A University network is a unique entity with difficult security parameters that need to balance academic freedom, intellectual property protection and normal business operations. As in any environment, breaches occur as a result of unique organisational failure modes, which are often better understood by attackers than by defenders. To complicate matters, security operations are a somewhat special branch of IT which is sometimes poorly understood by the rest of the IT environment and the wider organisation.
To even the scale, understanding your attacker and their objectives is key to a robust cyber security practice. In this talk, I will focus on designing and structuring security operations that take an understanding of the goals and objectives of an attacker as their starting point. True to the nature of an academic environment, such operations need to be light touch, robust and cost-effective. I will discuss some of the regular incidents in our environment and how we have designed controls. In particular, at the University we have developed a number of ‘predictive controls’ that have proven successful in detecting and deterring compromises of University data. I also discuss the sort of security skills and security operations that are required to implement and maximise the usefulness of predictive controls.
