Higher education’s reliance on third-party software and Software as a Service platforms has never been more consequential. Recent attacks on learning management systems and other platforms used by higher education institutions have demonstrated how a vulnerability at a technology provider can become a problem for institutions that depend on it.
For universities, the challenge is particularly acute. Third-party applications are embedded in teaching, research, administration and student services, often handling enormous amounts of sensitive data. How can institutions take advantage of these technologies without assuming that a trusted vendor is necessarily a secure one? How do they assess risk, balance security with the need for innovation, monitor vendors after deployment and prepare for the possibility that a compromise somewhere in the software ecosystem could ultimately affect their institutions?
EdTech spoke with Jon Allen, associate vice president, CIO and CISO at Baylor University; Fred Kwong, vice president and CISO at DeVry University; and Shefali Mookencherry, CISO and chief privacy officer at the University of Illinois Chicago, to learn how they’re managing risk at their institutions.
WATCH: A CDW webinar outlines how to map third-party SaaS risk.
HEALTHTECH: Jon, you were there when higher education institutions began collaborating more to assess the security risks of third-party software. Set the stage for us.
Allen: Back when higher ed started getting serious about cloud applications — and security reviews around cloud applications — it was a nightmare. Every institution had its own questionnaire for each vendor. If they were lucky, they got it back in 30 days. In all likelihood, it was filled out by a salesperson, not somebody who actually knew the environment. And it was hard to produce quality assessments.
At the 2016 EDUCAUSE cybersecurity conference, we asked, “Why aren’t we collaborating as institutions?” Originally, the idea was shared assessments, but that’s hard. Institutions have different risk postures, and vendors weren’t keen on institutions sharing detailed assessments with each other. So, we created the Higher Education Community Vendor Assessment Toolkit. That was a big evolution in the higher ed space.
Often, I’ll now engage with a vendor, and they’ll give me a completed HECVAT. It may not always be the most up-to-date version, but it’s not like starting from zero. We have a common language. We have common expectations.
LEARN MORE: Third-party risk management helps institutions detect threats.
HEALTHTECH: Considering recent breaches among software providers, how would you characterize the current threat environment?
Mookencherry: Universities must be more vigilant than ever in monitoring and managing risk. Third-party breaches are occurring with increasing frequency and receiving greater public attention, while regulatory requirements continue to expand. Encouragingly, third-party organizations are becoming more aware of their compliance obligations and are being held to higher standards of accountability than in the past. As security programs mature nationally and globally, transparency and visibility into cyber risks have increased significantly. The era when organizations could assume they were unlikely to experience a breach is behind us. For higher education institutions, risk assessment can no longer be a periodic exercise; it must be a continuous and ongoing process.
Kwong: I would say it’s a higher-risk environment than what we’ve seen in the past. Threat actors can leverage artificial intelligence to discover vulnerabilities, find flaws and execute against them. Before, sophisticated threat actors had the skill sets to do those things; now it’s in the hands of the masses. And that’s the scary part.
Allen: What constitutes risk at this point? Five years ago, everybody would have said Social Security numbers, credit card numbers, things like that — data elements. But at the end of the day, if core business or academic applications are unavailable, that can almost be more catastrophic to your operation than data loss, which is a sad situation.
We’re starting to get a hint of the new threat landscape under AI and various geopolitical tensions. It’s a contentious time, from that standpoint. The next 12 to 18 months are going to be hard.
HEALTHTECH: How has your approach to evaluating third-party software changed over the past few years?
Mookencherry: As part of every software contract renewal, universities should conduct a comprehensive reassessment of vendor risk to account for evolving threats, emerging technologies and ongoing innovation. Universities should typically require vendors to provide a SOC 2 Type II report or a HECVAT assessment, when available. If those certifications are not yet in place, the university should work collaboratively with the vendor to establish a roadmap and timeline for achieving them. If contractual agreements do not clearly define breach notification requirements, response obligations or accountability measures, universities should ensure those provisions are incorporated. Ultimately, the focus is not only on security and compliance but also on strengthening business resilience and ensuring operational continuity in the face of evolving risks.
Kwong: From a questionnaire and assessment perspective, we do it on a yearly basis. We also leverage Bitsight to do continuous monitoring of vendors. It’s a data point that we can use to help us understand if their security posture changes in any significant ways over the course of that year. When we combine those two things together, it gives us a more holistic view of the vendor.
Allen: With many of our regular vendors, we’ll ask them to show us their SOC report or tell us how they handle their cloud environment, and they’ll toss us a Microsoft Azure, AWS or Google Cloud document. But we’re not contracting with those guys — the vendors are. And things can change at any point. We want to see a clear responsibility matrix.
DISCOVER: Continuous threat exposure management helps higher ed prioritize risk.
HEALTHTECH: How do you balance enabling innovation for faculty and staff with maintaining appropriate security oversight?
Mookencherry: Universities thrive on innovation, research, experimentation and academic freedom. The objective is to ensure that security enables these activities rather than impedes them. The goal is not simply to say no. Instead, it is good to understand the risks, establish appropriate safeguards and create a framework that allows universities to confidently say yes.
Experience has shown that when security is perceived as a barrier, users may seek alternative ways to accomplish their objectives. That is why education, awareness and collaboration are critical components of our approach. Working closely with faculty and staff to help them understand potential risks and implement mitigating controls is key. In situations where a higher level of risk is accepted, there may be a requirement for a formal risk acceptance process to ensure that stakeholders understand and acknowledge their responsibilities. The focus is on helping users make informed decisions while identifying practical ways to reduce risk, such as network segmentation, limiting access to authorized users or implementing additional security controls. Ultimately, security’s role is to support innovation while maintaining an appropriate balance between opportunity, risk and institutional resilience.
Allen: We make decisions about implementation based on our assessments. That’s where a lot of risk mitigation happens. We may choose not to put certain data elements into a solution because of what we discovered through an assessment. We may change the way we handle authentication. Those are very campus-oriented decisions based on a risk profile. I’m not saying, “Shame on you, you shouldn’t be using that provider” or, “Hey, you’re not using the right version of TLS.” Instead, we’ll have conversations and educate users about risk.
Click the banner below to subscribe to our weekly newsletter.
HEALTHTECH: When a third-party vendor experiences a breach, what does your incident response process look like, and what information do you need in the first 24 hours?
Kwong: We’re a Canvas user. In the first 24 to 48 hours, we are in the trenches, trying to understand how we were affected. We have a good idea, because we have pretty good mapping of our connections to different third parties and what type of information we’re sharing with them. But right off the bat, we want to know if it’s safe to continue using the platform or technology. Or do they still have a potential breach scenario and they’re in cleanup mode? Are they still fighting off a threat actor that’s inside?
With Canvas, the saving grace for us was we do our own single sign-on to the application. We didn’t have our identities in their system. Having said that, we had to do key rotation. We reset all of the APIs and reset passwords because we weren’t sure how we were affected. Then, we did analysis of our own log files, and that’s about all we could do from our side.
HEALTHTECH: How has artificial intelligence impacted the way you evaluate third-party risk?
Allen: Our organization reviews all software contracts for the university. We start with our risk posture to protect institutional data. We can’t have leakage. I can’t tell you how many renewals we’ve seen in the past year where there’s one extra little section: “Hey, by the way, we train on your data.” No, you don’t.
Mookencherry: Universities should enhance their security assessment questionnaires and vendor review processes to address the growing use of AI. AI concerns center on data oversharing and data leakage. When AI capabilities are embedded within a software solution, it is good to seek a clear understanding of how the vendor manages and protects data, particularly if customer information is used to train, tune or improve AI models.
Given that vendors often serve multiple clients, it is critical to understand how data is segregated, protected and prevented from being exposed across tenant environments. It is good to also assess the vendor’s policies and technical safeguards related to their own AI development and usage practices. Ultimately, there should be assurances that appropriate governance, security, privacy and data protection controls are in place to safeguard institutional information while enabling the benefits of AI-driven innovation.
Kwong: Vetting the AI technologies that vendors are putting in place has been the biggest change to our assessments. Previously, through our vendor management process, we would ask questions about their security posture. Now we’re asking, “What type of AI are you using? How is it being leveraged? How is our data being used, if at all? Is it confined within our own instance or is it combined with other people’s data into a separate instance?”
Interestingly, new vendors are easier to get a handle on. It’s the ones we already have relationships with that suddenly turn on AI and you don’t know about it until you find out either through the grapevine or as part of annual security recertification.
UP NEXT: Are you ready for third-party risk? This checklist can help you be certain.
HEALTHTECH: Looking ahead three to five years, what do you think will be the biggest challenge in managing third-party cyber risk?
Mookencherry: The biggest challenge is visibility. As AI vendors rapidly evolve through startups, mergers and acquisitions, understanding third- and fourth-party risks becomes increasingly difficult. Greater transparency from vendors about both their strengths and gaps would help universities better assess and manage risk. Today, much of that due diligence burden falls on the institution.
Kwong: I think you may see a turnaround for some organizations, especially those that went 100% cloud, where they bring some applications back in-house. That could be particularly true with AI, when they start understanding the token costs of using these third-party models.
There needs to be an AI security framework. We’re all learning this stuff as quickly as possible, and there are various models to work from. But because we have all these vendors working with the technology, they’re in a much better spot to give us insight into how they’re controlling for it. If they could provide that data back out to us, we could look at our own programs and leverage it to be more secure. Being more transparent would help.
