Cybersecurity Programs & Initiatives

Illinois Security Program

The university’s overarching mission is being a world-class teaching and research institution. The goal of the Illinois Security Program is to enable instructors, researchers, staff and students to achieve this mission while keeping education and research data they work with secure, available and ensuring its integrity. Being a world class research institution we deal with a vast array of data that makes us a target. Failure to secure this data can lead to costly financial penalties and a loss of the institution’s reputation. The Illinois Security Program lessens the cost of security incidents ensuring that the university’s resources are focused on the main mission of teaching and research.

Major goals

1. Simplified. The program’s standards and framework are a simplified version of the National Institute of Standards and Technology Special Publication 800-53. Our standards cover 30 specific risk areas that map back to one or more NIST requirements. NIST was chosen because The Federal Information Security Management ACT designates NIST as the organization responsible for developing standards and guidelines for most federal grants and agencies. 
2. Unified. Settle the “best practices” question by tying information security requirements to an externally recognized framework of security controls, the NIST standards.
3. Prioritized. Standards typically don’t offer a way to prioritize risks. The new program specifies three risk levels, making it clear which risk to address first:
   • Critical Priority (P1)
   • High Priority (P2)
   • Medium Priority (P3)
4. Shared. The Illinois Information Risk Management Program is built on the premise that information security and risk management is a shared university responsibility, not exclusively an IT responsibility.

Program components

The Information Technology Security Policy (INFOSEC) establishes high-level information security requirements. The INFOSEC provides the mandate for the Security Program. It establishes the overall intent of the university to support and promote information security in all its practices.

Information Security Standards define 30 risk areas for the university. Each risk area includes a security objective. These risk areas are used to organize, measure and manage risk levels consistently across the university. These standards are built around data classification, which can be found in DAT01. Some of these standards are intended to be implemented by IT Pros, others place requirements on business units. The standards take their mandate from the Information Technology Security Policy.

Information Security Controls provide implementation information for each standard at various risk levels. The controls could be interpreted as a “how-to” version of the standards. As such, a coding scheme makes it easy to cross-reference between the documents. To better guide prioritization efforts, the detailed controls are specified according to the level of data being protected, as defined by the Data Management Policy.

We continue to develop documentation (procedures, checklists and templates) and software tools as needed to support the implementation of the standards and controls. These help organizations implement controls and control requirements effectively and efficiently.

Cybersecurity Improvement Initiative

The Office of the CIO and our campus IT partners have embarked on a multi-year effort to increase protection for our people, resources and data. Through endpoint management enrollment and security incident detection software (CrowdStrike), we are setting a baseline secure standard on university owned systems and enhancing overall security. The first phase began in fall 2023 with communications, gathering feedback from stakeholders, and implementing a pilot that became the model for unit engagements.

Why is this needed now?

Colleges and universities remain frequent targets of cybercriminals. According to IBM’s Cost of a Data Breach Report, the average cost of a breach in higher education is $3.6 million. With your cooperation and the continued support of IT professionals, CII will help defend our campus from such threats. Together, we can build a safer digital environment for everyone.

Cyberattacks against higher education are growing increasingly sophisticated and federal and state agencies require us to meet stricter compliance targets. We must elevate our cybersecurity practices through endpoint management and CrowdStrike, which will provide:  

• Visibility into the state and nature of systems on our network 
• Better vulnerability management through prompt updates 
• Robust protection against ransomware, malware and other attacks that can lead to costly and time-consuming data loss 
• Streamlined required auditing

Granting agencies, especially governments, expect grantees to demonstrate the highest cybersecurity standards. Universities with less network visibility are at a disadvantage in the grant funding landscape and remain at greater risk of data loss or theft and data breaches.