Re: IT Security in Higher Ed.

["Plesco, Todd" <tplesco () CHAPMAN EDU>]

My completely watered down analogies:

Government tends to be driven by politics
Corporate driven by profit
Higher Ed driven by Faculty and Regents

Government shifts based on an elected CEO and then their appointed
directors..and the availability of public funding streams or grants or
the occasional headline
Corporate shifts based on a Board appointed CEO and then their appointed
directors..and the opportunity for profit or the re-appropriation of
budget or a CIO with a fire to extinguish
Higher Ed shifts based on Faculty education strategies, grant funding
stream requirements, and the corporate/government shifts mentioned prior

Policy reference for government may be driven by compliance to
legislative mandates
Corporate policies driven by Sarbanes Oxley and other regulatory
mandates, HR, and cool looking posters or magazine articles
Higher Ed policies driven by Human Resources, Legal Affairs, Public
Safety, Registrar, Colleges, IT, and a combination of
Corporate/Government concerns.

These are mostly just samples and strictly my not-so-serious opinion. ;)

Best,
Todd A. Plesco  CISM, CBCP
Chapman University, Director of Information Security
One University Drive, Orange, CA 92866
Phone: (714) 744-7979/Fax: (714) 744-7041


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Hart, Lee Anne
Sent: Thursday, October 22, 2009 6:56 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] IT Security in Higher Ed.

Hello,

I'd like to do a little research on how or if IT Security in Higher
Education is different from other organizations such as the government
and
corporate America.  

- Are the threats/risks different?
- Is the purpose or goal different?
- Are there organizational differences?
- Unique challenges to working in higher ed?
- Why do you work in higher ed?
- Unique benefits to higher ed?   
- Have you worked for the government or a "for profit" company? If so,
what
differences do you see?
- Should it be different? Why/why not?
- Do you know of similar articles or threads on this topic?
- Other?

Thanks in advance for you help. Feel free to respond offline. I'll
review
the responses and use the information in blog entry I'll share with
list. 

Thanks,
Lee Anne

-------------------------------
Lee Anne Hart, CISSP
IT Security Analyst
Montgomery College
15400 Calhoun Drive, Suite 310
Rockville, MD 20855
240-567-3142 (O)
240-731-2332 (C)