%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> /XObject << /I1 16 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text /ImageC ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250713162947+00'00') /ModDate (D:20250713162947+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Annots [ 12 0 R 14 0 R ] /Contents 7 0 R >> endobj 7 0 obj << /Length 9179 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 174.779 521.469 571.955 re f 0.773 0.773 0.773 RG 0.75 w 0 J [ ] 0 d 45.641 175.154 520.719 571.205 re S 0.773 0.773 0.773 rg 61.016 190.529 m 550.984 190.529 l 550.984 191.279 l 61.016 191.279 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(CYBERSECURITY AWARENESS MONTH: CREATING STRONG )] TJ ET BT 61.016 676.134 Td /F1 14.4 Tf [(PASSWORDS)] TJ ET 0.400 0.400 0.400 rg BT 61.016 647.326 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 647.326 Td /F3 9.0 Tf [(May 10,2021)] TJ ET BT 156.578 647.326 Td /F2 9.0 Tf [( by )] TJ ET BT 171.086 647.326 Td /F3 9.0 Tf [(David Wiles)] TJ ET 0.373 0.169 0.255 rg BT 61.016 619.837 Td 1.096 Tw /F4 9.0 Tf [(Before)] TJ ET 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 61.016 618.686 m 87.530 618.686 l S 0.153 0.153 0.153 rg BT 87.530 619.837 Td 1.096 Tw /F4 9.0 Tf [(we pointed out that most people underestimate the importance of having a secure password, and still make the )] TJ ET BT 61.016 608.848 Td 0.000 Tw /F4 9.0 Tf [(mistake of using simple words and numbers as a password.)] TJ ET BT 61.016 588.859 Td 0.566 Tw /F4 9.0 Tf [(Keep in mind that your email and social network accounts contain very personal information about you. You must have a )] TJ ET BT 61.016 577.870 Td 0.000 Tw /F4 9.0 Tf [(strong password to keep your personal life personal, and not become a victim of identity theft.)] TJ ET 0.153 0.153 0.153 RG 85.866 560.697 m 85.866 561.110 85.696 561.520 85.404 561.811 c 85.113 562.103 84.703 562.272 84.291 562.272 c 83.878 562.272 83.469 562.103 83.177 561.811 c 82.885 561.520 82.716 561.110 82.716 560.697 c 82.716 560.285 82.885 559.875 83.177 559.584 c 83.469 559.292 83.878 559.122 84.291 559.122 c 84.703 559.122 85.113 559.292 85.404 559.584 c 85.696 559.875 85.866 560.285 85.866 560.697 c f BT 91.016 557.881 Td 1.403 Tw /F4 9.0 Tf [(Using email or your profile on Facebook, Whatsapp or Google, hackers can and do, extract a huge amount of )] TJ ET BT 91.016 546.892 Td 0.000 Tw /F4 9.0 Tf [(personal data of your personal "online" life.)] TJ ET 85.866 538.719 m 85.866 539.132 85.696 539.542 85.404 539.833 c 85.113 540.125 84.703 540.294 84.291 540.294 c 83.878 540.294 83.469 540.125 83.177 539.833 c 82.885 539.542 82.716 539.132 82.716 538.719 c 82.716 538.307 82.885 537.897 83.177 537.606 c 83.469 537.314 83.878 537.144 84.291 537.144 c 84.703 537.144 85.113 537.314 85.404 537.606 c 85.696 537.897 85.866 538.307 85.866 538.719 c f BT 91.016 535.903 Td 0.513 Tw /F4 9.0 Tf [(If you use the same password for multiple online accounts, you run the risk, if this password is hacked, of all your )] TJ ET BT 91.016 524.914 Td 0.000 Tw /F4 9.0 Tf [(online accounts being compromised.)] TJ ET 85.866 516.741 m 85.866 517.154 85.696 517.564 85.404 517.855 c 85.113 518.147 84.703 518.316 84.291 518.316 c 83.878 518.316 83.469 518.147 83.177 517.855 c 82.885 517.564 82.716 517.154 82.716 516.741 c 82.716 516.329 82.885 515.919 83.177 515.628 c 83.469 515.336 83.878 515.166 84.291 515.166 c 84.703 515.166 85.113 515.336 85.404 515.628 c 85.696 515.919 85.866 516.329 85.866 516.741 c f BT 91.016 513.925 Td 0.739 Tw /F4 9.0 Tf [(Using a personal name for an online account, the name of the city that you live in, the names of your children or )] TJ ET BT 91.016 502.936 Td 0.000 Tw /F4 9.0 Tf [(your date of birth, give hackers vital clues for attempting to access your personal data.)] TJ ET 85.866 494.763 m 85.866 495.176 85.696 495.586 85.404 495.877 c 85.113 496.169 84.703 496.338 84.291 496.338 c 83.878 496.338 83.469 496.169 83.177 495.877 c 82.885 495.586 82.716 495.176 82.716 494.763 c 82.716 494.351 82.885 493.941 83.177 493.650 c 83.469 493.358 83.878 493.188 84.291 493.188 c 84.703 493.188 85.113 493.358 85.404 493.650 c 85.696 493.941 85.866 494.351 85.866 494.763 c f BT 91.016 491.947 Td 1.239 Tw /F4 9.0 Tf [(For an average expert hacker, it is always easy to find passwords that are made up of words from the English )] TJ ET BT 91.016 480.958 Td 0.000 Tw /F4 9.0 Tf [(vocabulary or other languages, using a basic technique called "brute force" or "dictionary" attacks.)] TJ ET BT 61.016 457.999 Td /F1 9.0 Tf [(What makes a password safe?)] TJ ET BT 78.360 438.026 Td /F4 9.0 Tf [(1.)] TJ ET BT 91.016 438.010 Td /F4 9.0 Tf [(A password at least 8 characters long.)] TJ ET BT 78.360 427.037 Td /F4 9.0 Tf [(2.)] TJ ET BT 91.016 427.021 Td /F4 9.0 Tf [(The password does not contain information that is easy to find online, such as the date of birth, the telephone )] TJ ET BT 91.016 416.032 Td /F4 9.0 Tf [(number, your spouses name, the name of a pet, or a childs name.)] TJ ET BT 78.360 405.059 Td /F4 9.0 Tf [(3.)] TJ ET BT 91.016 405.043 Td /F4 9.0 Tf [(The password does not contain words found in the dictionary.)] TJ ET BT 78.360 394.070 Td /F4 9.0 Tf [(4.)] TJ ET BT 91.016 394.054 Td /F4 9.0 Tf [(The password contains special characters like @ # $% ^ &, and numbers.)] TJ ET BT 78.360 383.081 Td /F4 9.0 Tf [(5.)] TJ ET BT 91.016 383.065 Td /F4 9.0 Tf [(The password uses a combination of uppercase and lowercase letters.)] TJ ET BT 61.016 360.106 Td /F1 9.0 Tf [(A trick that the experts use to create secure passwords:)] TJ ET BT 61.016 340.117 Td /F4 9.0 Tf [(Think of a phrase and use the first letters of the words in the phrase.)] TJ ET 85.866 322.944 m 85.866 323.357 85.696 323.767 85.404 324.058 c 85.113 324.350 84.703 324.519 84.291 324.519 c 83.878 324.519 83.469 324.350 83.177 324.058 c 82.885 323.767 82.716 323.357 82.716 322.944 c 82.716 322.532 82.885 322.122 83.177 321.831 c 83.469 321.539 83.878 321.369 84.291 321.369 c 84.703 321.369 85.113 321.539 85.404 321.831 c 85.696 322.122 85.866 322.532 85.866 322.944 c f BT 91.016 320.128 Td /F4 9.0 Tf [(For example: )] TJ ET BT 146.033 320.128 Td /F2 9.0 Tf [("In South Africa, a barbecue is called a Braai!")] TJ ET 85.866 311.955 m 85.866 312.368 85.696 312.778 85.404 313.069 c 85.113 313.361 84.703 313.530 84.291 313.530 c 83.878 313.530 83.469 313.361 83.177 313.069 c 82.885 312.778 82.716 312.368 82.716 311.955 c 82.716 311.543 82.885 311.133 83.177 310.842 c 83.469 310.550 83.878 310.380 84.291 310.380 c 84.703 310.380 85.113 310.550 85.404 310.842 c 85.696 311.133 85.866 311.543 85.866 311.955 c f BT 91.016 309.139 Td /F4 9.0 Tf [(Take the first letters of each word and the password that is created is )] TJ ET BT 368.144 309.139 Td /F3 9.0 Tf [(ISAabicaB!)] TJ ET 85.866 300.966 m 85.866 301.379 85.696 301.789 85.404 302.080 c 85.113 302.372 84.703 302.541 84.291 302.541 c 83.878 302.541 83.469 302.372 83.177 302.080 c 82.885 301.789 82.716 301.379 82.716 300.966 c 82.716 300.554 82.885 300.144 83.177 299.853 c 83.469 299.561 83.878 299.391 84.291 299.391 c 84.703 299.391 85.113 299.561 85.404 299.853 c 85.696 300.144 85.866 300.554 85.866 300.966 c f BT 91.016 298.150 Td /F4 9.0 Tf [(This will be very difficult to guess, but easy to remember.)] TJ ET 85.866 289.977 m 85.866 290.390 85.696 290.800 85.404 291.091 c 85.113 291.383 84.703 291.552 84.291 291.552 c 83.878 291.552 83.469 291.383 83.177 291.091 c 82.885 290.800 82.716 290.390 82.716 289.977 c 82.716 289.565 82.885 289.155 83.177 288.864 c 83.469 288.572 83.878 288.402 84.291 288.402 c 84.703 288.402 85.113 288.572 85.404 288.864 c 85.696 289.155 85.866 289.565 85.866 289.977 c f BT 91.016 287.161 Td /F4 9.0 Tf [(At this point, you can decide to make your the Google password is )] TJ ET BT 357.146 287.161 Td /F3 9.0 Tf [(ISAabicaB!-G)] TJ ET BT 414.656 287.161 Td /F4 9.0 Tf [(, and Facebook )] TJ ET BT 481.697 287.161 Td /F3 9.0 Tf [(ISAabicaB!-F)] TJ ET BT 91.016 276.172 Td /F4 9.0 Tf [(and your university account )] TJ ET BT 205.568 276.172 Td /F3 9.0 Tf [(ISAabicaB!-U)] TJ ET BT 262.574 276.172 Td /F4 9.0 Tf [(S and so on.)] TJ ET 85.866 267.999 m 85.866 268.412 85.696 268.822 85.404 269.113 c 85.113 269.405 84.703 269.574 84.291 269.574 c 83.878 269.574 83.469 269.405 83.177 269.113 c 82.885 268.822 82.716 268.412 82.716 267.999 c 82.716 267.587 82.885 267.177 83.177 266.886 c 83.469 266.594 83.878 266.424 84.291 266.424 c 84.703 266.424 85.113 266.594 85.404 266.886 c 85.696 267.177 85.866 267.587 85.866 267.999 c f BT 91.016 265.183 Td /F4 9.0 Tf [(There is already a capital letter and a special character )] TJ ET BT 312.110 265.183 Td /F3 9.0 Tf [(\(!\))] TJ ET BT 321.101 265.183 Td /F4 9.0 Tf [(, so you just need to add a number to finish off a good )] TJ ET BT 91.016 254.194 Td /F4 9.0 Tf [(password like )] TJ ET BT 148.031 254.194 Td /F3 9.0 Tf [(9-ISAabicaB!-US)] TJ ET BT 221.543 254.194 Td /F2 9.0 Tf [(\(9 could be the month you created the password in - for example\))] TJ ET BT 61.016 234.205 Td /F4 9.0 Tf [(You will have already made your password a lot more difficult to hack, and it can be a lot of fun to create.)] TJ ET 0.400 0.400 0.400 rg BT 61.016 215.716 Td /F2 9.0 Tf [(Posted in:News,Phishing,Security,Tips | Tagged:Cyberaware,Cybersecurity,Password,Passwords,Phishing | With 0 )] TJ ET BT 61.016 204.727 Td /F2 9.0 Tf [(comments)] TJ ET q 225.000 0 0 135.000 61.016 493.628 cm /I1 Do Q endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 12 0 obj << /Type /Annot /Subtype /Link /A 13 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 493.6285 286.0157 628.6285 ] >> endobj 13 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2018/10/cyber-aware-month-common-passwords/) >> endobj 14 0 obj << /Type /Annot /Subtype /Link /A 15 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 619.0048 87.5297 628.1623 ] >> endobj 15 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2018/10/cyber-aware-month-common-passwords/) >> endobj 16 0 obj << /Type /XObject /Subtype /Image /Width 300 /Height 180 /ColorSpace /DeviceRGB /Filter /DCTDecode /BitsPerComponent 8 /Length 4011>> stream JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82 C    !'"#%%%),($+!$%$C   $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$," }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?(< ( ( ( ( ( (Q@((((((((((((((((((((((((((((((((((((((((((+!e:!6Y.9ۻλqT#%s?#klf@D.|m{9HrKՂ(QEQEQEQEQEQEQEQEQEQEQEs$okK 4zbb$1Gő Jq֍'Vj һn_xn 9|AFpב7_ ɣlUQkO]~ZG]at"FZ9<6qުQšC-j-̌e0O(9}~INOt ⺚_Mc2h]/ kön]\=bQ]$rnPiOҿ?Y\#Ͽ5 7Q dѿ6?*?JHD=@+# Q`HM|/C&Tk4o AOҿ??JH0{$y&F:oii7ݎ+vo5'_ U=[,<=4r e-TIQ`HàG5jZMͣ_ϧ9yf3]5y 2j(AEPEPEPEPEPEP0(QEQEQEQEWM?O]6vQȮҹ_ZڃjW]ʎ]ƏBG .ZڭԶȞSm,NN3YڷZ*ڿ3g܏C?s7H9jO[Vz*xr?BG .G!#o?o?:?[Ww3GH9h$5'GQy={j} 33]Ƥռ ӧ{`HJWb}Gum̞B>Vc>>׊5qWgY6[QXQEQEQE ( (Q@Š(AEPEPEPwB]B M"wZ]O8'l2 \vNg]CQ]'<҃ck c@~kPJYUsyvhAԩ4V`< yx[`w5}ax#.j 9}F/.[P{H)өP9`fΕn伔Op?C]jmvv[͕$NY9 ;'~{qF A#wZ+mxvVo͸qdqQєQEHQEQEQE ((QE (Q@Q@Q@Q@r!?KW+#KZRQ: iVdQQ@ QVn%5;"0 ݆g>_x}7vZ\,QWX>da})W( yyv 4 VvPQ%g 9f* 1$IMlCGQǐsG~/i}!ټDQM3:UXz/{ll2THG\tp54ނPIjZO}G1 [U;VC xp+Pu[)o㸶CHWS^Ik ىyZ%^OsqT,{R=N((((((((((((QExׄ p P} ʺ'@Kmq=?~ W^zj)j W=j dg*8ďxW_CQ\~?F?G eE}cmX{$s¿Ug!`jiO dmv-n?׬_C@^ԝ'ϳK}U5=2^=_Pv&I:tzzܥ2Ăf^7湛U]{I^KoYT@Ĩm8 +(tܛwV +A3^^/Eh?ok4"WEW`QEQEQEQEQEQEQEQEQEQEQE (Q@Q@W,QOV(;OH.Lּ3]\ưNI Qs)8R8=j-oQ~ 㴴WJjb߶O;G-oQ~ 㴴Sթ=+_|\DҼ#5)Ŋ8U+#`Mf7FBmb d㓎98+d2aEW!EPEPEPEPEPEPEPEPEPEPEP0(QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE (QEQEQEQEQEQEQEQEQEQEQEQE?`4lQTPll(=M6SFh ލފ(==袀 ލފ(==MPz6SElE`4Q@h=MPz6SElE`4Q@FElފ(==MP{Ѱz( endstream endobj xref 0 17 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000332 00000 n 0000000369 00000 n 0000000507 00000 n 0000000596 00000 n 0000009827 00000 n 0000009939 00000 n 0000010054 00000 n 0000010174 00000 n 0000010282 00000 n 0000010409 00000 n 0000010533 00000 n 0000010659 00000 n 0000010783 00000 n trailer << /Size 17 /Root 1 0 R /Info 5 0 R >> startxref 14962 %%EOF News « Informasietegnologie
Language:
SEARCH

  • Recent Posts

  • Categories

  • Archives

News

« Older Entries
Newer Entries »

Post COVID challenges: On the ground experiences

Thursday, December 15th, 2022

When COVID-19 struck, the various teams working on the ground to ensure that Stellenbosch University (SU) runs seamlessly on all technological fronts suddenly faced enormous challenges.

Almost overnight, the technological needs in all sectors of the university – from System Administration to IT services, Student Support, and End User Support – had to shift to accommodate remote working.

Post-COVID, all these divisions have had to adapt to a new normal of hybrid working, teaching and learning. And, in true SU style, despite the unprecedented rollercoaster ride, all these teams have risen to the occasion – and are optimistic about the campus’s technological future.

Mario Randelhoff, Manager of System Administration, described the past two years as “one of the most challenging times of my life”. He and his 10-strong team of system and database administrators run all the critical computing systems which the university uses relating to emails, the human resources system, and the learning management system, etc.

“It’s our task to manage the configurations to ensure emails are sent securely from users on campus to external users. In terms of managing the learning management system, which is all on-premises in our data centre, we look after the machines, do installations, and manage security updates. We ensure the overall learning management system platform is always up to date and available. Managing the Human Resources system means we have to ensure all the technology for leave requests, salary payments, performance assessments, pension information etc., is up and running,” he said.

Mario’s department faced numerous challenges during COVID, many of which remain. “One thing was non-negotiable – the business of the university had to go on during lockdown,” Mario said. “From being spoilt with everybody being onsite in the university’s buildings and knowing where all the problems and hotspots were, everybody became separate “companies” that had to be serviced.

“When everybody started working remotely, we had to move fast to set up the technology to allow users to access the systems from where they were. We had to cater for very large numbers of users trying to access the systems and ensure they did this securely when accessing our more sensitive systems. This could not be done via the open internet without security. 

“Gearing our learning management system for 100 percent remote work was a massive task. We had to obtain more servers as well as build capacity to ensure the system worked fast and efficiently. We didn’t want students to click on a page and then wait ten minutes to log in. 

“The fact that everybody was working remotely brought many issues to the fore – we had to put cybersecurity measures in place to ensure people didn’t click on phishing emails and to protect them from viruses.

“We also had to roll out laptops. Because of the culture of the university, many people working from their offices or the computer labs on campus didn’t necessarily have devices they could use from home. 

“It was stressful all over, getting to the new normal of working remotely while ensuring users had the same experience they would have had if they were working in the office. One of our biggest challenges as an operations team was that we couldn’t meet face-to-face. We had to adapt to online meetings. Then loadshedding would interrupt meetings, so we had to roll out UPS to team members so they could at least have a sustainable internet connection while working remotely.” 

Mario continued: “With COVID, lockdown, and loadshedding, it was a very stressful time. I had to coordinate everything from the systems side, and I also had to motivate my team to implement the changes in a short time.”

Mario, a father of two, said he never lost sight of the numerous personal struggles and work pressure he, his staff and all the university members were facing. What got him through, he said, is the fact that he does not get stressed out. “When others are stressing, that’s when I perform at my best.”

A challenge his department faces now is that having gotten through COVID, remote work has become “a hindrance”. “It is hard to keep a group dynamic going if everybody is working remotely. We do at least go in to work on Mondays for a face-to-face meeting. We also need to rebuild the interactions with the other technological teams.”

Another challenge, he said, is that the division currently has five vacancies, “but, in the post-COVID era, people have got used to working remotely and are not actually going for jobs where they need to be on site. This is a new problem that we are really experiencing firsthand.

Asked what new tech and other innovations are in the pipeline in his division, Mario said: “Technology has evolved so much we have to start onboarding more cloud services. We will start looking at migrating certain systems, such as our learning management system, to a cloud provider so we can scale it to many more people.

“From a team perspective, we have to work hard to change the mindset from traditional system administrators to thinking about being cloud architects and looking at deployment architecture and how to componentise the systems we look after. That’s where the mind shift needs to happen.” 

Allister Lesar, Head of ICT Student services, and his team are tasked with assisting students in all their ICT requirements to study, research, learn and achieve their goals at the university.

During COVID, he and his team of seven people had to quickly evolve and assist with quickly helping students and staff become capable of accomplishing their tasks remotely and enable remote learning from anywhere. They also had to roll out laptops to 2500 students overnight.

 

“We worked round the clock to ensure they received their laptops. Then we had to assist the students remotely with repairs and ensure the repaired laptops were couriered to them so their studies were not interrupted. We sent laptops to students in cities as well as in remote areas in Northern Cape and Limpopo.

“We also had to roll out WIFI hotspots as far as we could across the campus so that those students who were unable to go home could study safely on campus, in venues with limited numbers of people at a certain time. We shifted from a walk-in service for IT queries and repairs to an appointment basis only and we had to enable our remote workforce – who were accustomed to walk-in, face-to-face service – to assist students remotely.”

Allister said that, in the post-COVID era, students want to maintain the services of loaned laptops and remote working. “They’ve got used to studying in their rooms or at home, in uncrowded areas and are still asking for these resources. For instance, some students feel unsafe walking to the computer labs at night. While it is not financially viable to maintain this, we are trying to leverage programmes to assist them in that regard.”

Asked what’s in the technological pipeline in his division, Allister said they are looking at mobile device management solutions to enable remote services for students. We intend to secure all our endpoints so staff and students can use any device to study. For this to happen, we need to be able to pick up issues before they’ve even happened.” 

The COVID and post-COVID period have been tough, Allister said. “I worked till three in the morning and got up at seven to ensure the students got the help they needed. As a team, we galvanised each other by putting ourselves in the students’ shoes and imagining their strain. We drew on whatever energy we had. That’s what got us through. We focused on how to best help them through the situation.”

Ronel Reynecke, Head: End User Support and her 15-strong team, of whom some are based at the IT student centre and the rest at the main IT building, oversee the technical support for staff on campus.

“During COVID, the division had to instantaneously change from supporting users onsite to supporting users remotely to the best of our ability. That brought challenges on its own, as more remote support meant more licenses on the software we used to help our users, which of course, had a cost implication for IT. But, on the bright side, our users quickly became familiar with this software and we sometimes had to smile when, without even asking for the user ID, the users would start giving the ID almost before we could say good morning.

“Teams and Zoom (to a lesser extent) quickly became the default meeting platform, and specialised equipment followed in the lecture halls. It involved a great deal more work for the team and they had to do a lot of ‘hand holding’ to some staff to manage webinars and online meetings and to lecturers to implement the hybrid mode of teaching.

“Many things shifted for us. In terms of the devices we service, previously, there was a good divide between desktops and laptops, but during COVID, it immediately changed to laptops. We had large orders coming through for laptops, leading to insufficient storage space for all the devices while configuring the devices. 

“Then there was also the global semi-conductor shortage which led to a shortage of chips to make for example, laptop screens. COVID didn’t help and, while our delivery is normally two to three weeks, in some cases, it took almost a year, to get laptops.”

Further challenges included that “technicians who were accustomed to providing end-user support had to become Jacks of all trades. They also had to assist users with their home setups, and deal with internet connectivity issues, third-party software and printing issues at home. We had to connect everyone who had never worked from home or used VPN (virtual private networks) to access secure systems; and we had to migrate users who were still working on old VPN clients. We also had to explain to users that Anti-Virus updates had to run before VPN could connect and that it is enabled for MFA (multifactor authentication) which all contributed to better network security.”

Ronel said her team experienced a real “generational divide”, with the younger generation being better equipped for the technological changes than the older generation.

“Then there was also a digital divide, where some students did not have the funds to purchase laptops and data for connectivity. She said her team experienced first hand the fall-out of having to learn and teach new technologies. They had work to complete with deadlines and the new technology was strange and frustrating for them. So, apart from doing the normal IT tasks, they also calm the users down! We were almost like psychologists because people got so upset.   

“In the end, this took a huge toll on my staff, as some of them were even verbally abused by staff as they wanted to be helped instantaneously, never thinking that we might have had a rollover of calls.”

Ronel said several changes have already taken place in her department, and some are still to come. “The developments in the pipeline to improve customer experience include implementing Microsoft Intune (Microsoft cloud-based unified endpoint management service) to help manage the software of onsite and offsite devices; the hybrid joining of devices to Azure Active Directory to enable use of the full functionality of the Microsoft stack; and, the possible use of Windows as a service – a method of testing and releasing Windows features faster – to simply the work of IT support staff.”

When asked to look back on the challenges of COVID, and what was achieved, Ronel said: “COVID brought so many hardships and such heartache, but it pushed the boundaries in terms of our digital strategy. Tech experts predicted it could take up to seven years to get to where we are now and that all happened in the past two years. We had to push the boundaries and get into an entirely new digital era. 

“My team and I learnt so much. In fact, I feel so empowered, having learnt so much and I know that we can do even more when we work together as a team. We should learn from our experience and embrace the change.”

Petro Uys, Head: IT Service Desk, and her team of six people are tasked with first-level troubleshooting with all IT-related queries.

“We receive a very high volume of calls – especially since COVID meant that many people are working from home. This development added numerous requirements among users. 

“A key part of our work is to pick up trends, for instance, if people start calling in and say they can’t access SUNlearn – our learning management system – my team must immediately inform me so that we can deal with the issue. We immediately inform the second and third levels of the trends. It is vital for us to pick up trends and escalate them to get to the root cause.“Before COVID, when everyone was on campus it was easy to, for instance, change your password. Now that users are based at home, they cannot change their password and connect without issues. They must take additional steps for their new password to be recognised on their laptop. It was a huge challenge just to get people connected from home.”

Petro said the technological needs dealt with by her team had shifted substantially during COVID. “Our first challenge was to set up our team to be able to work from home. Some only had ADSL and limited connectivity from home. 

“On the customer side, they were frantic – they didn’t know how to connect from home; for instance, a VPN is needed for specific purposes, such as working with the financial or HR system. We spent a lot of time just calming the users down and telling them it was not that bad!

“Other challenges were to get our information out to users in good time. From an IT side, it takes time to get the right information to the people because you need to test it and ensure it’s the correct information. For example, people have different cell phones. We introduced multifactor authentication just to verify our staff members, but it was challenging because people struggled to verify themselves.

“So, testing and verifying information and getting it to our people was vital. We had to ensure our service catalogue was up to date every day.”

Petro added that the IT Service Desk has been receiving numerous security-related service requests. “This includes SPAM and spoofing emails. Users must be empowered with information from IT to be able to deal with these in the correct way. They must not open these emails and click on the links in the emails, or provide their credentials, as this can result in their accounts being compromised.

“The IT Service Desk acts as a gatekeeper and must have sufficient knowledge to protect users from doing the wrong thing, especially if they don’t know what to do.”

Asked what’s in the pipeline in terms of new directions and new technologies, Petro said a key task among her staff members is “to get them to really understand what the university is about, and to motivate them to strive to work towards the university’s vision and mission, so we all work towards the same goal”. 

“In terms of technology, I am pushing to start using chatbots and AI to enable self-service for users with queries. I also hope to implement extended service hours in our division. Currently, we work from 8 am to 4.30 pm, Monday to Friday. That’s not good enough in the modern world. We must look at our service hours, especially with all the loadshedding.”

Asked how she dealt with the challenges, Petro said: “I’m an in-the-moment person. I make the best of every moment and don’t overthink things. That really got me through the pandemic. I knew that I had to just carry on and to motivate the people we were dealing with. I just made sure I was present for my team and for those I served.”

 

 

Email

Posted in News, Our people | Comments Off on Post COVID challenges: On the ground experiences

SU takes great leap forward into cloud era

Monday, October 24th, 2022

hand touching visual screen with icons floating above it

Stellenbosch University is currently in the process of taking a “great leap forward” into the “cloud” era, which will see the new finance and student systems, SUNFin and SUNStudent, operating in the cloud.

This is not only going to make all the difference to security against cyber threats but will also make the university’s systems more efficient and accessible, in a number of ways, for students and staff. The move into the cloud, which is the culmination of years of work, will take SU into an entirely different risk profile, said Marc-Allen Johnson, acting director IT Institutional Software Systems at SU.

“This is a big step in the right direction, as the threat of cyber fraud at universities is growing all the time, all over the world,” Mr Johnson said in an interview. To date, most of the university’s administrative systems have been housed on premises, in a data centre on campus. “But now they will be housed in the cloud, running in data centres in Johannesburg and Cape Town, and according to the latest standards in technology, to ensure that the personal information of both students and staff remains secure,” Mr Johnson said.

“At the same time, once fully operational, it will be possible to access the systems from anywhere without having to be affected by loadshedding or interrupted internet connectivity on the Stellenbosch campus. So, we are providing a much-improved service, while ensuring a secure system.”

Elaborating on the two new systems, SUNFin and SUNStudent, Mr Johnson said SUNFin refers to the university’s new financial system. “It is an Enterprise Resource Planning (ERP) system that SU will use to manage day-to-day business activities of the Finance capability within the organisation. It manages all the key financial requirements that a university has to fulfil to ensure that the books balance, that people get paid and that we manage our finances well. The implementation of the SUNFin project has been under way for the last two to three years.”

“SUNStudent refers to the new system that supports the Student Administration capability and all the related student services. The SUNStudent system will usher in a modern, integrated and cloud-based solution that will allow key university capabilities like Registration, Bursary Awards, Assessment and Degree Audits to be supported in a secure way. Although the staff and students have always had access to self-service functionality, the modernised interface provides it all levels. The new Application and Admission process went live in 2021 and facilitated a significant jump in the number of applicants and demographic.”

Mr Johnson said the university is planning to be fully operational with both systems by the end of next year. The application and admissions functionality of SUNStudent have already been live for two years.

He said that, for the IT team at the university, the new moves address “quite a few risks”. “We have legacy administrative systems of between 20 and 30 years old at the university. Through the years, the demands on these systems have been continuously growing and the world continues to throw security challenges our way. We’ve responded by making changes ourselves, but the technical debt has grown untenable over the years. Coupled with a technology that the industry is not actively pursuing anymore and people who have been part of building these systems retiring, it was necessary to make a leap.

“So, it is a great relief for me to see us moving into a new era where we are implementing software solutions that will last another 30 years. It is also exciting to know that, from now on, our system will be continuously improving and remain up to date.”

Part of the improved efficiency, he said, was the fact that the IT Division will work in close partnership with vendors like Oracle and Serosoft “to ensure that we have security by design”.

“We also know that we are not their only client, which means that we benefit from the collective. For instance, if they implement enhanced security measures, or conduct vulnerability tests for one client, they implement it for all of us. That is one of the benefits of going to the cloud –the vendor takes responsibility to keep the system up to date and secure according to a contract.”

Mr Johnson said that in the past many institutions bought software “off the shelves from a vendor” and then tried to maintain their systems themselves.

“But then they fall behind the latest versions and patches which opens them up to security risks. By moving to the cloud, Stellenbosch University will receive regular updates and be assisted regularly, and we will not fall behind as new functionalities are released.”

Mr Johnson said that the mechanisms implemented by the new systems will be a great deterrent to the ever-present cybersecurity threats.

“I recall a quote, often attributed to Thomas Jefferson, – “The price of freedom is eternal vigilance” – and it really rings true. With these new systems, we have invested in a solution that will continuously be kept up to date. Yes, along with the vendors, our team will have to be continuously vigilant, but it means newly discovered vulnerabilities will be quickly patched by our partners. We are contractually partnered with our vendors to provide that level of surety.”

Mr Johnson said once the system is up and running, “we will all sleep easier”.

“As the research shows, one of the most difficult IT challenges at any institution is to implement a new system. It involves a lot of change and the switchover from the one system to the other is a risk that can be easily exploited by people wanting to do harm.

“For instance, if cyber criminals know that a new system is being implemented, they could send out an email to a student or staff member and invite them to click on a link to be “onboarded” on the new system – potentially leading to compromised credentials. During this period of transition, we have to promote a heightened awareness and ensure we educate all students and staff about the risks. Our teams monitor and respond to phishing attacks like these that target our users. One of the measures that counter the reach of these attacks is to implement multi-factor authentication. For instance, when you log into the system, you receive a prompt to either supply a one-time PIN or approve the log in using a mobile app. For many staff and students, it feels like a burden, but that simple act is an important deterrent, because if someone gets hold of your username and password it makes it much harder to get past that hurdle.

“We can try to put in place as many security measures as we can, but if the attacker manages to use phishing techniques to trick a student or staff member to disclose their username or password, it could give the attacker access to sensitive information. This is a critical threat to administrative systems and something we are obviously concerned about, hence measures like Multi-factor Authentication.”

Mr Johnson continued: “SUNFin and SUNStudent will not only provide better functionality, to enable us to become a more modern and efficient university, but they will also make us more resilient to cyber-attacks. However, we really need everyone’s help to be vigilant by educating oneself and being on the lookout for suspicious messages. All students and staff are encouraged to reach out to us if they have any doubts or queries about suspicious emails or notifications they receive. Our IT support desks and relationship managers are there to assist, especially during this transition period to final implementation of SUNFin and SUNStudent.”

Email

Posted in General, News | Comments Off on SU takes great leap forward into cloud era

Risks of cybersecurity have become massive in higher education sector globally

Monday, October 24th, 2022

hacker phishing scam

Universities around the world are facing ever increasing cybersecurity risks, particularly in the post-pandemic world – and Stellenbosch University is not immune to these threats. Even before Covid-19 struck, higher education institutions were already gathering vast amounts of data from students and staff – and now, with more hybrid and remote offerings, requiring even more information, the risks of cybersecurity have become massive.

The risks for these data rich institutions are wide ranging and include ransomware attacks, business email compromises, data and privacy breaches, as well as adversary-in-the-middle attacks, said Brian Mhembere, the Cybersecurity and Technology Risk Specialist in the ICT division at Stellenbosch University.

Brian, who has a background in IT in the banking, mining, health and financial services sectors, has seen and heard it all when it comes to cybercrimes. With his finger on the pulse of global cyber trends, and with first-hand experience of the havoc that cyber fraud can create, he has, in the past, been asked to share his expertise in interviews on television and on radio. He was even interviewed on the 8pm news on ETV ahead of Black Friday, where he warned South Africans of all that can go wrong when shopping online.

Now, as a key cyber “sleuth” at Stellenbosch University, he’s determined to ensure that the valuable student and research data stay safe.

“There have been a lot of data breaches in higher education institutions mainly through phishing attacks – attacks aimed at compromising personal identifiable data or to reveal personal sensitive information like credit card numbers, bank information or passwords,” he said in an interview.

Brian explained that ransomware attacks take place when a cybercriminal threatens to use technology to either publish or permanently block a victim’s personal data unless a ransom is paid. A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.

An adversary-in-the-middle attack is when an adversary intercepts communication channels between two components, with the aim of either altering the message or data, or compromising the integrity of the data a person is trying to transmit, with the result that the message reaches the intended recipient with altered information or configuration.

Brian was responsible for the recent cybersecurity maturity assessment and report on cybersecurity at the campus. The analysis was done using the ISO27001 standard and the National Information Security Technology (NIST) cyber-security framework, which uses a Capability Model Maturity (CMM) tool to analyse where the weaknesses lie in the whole IT environment. The CMM tool guides the analysis of the entire IT environment with controls mapping and scoring exposing gaps, in accordance with the ISO/IEC27001 standards.

“The report did not find anything out of trend with most universities around the world,” Brian said. “Our university falls in line with the current state of cybersecurity maturity of most other South African universities. There is still some work to be done to improve the cybersecurity of all these institutions. Our maturity is very low compared to universities in the UK and America, but better than that in some other countries in Africa.”

He said the audit was conducted during April and May 2022 and the report has not yet been published or made public.

“Even if we knew the findings, we would not make them public, because anyone who reads this article would know what our weaknesses are,” he said. “Even if SU had ever had an attack, we would not speak about it in the public domain. There have been attempts but we are able to monitor and protect most attacks.”

Brian said the issue of cybersecurity at the university keeps him on his toes, but this is nothing new. “When I was working as head of IT in one of the major private hospital groups, we had an incident with ransomware called Wanacry. One of our managers’ PC was encrypted by the hackers as she clicked on an attachment sent by email which contained some malicious code. Luckily, my office was right next to hers. I was able to run through and I saw her computer countdown times which said they were encrypting all her data on the computer unless she sent an amount in Bitcoin.

“We managed to quickly isolate her workstation and to disconnect it from the Internet, but it was too late to avoid the encryption on that workstation. However, we managed to prevent it from propagating through the network. We lost all the data on her machine, but because we had a good business continuity plan, we restored the data on her machine from our backups.”

In a humble deflection of his own vital role, Brian said: “This colleague saved the day. She followed all the awareness products we were pushing which is a major thing, as users are first and last in the line of defence. I have always placed a huge emphasis on user awareness and on campaigns to create what we call the the human firewall against cyber fraud.”

Brian, who grew up in Harare, Zimbabwe, has always been intrigued with information systems. He completed a Bachelor of Science, Honours degree in Information Systems, Diplomas in Telecoms Engineering, and Networking whilst working in various sectors. He is a Certified Information Security Manager from Information Systems Audit and Control Association (ISACA) and has since completed a range of other cybersecurity certifications and, in 2018, completed a Masters in Information Systems from the University of Cape Town.

“This is really very interesting work, as well as being very important,” he said. “In the age of digital transformation, everything is moving online and onto the cloud. It’s exciting to be part of this huge transformation and to educate users on best practices.

“Of course it keeps me up at night,” he said, of his role at Stellenbosch University. “But thankfully, our current chief director of IT has prioritised cybersecurity at the campus. We both recognise how important it has become in today’s world, especially for universities relying on remote working which was necessitated by the pandemic.”

He said the IT division is assessing the findings of the university’s audit into cybersecurity and is now working on implementing the recommendations from the report so as to strengthen their security and control in the digital sphere.

Brian said he tries to keep up to speed on cybercrimes, locally and internationally. “Recently, Uber was hacked. There were data breaches, and the matter is still under investigation. Each incident teaches us lessons. We learn how they were compromised, what their vulnerabilities were – and we compare this with ourselves. We ask ourselves, ‘if this happened to us would we be able to defend ourselves?”

He also cited numerous recent articles on the subject of cybersecurity, particularly in higher education. Part of his job, he said, is to keep up to speed on all developments in cyber fraud, which involves reading research, articles and journals on the subject. During the interview, he gave figures and case studies from various studies, including the Bank of America, Checkpoint, Sophos and Verizon.

“For example, the IT security company, Sophos recently published its report, The State of Ransomware in Education 2022 in which they gave insights into the ‘ever more challenging attack environment’ in which the education sector finds itself,” he said.

“Key findings are that ransomware attacks on education have increased – 64 percent in higher education were hit in 2021. Education is the sector least able to stop data being encrypted in an attack – higher education reported the highest data encryption rate of all sectors at 74%.

“The study also found that … education has below average cyber insurance coverage rates – only 78% of education organisations have cyber insurance coverage against ransomware compared with the global average of 83%. Many education organisations are choosing to reduce the financial risk associated with such attacks by taking cyber insurance.”

Cybersecurity should be a priority project for SU, Brian said. “So much could go wrong when a university is targeted. For example, when data breaches happen with student admissions and other personal data, a university can be fined by the regulator in terms of the POPI act. If our systems are compromised, the university could be forced to pay a breach fine of up to R10 million – or ten years in jail.

“We need to be always searching for the gaps. Hackers work 24/7 and always come up with new ways to compromise and breach systems for corporate espionage, financial gain, or national security espionage. We have to keep abreast with what’s happening in the world as it filters back to us.

“I’m so glad that SU’s senior management has bought into the importance of cybersecurity. To have an organisation with a chief director of IT who gives her full support – from budgetary support to moral support – on the importance of cybersecurity is hugely valuable.”

Image credit: Thomaguery; Getty

 

 

 

 

 

 

Email

Posted in General, News, Security | Comments Off on Risks of cybersecurity have become massive in higher education sector globally

Habits to adopt to ensure safety against cyber-attacks

Monday, October 24th, 2022

Cybersecurity on laptop screen while looking over shoulder

A student is innocently going through her emails. She sees one from a person she’s never heard of. There are spelling mistakes, but she ignores them and clicks on an attachment in the email. Suddenly her PC locks down and she can’t access her files. A message comes up and tells her she has to pay money to get her PC unlocked. Her data is kept ransom.

A use case from another university is a payroll supervisor logging into a public network at a hotel to check his emails and finalise the payroll. Later that evening he checked his email only to discover replies and emails from individuals he didn’t contact. His credentials have comprised and when he tried logging in again, he could not, staff salaries, personal information about staff all in the hands of a criminal. He was the victim of key locking.

These are real life examples of what can go wrong when a university is subjected to a cyber-attack. According to Dr Zenobia Davidse, IT Director General Support Services at SU, research shows that there has been an increase of 485% in ransomware threat level (Consumer Threat Landscape Report) and cyber-attacks are the fastest growing crime.

“These are picked up by the advance threat protection that is in place to detect them, and, thanks to efficient systems in place, they are averted, but it is still critical for all students and staff to play their part in ensuring the university’s safety against cyber-attacks,” Dr Davidse said in an interview.

“There are practical habits which everybody on campus can adopt to ensure safety against cyber-attacks,” she added.

In her position as IT director, Dr Davidse is in charge of “providing a set of services to assist, coordinate and support IT activities across the broader ICT function of the university”. Part of the task is supporting strategic initiatives across the campus.

A key task in her portfolio is the communication across campus about IT developments and threats.

Dr Davidse said there are a number of things which staff and students do which can put the university at serious risk – and these are often inadvertent actions. “Leaving your student card lying around is an invitation to gain access to SU buildings; failing to protect the password for your computer is also a big mistake; responding to a suspicious email, SMS or whatsapp is a no go – and even downloading a recording of a Teams meeting sharing the file with someone who should not have access to the information, can be serious repercussions for the university,” she said.

“Cyber criminals are constantly on the prowl for student information, data that they can exploit, systems they can keep at ransom – and they have very clever ways of getting it.”

Dr Davidse said there are a few things students should know when using the systems on campus. “It is important to be cautious when they log into the university’s various systems. Our correspondence to students would not be a request to fill in their username and password. So, if you receive any email, SMS or whatsapp from someone saying they are a representative of the university, and they need your password from you, you should not respond.”

Elaborating, she said: “A student’s access card is like a bank card because it enables access to different buildings, it contains printing credits, washing quotas, meal subsidies, etc, so if you leave it lying around, you can enable criminals to get access to places where your card has been provisioned for or deplete the credit.

“Another no no is to type your password out and paste it against your screen; or to share your password with someone else. Another action which is potentially dangerous is when staff create a shared folder and give people access without understanding that there is confidential information in there which others are not allowed to see.”

Dr Davidse said the university has a system in place to inform students which emails come from inside the university and which come from outside. “People should not ignore the ‘external’ sign that pops up in an email. Sometimes, you get an email, and you don’t know the person who sent it, but, out of curiosity, you click the link, start filling in a form or something and it is only then that you think, ‘but, why would the university ask me these things?’ Often it’s too late.”

Asked for practical examples of how students and staff can help to cyber-secure the university, Dr Davidse said: “A practical example is to use very secure passwords. Use a combination of lower and upper case letters, as well as numerical and alpha numerical – and never use the same password across different platforms. Do not use your university email address for a social media platform.

“Phishing emails and installing malware are methods used to gain access, trick someone share the username and password.”

Asked how staff and students can report cybersecurity risks at SU, Dr Davidse said the university has two very effective mechanisms. “One is to report the risk to the email, csirt@sun.ac.za, which is an email we use specifically for cyber incidents for prioritisation by our team.

“We also have a reporting utility within our email client. If an email comes in, there is a reporting functionality, allowing you to ‘report this message’ which you can do.”

Dr Davidse, who finds her job both challenging and fascinating, loves what she does. “I started off studying engineering. The most fascinating thing about engineering is to see how software can bring an idea to life; you see the promises of technology coming to fruition and the beauty of how it can really make things better in the world. I love how the answer is never obvious. You must do quite a bit of work before you find the solution to an issue.”

The best part of the job – which also involves linking the latest technology to the realm of higher education – is that it is constantly changing. “You can be finished with implementing one technology and the next piece comes out making it more advanced and innovative, so it’s never boring.”

Her last word, on cybersecurity, to students and staff, is: “People are trying to hack into systems all the time. It is up to all of us to protect our institution from this by putting simple measures in place and being constantly vigilant.”

Image credit: Guvendemir; Getty

Email

Posted in General, News, Security | Comments Off on Habits to adopt to ensure safety against cyber-attacks

New IT head puts spotlight on cybersecurity at Stellenbosch University

Monday, October 24th, 2022

Paper sheet with cybersecurity plan concept written on it

About six years ago, when Dr Denisha Jairam-Owthar was working as Chief Information Officer for the City of Johannesburg, the city was subjected to a massive cyber-attack which brought the organisation to a grinding halt. Hackers got into the city’s network and demanded money. The metro – the biggest in South Africa – had to switch to disaster recovery mode and all systems had to be shut down.

“That was when I experienced, first hand, the magnitude of a cyber-attack on this scale,” Dr Jairam-Owthar said.  

“When this sort of attack happens, the whole technical team faces a mammoth, urgent task. You have to look at every single system and find out where the vulnerability was. While you’re doing all this, you must ensure the organisation can continue to operate. This must all happen in parallel. There is no level of tracking or planning on paper that can prepare you for that day.”

At the time of the cyber-attack, Dr Jairam-Owthar had a four-month-old son. But that didn’t stop her from joining her team in working a gruelling 90 hours a week. “My staff and I brought sleeping bags so that we could sleep at the office, working shifts, sleeping for three or four hours at a time, manning our nerve centre to technically unravel this cyber-attack.” Her baby became sick from not seeing his mum, and the paediatrician asked what was happening at home. She explained that she was dealing with a crisis – and had no option but to soldier on.

Fast forward to today – and, as Stellenbosch University’s Chief Director: Information Technology Division, Dr Jairam-Owthar is always, on high alert for cyber-attacks on the campus. “Cybersecurity is one of those things that keeps me awake at night,” she said.

In an extensive interview, Dr Jairam-Owthar (39), who took up the position in January this year, was reassuring that SU is in safe hands. But with risks always at play, she stressed that cybersecurity should be “everybody’s business” on campus.

“Cybersecurity is a hot topic, because it is becoming increasingly prevalent. We see cyber-attacks on prominent organisations on a daily basis. They might have all the controls in place, but it just takes that one vulnerability to probe the weakness to come through – and before you know it, the entire network has been permeated.  It is not a matter of if a cyber-attack is going to happen … it’s a matter of when,” she said.

“CIOs have no option but to ensure that their cybersecurity systems are well resourced and resilient. The cost impacts on organisations and on society as a whole can be very difficult to come back from. Every CIO must be ready for when this happens and know how to respond – on a technical level, and on other levels, like how the institution deals with the situation.”

Dr Jairam-Owthar said the Covid-19-driven switch to digital acceleration has contributed hugely to the growth in cybercrime. “So many people suddenly found themselves working from home and depending on digital platforms. Cyber criminals quickly understood they could exploit this situation. Hackers are also highly aware that, in developing economies, many institutions do not update and upgrade their technology and infrastructure, and that’s where the vulnerability sits. These very intelligent hackers know we are challenged with funding, to keep up with technology. This is why countries in Africa become targets.”

Moving to why cybersecurity is so important for SU, she said: “This is an institution of real excellence in academics and research. We have researchers across many faculties, and there is so much research data in the system. Ethics in research is so critical. You cannot release the data unless you have followed all the processes. It is absolutely vital to ensure that the data, network and our online systems is well secured.

“On top of this, the system contains a great deal of students’ personal information – their exam marks, certificates and their whole student life cycle information. This could all be affected in a cyber-attack. When an attack happens, the reputation of the entire university comes into question, and those who fund research could become sceptical.

“I have to be able to say to my bosses at SU, hand on heart, that I’ve done everything I can to protect all our systems, network and information.”

Giving strong reassurance that SU is in safe hands,  Dr Jairam-Owthar said cybersecurity was high on her agenda when she joined the university in January. “With the support of the university’s leadership, we did an assessment of where we stand.  It found that we are well within the industry norm but there’s a lot more to do because, when it comes to cybersecurity, we are faced with a moving target. We cannot be static or complacent about it. So while we are fine in terms of the industry norm, we have to always drive to improve. The most critical challenge for CIOs is to keep up with this moving target of cybersecurity.

“We do have our controls in place as a university, but … even if we put in excellent controls; someone in Amsterdam for example can find a vulnerability. We have to be on the pulse, staying ahead of the target – because it is moving all the time.”

Dr Jairam-Owthar said there is also the issue of balancing costs. “Our partnerships with our vendors, such as Microsoft, become critical. We have to consistently ensure our vendors deliver value. The skill lies in balancing shrinking budgets with moving targets and higher expectations of technology.”

When she was at the City of Johannesburg, Dr Jairam-Owthar played a key role in the institution’s IT Digital Transformation. Passionate about education, she believes her role at SU is to enable education through technology at SU, because IT is a ‘critical enabler’ in the transformation of education”.

“The impact of what we do is to enable students and staff to be educated. That is the part that speaks to me as a person. Education holds a place in my heart.”

Dr Jairam-Owthar said the university recently did an analysis using the National Information Security Technology (NIST) cybersecurity framework.

“The NIST is a tool which does a full analysis of the entire IT environment and where the weaknesses lie, and how to prioritise to close the gap. That report has been done, and we are engaging on it in terms of priority and the budget to start implementing it to strengthen our controls and security,” she said.

Turning back to the incident at the City of Johannesburg, Dr Jairam-Owthar said it was “like walking through fire”.

“It’s like having an intruder in your home, and you are standing in the house and you don’t know which door the intruder came in. I never want anyone to go through that again. I wouldn’t wish it on anyone. We need to be well prepared.”

Asked what her main message to SU students and staff is when it comes to cybersecurity, she said:

“My main message is that cybersecurity is everyone’s responsibility, not just that of the IT Division. Everyone on campus – staff and students – need to play their role. To stress the importance of this, we will soon launch our cybersecurity training aimed at strengthening our human firewall which is the staff and students. Everyone on the campus, must do their bit to strengthen this human firewall.

“SU has such excellence in academia and research. Let’s work together to find the gaps and strengthen the systems. It’s the simple things like don’t share your passwords, make sure you authenticate when you get on the network, don’t go to sites that look odd; being able identify a phishing email. Check with us if you are not sure. If you get an email that doesn’t sound right, talk to us and we will guide you. Most cyber-attacks come through the human firewall. We cannot work in silos for cybersecurity either. We need a holistic approach for SU for cybersecurity. Lastly, make sure you do the training, it will empower you on what to look out for.”

When Dr Jairam-Owthar looks at her son, now a healthy, happy hi-tech six-year-old, she sees a boy who “handles a phone, an Ipad and a computer all at once”.

“It is for this generation that we need to bring the university into the digital fourth industrial revolution.

“I say to my IT staff that; our primary stakeholders are the 33 000 students and the 3500 staff of this university. I want to know what our primary stakeholders look for in technology so we can meet their demands in a safe and secure way, where we are also implementing a key principle of ‘security by design’ on any technologies we implement”.

Image credit: Formatoriginalphotos

Email

Posted in General, News, Security | Comments Off on New IT head puts spotlight on cybersecurity at Stellenbosch University

« Older Entries
Newer Entries »
 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.