

How Can a Phishing Attack Lead to More Fatal Cyberthreats Like Ransomware?

A phishing attack is a common and effective method used by threat actors to gain unauthorized access to sensitive data in educational institutes by tricking victims into disclosing personal information or downloading malware. While phishing attacks seem independent, they could be a first step to more severe cyber threats such as ransomware, malware, data theft, and more.

Malicious actors often use phishing attacks to deliver ransomware or malware payloads because they can customize phishing emails to target specific individuals. In a successful phishing attack, the attacker can introduce ransomware into the victim’s system, rendering their data inaccessible unless a ransom is paid, causing significant harm to the victim.

Strategies for Preventing Phishing and Ransomware Attacks in Educational Organizations

Here are a few practical strategies for preventing phishing and ransomware attacks in educational institutes:

- Leveraging AI-Based Anti-Phishing Solutions: One vital strategy to prevent phishing and ransomware attacks in educational institutes is leveraging AI-based anti-phishing solutions. These solutions use machine learning algorithms to detect and block phishing emails before they reach their targets. They can also analyze email content and metadata to identify suspicious patterns and behavior, such as unusual IP addresses or domain names, and flag them for further investigation.
- Engaging a Trusted Vendor or Managed Security Service Provider (MSSP): Engaging a trusted vendor or MSSP is critical in preventing phishing and ransomware attacks in educational institutes. These providers have the expertise, experience, and resources to provide comprehensive security solutions, including threat intelligence, risk assessments, vulnerability management, and incident response. They can help educational institutes implement security best practices and provide ongoing support.
- Educate Faculty, Staff, and Students: Among the most effective ways to prevent phishing and ransomware attacks is educating everyone in the educational institution on the risks of such attacks. Conduct regular training sessions that help them identify and avoid suspicious emails, attachments, and links. This way, they can recognize phishing emails and report them to the IT department before any damage is done.
Implement a Strong Security Policy: The first step is establishing a robust security policy. School networks should block access to potentially risky sites, and student app downloads should be monitored and restricted. Educational institutions must also include mobile security in their cybersecurity strategies since threat actors often use mobile IoT devices, such as laptops, desktops, smartphones, or tablets, to gain access to the network. IoT device testing and implementing end-to-end encryption can significantly reduce the risk of attackers.
Access Control Implementation: Given that educational institutions have a vast network of students, teachers, and staff, it is crucial to implement access control measures that limit individuals’ access to only the required programs. IAM (Identity and Access Management) systems working on the ‘least-privilege’ and ‘need-to-know’ principles are found to be efficient in preventing malicious infiltration significantly. Access control offers two critical advantages. Firstly, it prevents unauthorized individuals from accessing sensitive information. Secondly, it limits attackers’ ability to cause harm if they compromise someone’s account.

Higher Ed must prioritize investing in modern and effective cybersecurity technologies to protect themselves against the constantly evolving threat of cybercrime.

Educational institutions face a significant threat from phishing attacks, which can escalate into more dangerous cyber threats like ransomware. To safeguard against such risks, educational institutes must proactively implement practical strategies for preventing and mitigating the damage caused by phishing attacks and other related cyber threats. It can be achieved by raising awareness among staff and students, implementing strong security measures, and working with experienced cybersecurity experts. Education institutes can ensure their systems and data safety and security by taking concrete steps, such as adopting AI-based anti-phishing solutions to keep their information assets secure from malicious actors.

Brad Hudson

VP of Cyber Security

About Columbia Advisory Group:
Columbia Advisory Group (CAG) is a leading Information Technology (IT) consulting firm. CAG’s team has assessed and helped improve the performance of more than 300 technology organizations and IT departments, including many higher education institutions, state agencies, and Fortune 50 customers. Practice specialty areas include Infrastructure, IT Service Management, Cybersecurity, and A/V Services. CAG improves business outcomes with IT insights and expert technical support. Based in Dallas, Texas, CAG works extensively with clients throughout the U.S. Contact us at info@columbiaadvisory.com.

Remaining Relevant in Higher Education Depends on a Digital Strategy

Posted on April 11, 2023April 13, 2023 by Tim Taylor

A primary business goal is to “Remain relevant, to stay in business.” Over the past decade, technology use in postsecondary education has increased significantly, driven by factors such as the growth of online and blended learning, the adoption of understanding management systems (LMS), the use of mobile devices and apps, and the integration of data analytics and artificial intelligence (AI) tools.

According to Education Data Initiative, college enrollment peaked in 2010, and the statistics indicate enrollment has declined nationally by 9.6% by 2020. (Source: Education Data Initiative - https://tinyurl.com/y3rc84xt)

Education Data Initiative

Digital Technology is a fundamental pathway for Higher Education organizations to remain relevant, make informed decisions about programs, bring about strategic decisions, and allocate resources effectively. However, pre-pandemic strategies and tactics still suffocate many institutional structures and governance models.

For several years, Educause has listed IT strategy, governance, and funding in its top 10 issues. Educause stated “Ensuring IT leadership is a full partner in institutional strategic planning” as its top issue for 2023 (Educause Top 10 IT Issues, 2023: Foundation Models). Further, “Digital capabilities have become a key success factor for colleges and universities.”

The recent pandemic heightened the importance of remote/online learning, prompting many institutions to scramble to enhance their supporting technology. (Source: Inside Higher Ed - https://tinyurl.com/j8kcntn2)

Inside Higher Ed

As a technology leader, I consistently review business strategy plans within the Higher Education sector. A common thread among these strategies is the emphasis on growing student enrollment. However, I’ve noticed that many of these plans do not explicitly include a robust digital technology infrastructure to support these ambitious objectives. This oversight presents a significant challenge, especially when institutions face constraints such as limited or declining student populations, regional boundaries, or cost barriers.

The U.S. Census Bureau predicts that the number of postsecondary eligible 18-year-olds will decrease starting in 2025, increasing competition for enrollment. (Source: U.S. Census Bureau - https://www.census.gov/newsroom/press-releases/2020/school-enrollment-projected.html)

U.S. Census Bureau

The future of higher education will need to look at technology as an enabler, as a “full partner in institutional strategic planning,” rather than a black hole for expenses. Transforming the organization requires a fundamental shift in Digital Governance from the top down.

Tactics without strategy is the noise before defeat.

Shadow technology groups outside of IT abound in Higher Education. Spending on new technologies outside of IT without cost rationalization or metrics on benefits erodes the available budget. Often these expenditures, whether impactful or not, continue. Budgets come under increasing pressure without a regular cross-department spending analysis.

Higher Education IT Departments tend to be highly reactive (justify improvements per incident), change only when an audit is failed, have just enough funding to keep the lights on, and can’t say “NO” to technology requests. CapEx spending by projects often contributes to the bloating year-over-year OpEX expenditures. Every CapEx expenditure has associated, ongoing OpEx costs to support the IT Services Portfolio. IT is tactically fighting the battles as best they can, without a clear strategy to guide them or prioritize.

Chaos does not scale…well.

Can your organization, not just IT, explain its digital strategy clearly, and provide evidence of investments toward modernizing its digital ecosystem to match the 5-10 strategic plans?

A good (not perfect) digital strategic plan is needed. Oversimplified, a good plan needs three things:

- Unwavering Executive support and alignment across the senior executive leadership.
- An achievable timeline.
- Dedicated, rationalized funding and associated benefits.

Missing any one of these and it’s considered a poor plan. A good strategic plan coupled with an excellent tactical plan is the key to winning the battle. Simply put, if your organization does not have a digital strategy created by a technology governance function aligned with the organization’s strategy, your ability to remain relevant will reach a tipping point. In The Art of War”, military strategist Sun Tzu stated, “Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat.”

What Can We Do?

There isn’t a single solution, but there is a path to position the organization for a higher opportunity of success.

Make the senior IT person (CIO, CTO, etc.) a full partner in strategic planning, not just a subordinate capability.
Leverage ISO38500 “Information technology (IT) — Governance of IT for the organization.”
This standard provides guiding principles for members of governing bodies of organizations on the effective, efficient, and acceptable use of information technology within their organizations. This international standard is intended to facilitate an organization’s digital strategy governance.
Establish at the highest level an IT Steering committee or Technology Advisory board.
A steering committee with broad representation with a charter to serve the organization, not just independent interests, which address:
- Technology Service Portfolio management
- Financial management
- Demand Management
- Risk Management
Conduct an Executive Business Technology Agenda Workshop.
Understand IT delivery models and establish guiding principles and drivers that are the rationale for the Business, Functional, Technical, and Implementation goals and plans.
Create a service-centric IT organization.
Everything IT does is a Service. This doesn’t mean any request but an intentional, strategic set of services and processes. Retire digital offerings that don’t provide a critical or strategic advantage or value proposition.

When is the best time to plant a tree?

This has the same answer as “When should we start?

10 years ago.

When ITs customers complain about IT, it’s usually not about the technology but the organization’s governance and processes. Good leadership, strategy, processes, and people enable an organization to:

Exhibit management control of your environment as you move forward; and
Doing the correct things and doing those things correctly

When an institution can manage IT services effectively, it can sharpen its focus, increase its value while reducing cost and increasing margins, and thus remain relevant.

Tim Taylor

Tim Taylor has worked in technology for over 35 years. He has recently focused on the Higher Education vertical. Tim has helped over 60 organizations in multiple industries (Oil/gas, Financial, government, transportation, hospitality, healthcare, etc.) with their IT business challenges, leading numerous IT Service Management assessments, executive workshops, and implementations. He has trained over 2,000 consultants.

Why Higher Education Should Consider Implementing an eSports Program to Improve Enrollment

Posted on April 4, 2023April 13, 2023 by John D'Annunzio

As the world of esports continues to grow, colleges and universities are beginning to take notice of the potential benefits of incorporating esports programs into their curriculum. From increasing enrollment to providing students with valuable skills, esports programs have the potential to have a positive impact on higher education institutions.

One of the most significant benefits of esports programs is the potential to increase enrollment. According to a report by Inside Higher Ed, colleges and universities with esports programs have seen an increase in enrollment, particularly among male students. The report states that “colleges are finding that offering esports programs can help them attract and retain students who might not otherwise be interested in attending college.” This is also supported by a recent study by EdTech Magazine, which found that colleges and universities that have implemented esports programs have seen an increase in enrollment and retention.

But it’s not just about the enrollment numbers, esports programs can also provide students with valuable skills that are in high demand in the workforce. Esports requires a combination of teamwork, communication, strategy, and critical thinking. These skills are transferable to many different industries, including game development, streaming, and marketing. According to a report by AV Network, “esports programs offer students the opportunity to develop and enhance skills that are in high demand in today’s job market, such as teamwork, communication, problem-solving, and critical thinking. These skills are not only important for success in the esports industry but also for a wide range of other industries.”

Furthermore, esports programs can also provide a pathway for students to pursue careers in the rapidly growing esports industry. According to Fortune Business Insights “The global eSports market is projected to grow from $1.44 billion in 2022 to $5.48 billion by 2029, at a CAGR of 21.0% in forecast period, 2022-2029. (https://www.fortunebusinessinsights.com/esports-market-106820). As the industry continues to grow, so will the demand for professionals with expertise in areas such as game development, streaming, and marketing. This is supported by another recent study by SportsEngine, which found that “colleges and universities that offer esports programs are providing students with a pathway to careers in the rapidly growing esports industry.”

Another benefit of esports programs is the opportunity to foster a sense of community and belonging on campus. According to a report by the Higher Education Video Game Alliance, “esports can be an effective way to create a sense of community and belonging for students who may not otherwise find it in traditional student groups.” This is especially important for non-traditional students who may not have the same opportunities to participate in traditional sports or extracurricular activities.

In addition, many colleges and universities are beginning to offer scholarships for esports programs, providing students with the opportunity to earn money to pay for their education while also participating in their passion for esports. This is a great way to attract and retain students who may not have the financial means to attend college otherwise.

Furthermore, esports is a way to keep students engaged and motivated to stay in school. Esports program provides students with an opportunity to experience the same level of competitive excitement and camaraderie as traditional sports, while also providing a pathway to careers in the esports industry.

However, it is important to note that implementing an esports program is not without its challenges. One of the biggest challenges is the lack of funding for esports programs. Many colleges and universities struggle to secure funding for their esports programs, which can limit their ability to provide students with the resources and support they need to be successful. Additionally, it can be difficult for schools to build the infrastructure and support systems needed to sustain an esports program in the long term.

In conclusion, higher education institutions should consider implementing esports programs to improve enrollment and retention. Esports programs can provide students with a unique opportunity to develop valuable skills, pursue careers in the esports industry, and improve the college experience especially for non-traditional students.

Shane Hudson

AV Practice Director

How Can Predictive Analytics Help with Higher Education Retention

Posted on March 30, 2023March 30, 2023 by John D'Annunzio

Higher education institutions are constantly looking for ways to improve student retention rates, and analytics can provide invaluable insights into how to do that. Through predictive analytics, colleges and universities can identify current and potential students who may be at risk of dropping out or not completing their degrees on time. By utilizing data-driven methods to identify warning signs such as a lack of engagement or poor grades, administrators can take proactive steps to address these issues before they become too serious.

For example, Degree Analytics is a company that offers an AI-based platform that tracks student data to predict risk factors. It collects information from admissions applications, transcripts, course records, and surveys – then uses machine learning algorithms to analyze the data and send targeted interventions when students are deemed at risk of leaving. These personalized interventions (such as targeted emails, text messages, or phone calls) enable institutions to reach out directly to students in need more quickly and effectively than ever.

Another way higher education institutions can use analytics to improve student retention is by creating personalized education plans for each student. By combining analytic tools with existing university resources, administrators can develop a comprehensive plan tailored to each student’s academic goals and strengths. This will enable them to get ahead in their studies faster and more effectively and stay on track toward graduation.

Finally, analytics can aid higher education institutions in developing better communication strategies between faculty and students – allowing them to understand better what’s working well (and where there’s room for improvement). By tracking what topics are discussed during lectures or which teaching techniques tend to lead to improved performance among different learners, faculty members can adjust their approach accordingly – leading to more successful outcomes in the classroom.

In summary, there’s no doubt that using analytical processes can help higher education institutions increase their student retention rates – enabling them to retain more students and create a better college experience overall. Several companies have already developed powerful platforms that utilize sophisticated analytical techniques; such tools allow administrators to take advantage of these benefits immediately and see marked improvements over traditional methods.

Ming Luong

Delivery Director

Proper Post Implementation ERP System Maintenance

Posted on March 28, 2023March 28, 2023 by Ming Luong

Enterprise Resource Planning (ERP) systems have revolutionized how organizations manage resources, streamline processes, and make data-driven decisions. They deliver various benefits, from enhanced efficiency and visibility to standardized processes, increased customer satisfaction, and reduced costs. According to a report by Panorama Consulting Solutions, large organizations have embraced ERP systems, with 81% of organizations with annual revenues over $1 billion and 68% of organizations with annual revenues between $500 million and $1 billion implementing them. The adoption rate for organizations with annual revenues between $50 million and $500 million is steadily increasing, currently at 26%.

Despite the numerous advantages of ERP systems, the critical aspect of post-implementation maintenance is often overlooked. Failing to maintain and update the system can lead to it becoming outdated, unstable, vulnerable to security threats, and ultimately requiring significant investments in time, money, and expensive labor to replace. As such, it is essential to establish a comprehensive maintenance plan and system maintenance life cycle to ensure the system remains stable and secure and performs optimally.

A well-designed maintenance plan specifies the schedule and procedures for regular maintenance activities, such as updates, backups, and security checks. It should be reviewed and updated regularly to account for system requirements or business needs changes. Key components of the maintenance plan include regular system updates, data backups, security checks, performance monitoring, and user training. In addition to the maintenance plan, organizations should establish appropriate environments and a system maintenance life cycle to support their maintenance activities.

The system maintenance life cycle typically comprises four stages: planning, analysis, implementation, and evaluation. During the planning stage, the maintenance plan is created, including the schedule for regular maintenance activities and the resources required to carry them out. The analysis stage involves examining the system to identify potential issues or conflicts that may arise during the maintenance process. In the implementation stage, maintenance activities are performed, and changes are thoroughly tested in a non-production environment before being deployed to the production environment. Finally, in the evaluation stage, the effectiveness of the maintenance activities is assessed, and any necessary adjustments are made to the maintenance plan.

System maintenance can be divided into patch maintenance, upgrades, and enhancements. ERP vendors typically provide patches and upgrades to keep their systems current and secure. Patches are relatively easy to install and address specific bugs in processes or legal changes mandated by legislation. On the other hand, upgrades usually consist of monthly or quarterly maintenance/minor upgrades and a major upgrade every three years. Major upgrades can take several months to install but are essential for keeping systems up-to-date and running smoothly. Enhancements involve adding new features or functionality to the system, ranging from simple to complex.

A robust ERP maintenance strategy experiences fewer issues, better system performance, and lower total cost of ownership (TCO) over time (Source: Deloitte, “Optimizing ERP Maintenance and Support”). This highlights the importance of investing in a comprehensive maintenance plan and adhering to a well-defined system maintenance life cycle.

When implementing an ERP system, organizations should also consider the potential risks and challenges associated with system maintenance. These may include data migration issues, integration complexities, and employee resistance due to changes in work processes. To mitigate these risks, organizations can follow best practices such as involving key stakeholders in planning, establishing clear communication channels, and providing adequate user training and support.

Successful implementation of an ERP system does not end with its deployment. Organizations must recognize the importance of ongoing maintenance to ensure the system remains stable, secure, and effective in delivering the desired benefits. By establishing a comprehensive maintenance plan and system maintenance life cycle, organizations can optimize the performance of their ERP systems, reduce costs, and improve overall efficiency.

Another critical aspect of ERP maintenance is monitoring and measuring the system’s performance. Key Performance Indicators (KPIs) can help organizations track their maintenance efforts’ effectiveness and identify improvement areas. By regularly analyzing these KPIs, organizations can make informed decisions about resource allocation, prioritize maintenance activities, and ensure their ERP system continues to deliver value.

Organizations should also consider leveraging advanced technologies, such as Artificial Intelligence (AI) and Machine Learning (ML), to enhance their ERP maintenance efforts. These technologies can help automate routine maintenance tasks, predict potential issues before they escalate, and optimize system performance. By embracing these innovative solutions, organizations can stay ahead of the curve and ensure their ERP systems remain reliable, secure, and efficient.

In addition to these strategies, organizations should foster a continuous improvement culture and encourage employees to participate actively in the maintenance process. By involving end-users in identifying system issues, organizations can ensure that their maintenance efforts address real-world problems and lead to tangible improvements in system performance. This collaborative approach can also help build a sense of employee ownership and commitment, leading to higher user satisfaction and system adoption.

Organizations should remain vigilant about the ever-evolving cybersecurity landscape and protect their ERP systems against emerging threats. Regular security audits, vulnerability assessments, and penetration testing can help identify potential weaknesses in the system and provide valuable insights for strengthening its defenses. By prioritizing security in their maintenance efforts, organizations can safeguard their critical data and business operations from the risks posed by cybercriminals.

The ongoing maintenance of an ERP system is crucial to its ability to deliver value to the organization. By developing a comprehensive maintenance plan, adhering to a well-defined system maintenance life cycle, and leveraging best practices and advanced technologies, organizations can optimize the performance of their ERP systems and drive continuous improvement across their business operations.

References:

Panorama Consulting Solutions. (2018). “2018 ERP Report” [PDF file]. Retrieved from https://www.panorama-consulting.com/resource-center/erp-report-archive/2018-erp-report/ This report provides statistics on ERP system adoption rates and trends across different industries and organization sizes.
Deloitte. (n.d.). “Optimizing ERP Maintenance and Support.” Retrieved from https://www2.deloitte.com/content/dam/Deloitte/xe/Documents/technology/erp/ME_PoV_Optimizing_ERP_maintenance_and_support.pdf This document from Deloitte provides insights and best practices for optimizing ERP maintenance and support to improve system performance and reduce total cost of ownership.
Brehm, H., Heinzl, A., & Markus, M. L. (2001). Tailoring ERP systems: a spectrum of choices and their implications. Proceedings of the 34th Annual Hawaii International Conference on System Sciences. doi: 10.1109/HICSS.2001.927045 This research paper discusses the challenges and risks associated with ERP system maintenance and provides recommendations for tailoring ERP systems to meet specific organizational needs.
Ahmad, M., & Cuenca, R. P. (2013). Critical success factors for ERP implementation in SMEs. Robotics and Computer-Integrated Manufacturing, 29(3), 104-111. doi: 10.1016/j.rcim.2012.04.019 This research paper discusses critical success factors for ERP implementation in small and medium-sized enterprises, including the importance of ongoing maintenance and user training.
Gartner. (2020). “Magic Quadrant for ERP Systems.” Retrieved from https://www.gartner.com/en/documents/3989363/magic-quadrant-for-cloud-erp-for-product-centric-enterpr This report by Gartner provides an overview of the ERP market, including trends, vendor analysis, and recommendations for ERP system selection, implementation, and maintenance.

Ming Luong

Delivery Director

How Educational Institutions Can Choose the Most Effective Wi-Fi Security Solutions to Protect their Critical Information Assets

Posted on March 9, 2023March 22, 2023 by Sameer Vitvekar

Educational institutions have large amounts of critical data at risk like any other organization. Hence, Wi-Fi security and the right solutions are vital for such organizations. This article will examine the importance of Wi-Fi security solutions for educational institutions and explore effective strategies to safeguard their critical data from today’s cyber threats.

Wi-Fi networks have become an integral component of the day-to-day operations of educational institutions, highlighting the critical need for robust security measures to mitigate potential cyber threats. This extensive reliance on technology brings a new set of challenges for IT administrators, as the security of these networks is constantly at risk. Hence, educational institutions must choose the most robust Wi-Fi security solutions to protect their critical information assets.

This article discusses the key considerations when choosing the best Wi-Fi security solutions for educational institutions and the importance of staying ahead regarding security threats.

Critical Information Assets That are at Risk in Higher Education

Educational institutions have a wide range of critical information assets at risk of being compromised in today’s world, which is increasingly digitized. These assets may include student and faculty records, intellectual property, financial data, and other confidential and sensitive information.

The risks associated with such assets can range from data breaches and identity theft to ransomware and malware attacks. Therefore, educational institutions must proactively protect their critical information assets. That includes implementing robust security measures such as data encryption, secured Wi-Fi connection, firewall protection, and regular security audits.

Wi-Fi Security: Significance for Schools, Colleges, and Universities

The importance of Wi-Fi security in educational settings should not be underestimated. Wi-Fi has become an essential part of the digital learning environment, and its security is vitally important for the safety of educational institutions like schools, colleges, and universities. These institutions must have strong Wi-Fi security measures to prevent malicious attacks on their networks that could potentially lead to a data breach.

That is particularly true for universities, which often store sensitive research data on their networks. By implementing robust Wi-Fi security measures, such as authentication, encryption, password policies, and other security policies and procedures, universities can protect their research data and ensure their networks remain safe from malicious activity.

Choosing the Most Effective Wi-Fi Security Solutions: Key Considerations

You will come across many options when selecting the most effective Wi-Fi security solutions. Understanding the following key considerations in the selection process is critical to ensure the most efficient and secure outcome.

Choosing an AI-Driven Solution

One of the more recent options available for Wi-Fi security is using an AI-driven solution. Such a solution can provide many benefits, including improved network performance and enhanced security. AI-driven solutions are specifically designed to detect and prevent malicious activity on a Wi-Fi network. Using machine learning algorithms, these solutions can quickly detect and block malicious activity and provide real-time reporting and alerting of potential threats.

AI-driven security solutions can integrate automated and intelligent threat detection, analysis, and response capabilities into the security infrastructure. That provides a higher level of protection for Wi-Fi networks by allowing faster and more accurate detection of malicious activity and the ability to respond to potential threats in real time. Furthermore, AI-driven security solutions can continuously learn and adapt to changing network environments, allowing organizations to stay ahead of the latest threats.

Wireless Network Security Protocol

When it comes to wireless network security, choosing an effective and reliable solution is paramount. Different security solutions offer various levels of protection and come with multiple features and capabilities.

The three main types of Wi-Fi security protocols include Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), and Wi-Fi Protected Access II (WPA2). Each option offers different levels of protection and has advantages and disadvantages.

Wired Equivalent Privacy (WEP)

Wired Equivalent Privacy, commonly known as WEP, is a security protocol used on a Wi-Fi network to provide an encrypted connection between a wireless access point and a client. WEP was first introduced in 1999 but has since been replaced by more secure protocols, such as WPA and WPA2. However, WEP is still commonly used in older Wi-Fi networks or networks with a limited budget.

The encryption protocol used by WEP is based on the RC4 stream cipher. As a result, it is vulnerable to several attacks, such as replay attacks, weak IVs (initialization vectors), and key cracking. These vulnerabilities are amplified when the WEP key is short or weak.

Wi-Fi Protected Access (WPA)

Wi-Fi Protected Access, often called WPA, is a security protocol to protect wireless networks from unauthorized access. WPA advances the Wired Equivalent Privacy (WEP) protocol, the original security standard for wireless networks. WPA was created to address the vulnerabilities of WEP and provide a more secure and robust protocol for wireless communications.

WPA uses encryption and authentication to protect communications over a wireless network. The encryption is implemented through TKIP (Temporal Key Integrity Protocol), designed to dynamically generate a new encryption key for each data packet transmitted.

Wi-Fi Protected Access II (WPA2)

WPA2 is an IEEE (Institute of Electrical and Electronics Engineers) 802.11i protocol released in 2004 as an advanced security protocol for wireless networks, replacing the older one. WPA2 provides more security than WPA by employing the Advanced Encryption Standard (AES) to encrypt data and authentication.

WPA2 also increases the strength of a wireless network by using a longer and more complex key that requires authentication from both the wireless access point and the client.

Selection of a Trusted Solution Provider

Another critical consideration when looking for the most effective Wi-Fi security solutions is to choose a trusted solution provider. It is of paramount importance as the security of the Wi-Fi network will depend on the quality of the solutions provided.

It is vital to ensure that the solutions being used comply with applicable security regulations while providing the necessary levels of protection. Additionally, they should be designed to minimize the risk of malicious attacks and protect data and confidential information. The provider should also have a comprehensive support system to assist in the event of an issue or problem.

Migrating from WPA2 to WPA3, and Why Does it Matter?

WPA3 offers a more secure and reliable Wi-Fi network than the older WPA2 protocol. WPA2 and WPA3 are two widely used security protocols in Wi-Fi network systems. Migrating from WPA2 to WPA3 is increasingly becoming necessary for many organizations.

WPA2 was first introduced in 2004 and is still used by many organizations despite its known vulnerabilities. WPA3, on the other hand, was designed to address these vulnerabilities, as it is based on a more advanced security protocol called Simultaneous Authentication of Equals (SAE). This protocol uses more robust encryption algorithms and provides more secure authentication methods than WPA2. WPA3 includes an “Individualized Data Encryption” feature, which provides a unique encryption key for each user, making it even more secure.

Best Practices for Wi-Fi Security in Educational Institutions

The following are the best practices all educational institutions must adopt to ensure the security of their Wi-Fi network and critical data assets.

Implement strong password policies and best practices for secure Wi-Fi network usage.
Use advanced encryption protocols like WPA2 or WPA3 to secure the institution’s Wi-Fi network.
Utilize firewalls and WAF (Web Access Firewall) to protect an institution’s on-premise and cloud infrastructure and create a secure barrier for adversaries.
Regularly patch and update existing networks, devices, and operating systems.
Use anti-phishing, antivirus, and antimalware software solutions that leverage AI (Artificial Intelligence).
Limit access to certain services and sites by leveraging whitelisting and blacklisting to control the ingress and egress traffic.
Implement a guest and BYOD (Bring Your Own Device) remote access policies, start implementing a zero-trust approach, and limit access to the network from non-school devices.

As educational institutions become increasingly connected and digitalized, they must ensure they have the most secure Wi-Fi and network through efficient security solutions. By selecting the correct security protocols, restrictions, and authentication mechanisms, educational institutions can ensure that critical information and students’ data remain fully protected. Also, risk assessments are vital to ensuring that all possible vulnerabilities are identified and rectified, allowing for a securely connected environment.

About Columbia Advisory Group:
Columbia Advisory Group (CAG) is a leading Information Technology (IT) consulting firm. CAG’s team has assessed and helped improve the performance of more than 300 technology organizations and IT departments, including many higher education institutions, state agencies, and Fortune 50 customers. Practice specialty areas include Infrastructure, IT Service Management, Cybersecurity, and A/V Services. CAG improves business outcomes with IT insights and expert technical support. Based in Dallas, Texas, CAG works extensively with clients throughout the U.S. Contact us at info@columbiaadvisory.com.

References

Efforts Solutions. Artificial Intelligence (AI) driven Smart Wi-Fi. Retrieved February 16, 2023, from Efforts Solutions IT website: https://effortz.com/ai-driven-smart-wifi/
Irei, A. & Scarpati, J. (2022, December). Wireless security: WEP, WPA, WPA2 and WPA3 differences. Retrieved February 16, 2023, from Networking website: https://www.techtarget.com/searchnetworking/feature/Wireless-encryption-basics-Understanding-WEP-WPA-and-WPA2
Kerravala, Z. (2019, March 6). Why Wi-Fi needs artificial intelligence. Retrieved February 16, 2023, from Network World website: https://www.networkworld.com/article/3355237/why-wi-fi-needs-artificial-intelligence.html
Leininger, L. (2022, August 1). 2022 Public Wi-Fi Statistics: How do we use it and is it safe? Retrieved February 16, 2023, from Highspeedinternet.com website: https://www.highspeedinternet.com/resources/public-wi-fi-statistics
Metzler, S. WPA3: The ultimate guide. Retrieved February 16, 2023, from SecureW2 website: https://www.securew2.com/blog/wpa3-the-ultimate-guide
Security Uncorked. Wi-Fi security: WPA2 vs. WPA3 – security uncorked. (n.d.). Retrieved February 16, 2023, from Securityuncorked.com website: https://securityuncorked.com/2022/08/wifi-security-wpa2-vs-wpa3/
Mordor Intelligence. Wireless Network Security Market. (n.d.). Retrieved February 16, 2023, from Mordorintelligence.com website: https://www.mordorintelligence.com/industry-reports/wireless-network-security-market
The Best Practices for School Network Security in 2020. Smile Business Products. https://www.smilebpi.com/the-best-practices-for-school-network-security-in-2020/
Hommel, W., Metzger, S., & Steinke, M. (n.d.). Information Security Risk Management in Higher Education Institutions: From Processes to Operationalization. Retrieved February 17, 2023, from Eunis.org website: https://www.eunis.org/download/2015/papers/EUNIS2015_submission_48.pdf

Jason Claybrook

Strategic Consultant and Certified Wireless Design Professional (CWDP), Certified Wireless Security Professional (CWSP), Certified Wireless Network Administrator (CWNA)

How Higher Education Registrars Benefit from 3rd Party Ellucian Banner and Degree Works

Posted on March 7, 2023March 14, 2023 by Haley Rose

Higher education Registrar Offices play a crucial role in maintaining and updating student records, which include academic, personal, and financial information. With the advancement of technology, most colleges and universities use Ellucian Banner and Degree Works software to manage and store these records. However, managing these systems can be challenging, especially with the increasing complexity of the software. This is where the benefits of having access to a consultant who performs both functional and technical work on Ellucian Banner and Degree Works come into play.

Increased Efficiency

A consultant who is knowledgeable in both the functional and technical aspects of Ellucian Banner and Degree Works can provide Registrar Offices with the support they need to increase their efficiency. They can help streamline processes, automate tasks, and provide guidance on best practices, saving time and reducing errors.

Improved Data Management and Governance

Registrar Offices have access to a vast amount of sensitive and confidential student data. A consultant can assist with data management ensuring that data is stored and processed securely and accurately. They can also assist with data migration and integration, making it easier for Registrar Offices to transfer data from one system to another. This can expand to include the larger process of data governance to help ensure the quality and reliability of the data.

Enhanced User Experience

Ellucian Banner and Degree Works are complex systems; navigating them can be challenging. A consultant can help Registrar Offices to understand the software better, providing training and support to ensure that users can perform their tasks effectively and efficiently.

Improved Integration

Ellucian Banner and Degree Works integrate with other systems, such as enrollment and financial aid systems. A consultant who is knowledgeable in both functional and technical aspects of the software can assist Registrar Offices with the integration of these systems, ensuring that data is exchanged and processed correctly.

Cost Savings

Hiring a consultant who performs both functional and technical work can save Registrar Offices money in the long run. They can assist with troubleshooting and resolving technical issues, reducing downtime and the need for additional support. They can also provide training and support to ensure that users are able to perform their tasks effectively, reducing the need for external support.

In conclusion, Higher Education Registrar Offices that have access to a consultant who performs both functional and technical work on Ellucian Banner and Degree Works can benefit from increased efficiency, improved data management, enhanced user experience, improved integration, and cost savings. These benefits make it easier for Registrar Offices to manage student records and provide a better experience for students, staff, and faculty.

Dana Salinas

Banner Team Lead

Staying ahead of the Technology Curve. Why it is Important to Have a Planned Hardware Refresh Cycle

Posted on February 21, 2023March 28, 2023 by John D'Annunzio

A common challenge in higher education often centers around managing technology lifecycles, which can be crucial. Technology is constantly evolving and improving, and hardware can quickly become outdated. At times, even before it has been installed and put into service. In addition, every capital equipment purchase incurs expense costs regarding support agreements, labor for supporting assets, configuring assets, patches, etc.

Technology departments continually work towards addressing the challenges which include, but are not limited to:

- Planning changes, upgrades, and budgeting, including depreciation of assets.
- Management and justification of unplanned cost per incident (i.e., fix on failure) due to asset failure and replacement.
- Mitigating risk related to security, reliability, performance, usability, obsolescence/maintainability, etc.
- Addressing audit findings for at-risk assets no longer supported by the vendor.
- Elevating resource skill sets, knowledge and maintaining technical relevance.

Refreshing technology is of vital importance. The inhibitors to these challenges are often external: IT models driven by departmental projects and CAPEX budgets inherent in a cost center model.

One example of refreshing hardware’s importance is seen in the aviation industry, as outlined in a recent Wall Street Journal article. The Federal Aviation Administration (FAA) issued a “Notice to Airmen” (NOTAM) warning pilots and airlines about the potential risks of using older navigation hardware. The NOTAM stated that some older navigation hardware might not properly process satellite signals transmitted by the next generation of GPS satellites. This highlights the importance of regularly upgrading and refreshing hardware to stay current with the latest technology and ensure systems function properly.

The higher education market greatly benefits from a managed approach to upgrading and refreshing hardware. With the growing emphasis on technology in classrooms, universities and colleges must ensure that their hardware is up to date to provide students with the best possible learning experience. This includes upgrading and refreshing equipment such as computer labs, classrooms, and lecture halls. Obsolete computer equipment will no longer be able to support the current Operating Systems (OS), thus no longer be supported for security patching. They may also not support modern software. Upgrading hardware also allows institutions to adopt new and innovative teaching methods, such as online and blended learning, which are becoming increasingly popular.

Higher Education can mitigate some of these costs by leveraging cloud technologies for servers. Using capital server purchases requires purchasing hardware to meet peak demand, thus, over-purchasing capacity is needed for only 20% of the year. Cloud technologies can provide right-sized servers with in-place server “upgrades” or “downgrades” dynamically. This provides better cost management. It also offers the advantage of reducing the number of servers where a single, more powerful computer can be used to consolidate multiple smaller servers, thus lowering overall cost and support effort.

Yet some hardware assets live on the campus, such as external and in-building network infrastructure and classroom technologies. Failure to keep up with network technologies can translate into poor performance with newer laptops/phones/tablets, etc. In addition, known security vulnerabilities in obsolete equipment pose a significant risk. Cybersecurity audit findings for obsolete network equipment can cost millions of dollars to retrofit.

In conclusion, upgrading and refreshing hardware is essential to maintaining any system’s reliability and efficiency. This is particularly true in industries that rely heavily on technology, such as aviation, commercial, and higher education markets. Staying current with the latest hardware allows businesses and organizations to improve efficiency, stay competitive and provide the best possible service to customers and students. Staying current with technology is a strategic and financial decision. Can businesses afford to wait to invest in technology only after failure?

Leaders need to pay attention to the technology mix within their organization. As technology stacks reach their peak simultaneously, the organization’s resources will be consumed by operational plays while contributing little to strategic development. Consequently, leaders face the challenge of escaping the trap of rigidly staying too long with a set of successful technology ventures. New technology platforms are always needed, and the skills to transform from old to new are demanded.

Tim Taylor

Director ITSM

Why are Compliance and Related Controls so important in IT?

Posted on February 14, 2023March 14, 2023 by David McLaughlin

Policies and industry standards help to ensure the confidentiality, integrity, and availability of sensitive information. For example, higher education institutions must protect student data and financial information through FERPA and other regulations, healthcare organizations must comply with HIPAA regulations to protect patient information, and financial institutions must comply with PCI-DSS to protect credit card information. Compliance with these regulations helps prevent data breaches and other security incidents that could significantly harm individuals or organizations.

Maintaining compliance helps to protect organizations from financial and reputational damage. Failing to comply with regulations can result in significant fines and penalties and damage to the organization’s reputation. For example, organizations that fail to comply with GDPR can be fined up to 4% of their annual revenue or $20 million, whichever is greater.

Maintaining regulatory compliance also helps to ensure the proper functioning of IT systems and processes. For example, IT general controls such as change management and incident management help to ensure that changes to systems and processes are made, controlled, and authorized and that incidents are quickly identified and resolved. One of the biggest causes of a data breach is the failure to patch software systems, so many companies and institutions have policies and compliance controls to ensure this is done. This helps minimize the risk of system failures and other issues that disrupt business operations.

In summary, compliance and related IT controls are critical for protecting sensitive information, preventing financial and reputational damage, and ensuring the proper functioning of IT systems and processes.

Gartner and EDUCAUSE recognize this importance and have published several reports, papers, and studies on the topic. Gartner, for example, has published reports on IT risk management and compliance, as well as studies on developing a successful compliance program. EDUCAUSE has published several papers and guides on various compliance-related topics, such as data security and HIPAA compliance for higher education institutions. Both organizations offer a wealth of information, guidance, and best practices for organizations looking to improve their compliance and control practices.

David McLaughlin

CEO

Do’s and Dont’s of Software Selection

Posted on February 9, 2023March 14, 2023 by David McLaughlin

Software selection is a crucial process for organizations looking to enhance their productivity and efficiency. The right software can streamline processes, automate manual tasks, and provide valuable insights into business operations. However, making the wrong selection can lead to frustration, wasted resources, and a negative impact on productivity. At CAG, we do many software selection projects for clients as a standalone or part of more extensive managed service agreements. In this blog post, I will discuss some of the dos and don’ts of software selection we have learned over the years.

Do’s of Software Selection

Buy In:
Ensure you have the right stakeholders involved and committed to the process. Educate them on why the process is necessary, how long it will take, and what their time commitment will need to be.

Define your requirements:
Before searching for the right software, you must define your requirements. This includes identifying the specific business problems you want to solve and the features and capabilities required to address them.

Consider your budget:
Software selection involves making a significant investment, so it’s essential to consider your budget. Determine how much you’re willing to spend and look for software that offers the needed features within your budget constraints.

Consider alternatives:
Upgrading or adding capabilities to existing systems, better user training, and/or enhanced support. Sometimes the best solution is already there and needs to be better utilized.

Research potential vendors:
Do your research on potential vendors. Look for a vendor with a proven record, a compelling reputation, and a history of providing high-quality software solutions.

Evaluate vendor support:
Consider the level of support you’ll receive from the vendor. Look for a vendor that offers excellent customer support, including training, technical support, and maintenance.

Don’ts of Software Selection

Don’t rush the process:
Software selection is a complex process that requires careful consideration and research. Don’t rush the process, or you may make a hasty decision that you’ll regret later.

Don’t forget about scalability:
When selecting software, it’s important to consider the future. Don’t forget to look for software that is scalable, so you can continue to use it as your business grows.

Don’t forget about the soft costs:
Large-scale organizational change can cause a lot of uncertainty with users, negatively impacting productivity and your vendors and customers.

Don’t overlook security:
Security is a critical concern in today’s digital world, and some organizations also have regulatory requirements for security. Don’t overlook this factor when selecting software, as a security breach can seriously affect your organization.

Don’t rely solely on vendor presentations:
Vendor presentations can be misleading, and it’s important to do your research.

Expect the unexpected:
Users will find potential solutions that haven’t been considered until the middle of the process, and vendors who have capabilities that weren’t surfaced in the research will pop up. Maintain your process, but make sure you have a way of managing added information that comes up during the process.

In conclusion, the software selection process is critical to the success of any organization. By following the do’s and don’ts of software selection, according to Gartner, organizations can make informed decisions that will lead to enhanced productivity, efficiency, and profitability. The key is to take the time to involve stakeholders in the process, define your requirements, research potential vendors and options, and carefully evaluate and plan for the impact the solution will have on the organization. With careful consideration and diligence, organizations can find the right software to meet their needs and achieve their goals.

David McLaughlin

CEO