The threat to enterprises across the Internet from cyber attacks is changing. Attackers have become more skilled, better organized and better resourced. Higher education has become the target for national intelligence agencies, cyber criminal gangs, and hacktavists. Higher education institutions and especially research institutions have what these groups want and it is worth their effort to get the information. Meeting these threats requires a different strategy. During the 20th century most institutions adapted a “perimeter” defense strategy. This approach fell short as the threat evolved. Conventional wisdom evolved to a “defense in depth” strategy, forcing attackers to breach many layers of defense. Still, this required the defender to be strong everywhere and the attacker to be able to concentrate his effort. In the last few years our understanding has changed and many are adopting an “intelligence-driven kill chain” defense. This approach acknowledges that intrusions are inevitable, but flips the paradigm in that a defender only has to be successful once while the attacker must succeed every step on the chain to successfully complete an attack.

What is your institution’s posture on cybercrime and espionage? Does your campus have the tools in place protect against the “smash and grab,” “dirt jumpers,” “waterholing,” “living off the land,” “packing” and “fluxing” ploys and techniques currently being used against cyber infrastructure and users? The REN-ISAC community is able to assist institutions with vulnerability and threat prediction, detection, prevention and remediation through an arsenal of tools and an extensive library of knowledge. REN-ISAC’s mission is to aid and promote cybersecurity operational protection and response within the research and higher education (R&E) communities. The mission is conducted through private information sharing within a community of trusted representatives at member organizations, and as a computer security incident response team (CSIRT) supporting the research and education community at-large. When REN-ISAC alerted institutions to the POODLE vulnerability is an example of a situation that provided many institutions the means to strengthen their security posture, protect their assets and promote security awareness on their campus.

Troy is one of the SAINTCON and UtahSAINT founders, and continues to be the driving force behind the conference and organization. He’s relentless in his passion for the community, including being a part of the DEF CON security conference and as part of a CTF organizing team.