Thanks to rapid digitisation, a greater focus on short courses and a desire to compete on the global stage, universities are setting themselves for a more profitable future. But saddled with such lofty ambitions come new security threats – ranging from stolen data to identity theft.
Jasper Rowe, Principal at Rowe Consulting, is at the forefront of this higher-education transformation. He’s spent more than two decades working in the security space, having built and deployed the shared identity and access management (IAM) service for the NSW Government. Jasper and his team are specialists in the university sector, so he was the perfect person to sit down with and discuss the challenges around identity establishment and user authentication at tertiary institutions.
Managing identity in a fast-changing sector
Like most industries, the university sector has been majorly impacted by COVID-19. Many have decided to accelerate their digital transformations as a way to mitigate their reduced funding and set themselves up as more flexible education providers.
Many would argue that tertiary institutions were already slow to adapt to a changing market, and the pandemic simply opened their eyes to the reality: that students have a keen appetite for flexible learning. But with any change, new challenges inevitably follow.
“When we look at the way in which the learning market has changed over the past three to five years, there’s been a very significant shift to digital learning,” Jasper says. “And much of that comes down to people wanting to learn something very specific.”
“We’re seeing people seek out higher education as a way to, for example, become a more effective manager, rather than seeking out a postgraduate degree. Or perhaps they want to expand their development capabilities by learning Python, or understand what’s happening in cryptocurrency by taking a Bitcoin 101 course.”
While most universities have the capacity to meet those specific needs, they aren’t designed to deliver learning in such a way. Jasper says it’s still very much around an “award-based program”.
“As we see this shift towards digital learning,” he says, “there’s an acceleration of the desire to deliver short-course products.”
How does identity address this?
It’s incredibly difficult to understand your market – and to effectively market to them – without having a clear identity and access management (IAM) strategy. IAM is about defining and managing the roles and security access privileges of all individuals, whether they be students, employees or external contractors. By having a trusted digital identity for each and every person interacting with the university – online or on campus – you can begin to effectively manage and monitor exactly who is accessing what, when, where and how.
“If you look at the lifecycle of a student, we come in as an undergraduate, progress through our degree and then become alumni,” Jasper says. “Once we’re an alumnus, we have essentially finished our engagement with the university. But that becomes problematic because the reality is that those alumni can then become advocates and even prospects for future short courses.”
Because of this, in order to effectively manage that journey from undergraduate to alumnus to short-course student, identity must play a central role. This is particularly true when you consider how short-course students should have access to learnings and services.
“Imagine you’re in the school of medicine and you have a specific course around brain specialisation,” Jasper says. “We would have people from external institutions or external hospitals coming in to undertake that as a short course, potentially sitting alongside an award-based student.”
“Everyone needs to see the same materials and have access to the same level of intellectual property. But if there’s isn’t an effective identity approach that manages how both external and internal people interact with that data, as well as the staff members who are administrating the course, then it becomes very difficult to make these kinds of transitions.”
Protecting commercially-sensitive IP against malicious actors
Migrating from traditional services to a digital-ready offering might mean universities have greater opportunities to attract students and staff, but it also raises new risks – particularly around their sensitive data.
“The key risk when we look at things from an information-security perspective is the risk of being compromised by nation-state actors or those who would seek a commercial advantage,” Jasper says. “If we look at the current pandemic as an example, there is very heavy research around finding a vaccine. Some of this data is being shared, while some of it is considered to be commercially sensitive.”
“There was a recent attack on a UK university and the British Government has asserted that it was the Russian Government who compromised the university to access vaccine information. So while a certain amount of that would be shared, another portion becomes commercially sensitive because you need to be able to justify the investment you are making into these areas. That means the risk of nation-state actors compromising your data is quite high, and the impact of that can be financially devastating.”
The only solution is to put the appropriate identity and access management in place. Without it, universities risk jeopardising their ability to protect their commercially sensitive IP, which could ultimately impact their chances of attracting the right type of organisations and securing lucrative research contracts.
The leaders will be universities that focus on both service delivery and IAM
The end goal for every university is to get everything right: the user experience, the top-class student service delivery and the deployment of identity and access management. What, then, is the outcome? Jasper says it goes beyond merely bumping up enrolments.
“One of the key drivers for a lot of universities is taking control of what’s happening from a short-course management perspective,” he says. “As we see the increased digitisation of education, getting identity right means providers can take advantage of the very rapid movements happening in the market right now.”
“We also have to understand that competition has now changed. We see, for example, Harvard offering all of its courses online – as soon as you’re online, you remove that need to be on campus, which essentially means that you are competing more than ever on the global stage. And getting identity right means that you are able to compete more effectively in the digital marketplace.”
You can listen to more of Jasper’s insights on episode 14 of our podcast, IDentity Today. For more information about how your organisation can leverage the power of identity, contact us today.
