Re: number of IT security staff

[Rodney Petersen <rpetersen () EDUCAUSE EDU>]

I will try to respond to the questions a little more specifically on
behalf of EDUCAUSE as requested.

Of particular interest will be the EDUCAUSE Core Data Service
(www.educause.edu/coredata) 2003 Summary Report
(http://www.educause.edu/apps/coredata/reports/2003/) which has a
chapter on "IT Organization, Staffing, and Planning."  For example, on
page 5 it reports the average number of FTE Staff for IT Security in the
Central IT Organization as follows:

All Colleges/Universities               1.0
Doctoral/Research                       2.6
Master's Colleges/Universities  0.6
Baccauleate Colleges            0.3
Associate's Colleges            0.4
Other Colleges/Universities             1.6

It may also be worth noting the number of staff for IT Policy:

All Colleges/Universities               0.5
Doctoral/Research                       0.9
Master's Colleges/Universities  0.3
Baccauleate Colleges            0.2
Associate's Colleges            0.3
Other Colleges/Universities             0.9

The EDUCAUSE Center for Applied Research Research Report (from a survey
conducted in April 2003 - see
http://www.educause.edu/LibraryDetailPage/666?ID=ERS0305C) revealed the
following:  

-22.4% institutions of higher education have a chief IT security officer
or equivalent; 
-90% of CSO's work at doctoral extensive or intensive institutions; 
-95 percent of the IT security officers report to a senior administrator
in the IT office, including 50 percent who report to the CIO; 
-respondents were asked when their institution created the IT security
officer position and there is a clear, steady pattern of growth
beginning in 1994; 
-the Director of Networking had day-to-day responsibility for security
at over 30% of the institutions

The entire report is available to ECAR subscribers.  For a list of
subscribing ECAR organizations, see
http://www.educause.edu/ECARSubscribingOrganizations/957  The key
findings are publically available at
http://www.educause.edu/ir/library/pdf/ecar_so/ers/ERS0305/ekf0305.pdf
Additionally, you may want to refer to the ECAR Research Bulletin on
"High Stakes: Strategies for Optimal IT Security Staffing" available to
subscribers at http://www.educause.edu/LibraryDetailPage/666?ID=ERB0406

Please let me know if you have any further questions.

Regards,

-Rodney

-------------------------------------------------- 
Rodney J. Petersen
Policy Analyst & Security Task Force Coordinator

EDUCAUSE 
1150 18th Street, N.W., Suite 1010
Washington, D.C.  20036
(202) 331-5368 / (202) 872-4200 
(202) 872-4318 (FAX) 
EDUCAUSE/Internet2 Security Task Force
www.educause.edu/security 
-------------------------------------------------- 

-----Original Message-----
From: The EDUCAUSE Security Discussion Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Theresa M Rowe
Sent: Monday, January 31, 2005 1:21 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] number of IT security staff

Educause has tracked this for the Core Data survey years.
Maybe someone from Educause can respond specifically.  You can check
this out at http://www.educause.edu Down on the bottom left click on
Core Data Service If your university has not responded, perhaps you can
encourage them to do so (the more respondents, the better).
You can then do a lot with the data.

You can review the summary reports, though - those seem to be public
-Click on 2002 or 2003 Summary Report. Chapter 1 is IT Organization,
Staffing and Planning.  You can compare staffing for yourself.

Theresa
---- Original message ----
> Date: Mon, 31 Jan 2005 13:10:26 -0500
> From: James H Moore <jhmfa () RIT EDU>
> Subject: Re: [SECURITY] number of IT security staff
> To: SECURITY () LISTSERV EDUCAUSE EDU
>
> I think that Kathy is trying to update ECAR ;-) Really,
does someone know if
> ECAR is going to track this on an annual basis?  We are not
a member of
> ECAR, and I haven't seen the full report, but I might make
the case for
> joining, if ECAR has the intention of tracking security
manangement,
> technical, risk, and awareness issues annually, along with
some trending.
> Jim
> - - -
> Jim Moore, CISSP, IAM
> Information Security Officer
> Rochester Institute of Technology
> 13 Lomb Memorial Drive
> Rochester, NY 14623-5603
> Office: 585-475-5406
> Lab: 585-475-4122
> Fax: 585-475-7950
>
> "Distrust and caution are the parents of security."  --
Benjamin Franklin
> -----Original Message-----
> From: The EDUCAUSE Security Discussion Group Listserv 
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of
Theresa M Rowe
> Sent: Monday, January 31, 2005 10:46 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] number of IT security staff
>
> I suggest you look at Educause Core Data - there's a very
good staffing
> comparison that is easy to use, and you can look at all
reporting
> institutions, or create a peer group of those like you.
>
> Theresa Rowe
> Assistant Vice President
> University Technology Services
> www.oakland.edu/uts - the latest news from University
Technology Services
> **********
> Participation and subscription information for this
EDUCAUSE Discussion
> Group discussion list can be found at
http://www.educause.edu/groups/.
> **********
> Participation and subscription information for this
EDUCAUSE Discussion Group discussion list can be found at
http://www.educause.edu/groups/.
> ________________
> smime.p7s (5k bytes)
Theresa Rowe
Assistant Vice President
University Technology Services
www.oakland.edu/uts - the latest news from University Technology
Services

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/groups/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.