Cybersecurity Risk Management in Higher Education—It’s Not Just an IT Problem:

Changing Higher Ed podcast 279 with host Dr. Drumm McNaughton and guest Brian Kelly

Transcript: Changing Higher Ed podcast 279 – with host Dr. Drumm McNaughton and guest Brian Kelly

Introduction to Changing Higher Ed^®

Welcome to Changing Higher Ed^®, a podcast dedicated to helping higher education leaders improve their institutions. With your host, Dr. Drumm McNaughton, CEO of The Change Leader, a consultancy that helps higher ed leaders holistically transform their institutions. Learn more at changinghighered.com. And now, here’s your host, Drumm McNaughton.

[00:00:20] Introduction and Guest Welcome

Drumm McNaughton: Thank you, David.

[00:00:22] Brian Kelly’s Background and Career

Drumm McNaughton: My guest today is Brian Kelly Chief Information Security Officer (CISO) at Community Health Networks for Connecticut. Before joining the Community Health Networks, Brian was a virtual CISO for Compass IT Compliance, and in his role as a CISO, he supports the safeguarding of information assets across multiple verticals against unauthorized use disclosure modification, you get the meaning he’s protecting your data and all the personal information that’s on your networks.

Brian has a long history in higher ed as well as CISO. He got his start in the Air Force and was a CISO at Quinnipiac University. He was also worked at EDUCAUSE for a long time. He joins us today to talk about all things cyber and what institutions should be doing to protect their data.

Brian, welcome back to the program.

Brian Kelly: Thanks for having me back. I’m glad to be here.

Drumm McNaughton: My pleasure. We had such great conversations before, I’m really looking forward to this one.

Brian Kelly: Same here. Same here.

[00:01:23] Transition from Virtual to Physical CISO

Drumm McNaughton: And of course, things have changed in your world. You’re no longer a quote virtual CISO. You’ve got a, maybe I should say, a little more sane job.

Brian Kelly: yes, I think, or less virtual. I’m sitting in a physical office today and, having one client to support and not virtualizing myself. What was the movie years ago, I think it was a Michael Keaton movie where he cloned himself or made copies of himself. I don’t feel like I’m doing that anymore. I can just be in, in one place and singularly focused.

Drumm McNaughton: Very good. When you say cloning, for me, it goes to Iron Man three, that’s.

Brian Kelly: A more modern reference. Exactly.

Drumm McNaughton: So when I think about Michael Keaton, I think about Beetlejuice.

Brian Kelly: That’s the classic or one of the Batmans, depending on where you are , in that as well.

Drumm McNaughton: Exactly. So getting off the movie references, of course there’s a lot of crazy things going on with movies as there is, but there always is.

[00:02:21] Understanding the Role of a CISO

Drumm McNaughton: Tell us about you and what a CISO is, ’cause a lot of folks don’t really understand cyber world other than, “oh my gosh, I can get all sorts of interesting things buying them from Amazon on the internet”. Sorry, I didn’t mean to give a commercial folks.

Brian Kelly: yes. And I was, as we were thinking about the movie. Plots a lot of, the sort of the cybersecurity or information security world, right, sometimes has these movie plot scenarios that we’re fighting against. So from a CISO or a CISO, depending on, how you wanna pronounce that, a Chief Information Security Officer has really evolved into being everything from what was traditionally data security or computer security through privacy and compliance, and really looking at how to help an organization reduce risk, operate in today’s environment where there are lots of sort of movie plot threats out there, but also be able to be functional, right, we can’t surround ourselves in bubble wrap and be protected from everything. So it’s a really interesting role. I’ve been in it, I know you said, as a virtual CISO, I was a CISO at Quinnipiac University for a very long time, 13 years.

I worked with EDUCAUSE, helping guide other campus CISOs in their decision making. And really it’s about culture, it’s about trying to advocate for how we can work, in our organizations and do that securely.

Drumm McNaughton: And the CISO or CISO as some people call it, they’re the ones who send out these really annoying messages that say, “don’t click on links that you don’t recognize”.

Brian Kelly: yes, and I think, yes,

Drumm McNaughton: Sorry, I couldn’t resist.

Brian Kelly: I think it’s trying to, less about annoying and more of that educational piece. I think being careful about how we message, right, is the, we don’t wanna be the office of “NO”, we want to be the office of “KNOW”. We want you to know what the risks are.

And I think for a very long time, your sentiment is true, the end user receiving that, sometimes scary, sometimes intimidating, sometimes condescending email from a security person saying, “don’t do this or look out for that” without the detail, ends up feeling annoying to the end user, and really I think that’s an opportunity to say, how can we better message, how can we better communicate, right, so that you feel we’re here as a partner to help you. yes.

[00:04:38] Cybersecurity Threats and Real-World Examples

Drumm McNaughton: What’s the worst cyber event that you have seen? Maybe not personally, something that listeners can relate to and says, “oh my gosh, that was huge”.

Brian Kelly: I think for many of us in the last year or two, we had the United Healthcare breach, where a lot of our personal health information, many, many millions of Americans. And that data is at risk and it’s similar, we talked a little bit about DOGE and, Social Security administrator warning recently, within the last week or two, or it was big news or in the number again there was close to 300 million American’s data is potentially, exposed or at risk. And I think those are the things that are concerning to us as citizens, as users is, people on the internet of how our data is protected, how it’s shared, where it lives, and to some degree, we look at those numbers, 300 million plus Americans impacted. We almost have to assume compromise that all of our personal information is already somewhere out of our control.

[00:05:38] Personal Data Protection Strategies

Drumm McNaughton: Yes, My wife and I got notified of a potential breach. It wasn’t with DOGE and the Social Security Administration, it was something else. And we ended up putting our credit on lock so that nobody could access it.

Brian Kelly: So we recommend, I think they call it a credit freeze. So you freeze your credit and that’s not always a simple and straightforward process. There’s multiple credit agencies, you have to go to Experian and TRW and all of them and do that. And they’ve made it a little bit easier for you to freeze and thaw that.

But that’s typically the advice that we’re giving, from all aspects, even for minors. So I, I have, two boys, that are both o over 18 now, but when they were younger, we had set up those credit freezes, ’cause oftentimes that personal information of a minor child, where there was one last year where Power School, which is the backend administrative services function for a lot of K-12s across the country, they were compromised. So they lost the information of minor children. You worry that those children, that information could be used to open credit and the things that you worry about in our stage of life, we also, as parents, need to think about doing those credit freezes for our minor children as well.

So, yes, I think that’s, unfortunately the strategy is you’re no longer at a point where you believe you can protect the privacy, keep that information private and not being released. Now we have to think about how do we protect against the misuse or the unauthorized use of that information that’s already out there, already leaked.

[00:07:10] Ransomware and Phishing Attacks

Drumm McNaughton: And that misuse happens not only with individuals, but it also happens with organizations. We hear ransomware going on, and the way that these things happen is the same thing that happens with people. Someone clicks on a link that takes them down to a black, rabbit hole.

Brian Kelly: yes, it’s a new evolution of a centuries old con, right, at the end of this rabbit hole, or at the top of that rabbit hole is really trying to trick the individual out of information. We see that, as you described, organizationally, the FBI calls it a “business email compromise”, and they like to use the acronym, BEC. And really that’s where you’re seeing these emails, we call them in the CISO world or the cybersecurity world, we call them “phishing attacks”. They’re casting a lure into your inbox and trying to get you to click on that link. When you click on it, it takes you to a place that looks like your bank or looks like Google. And really what is happening there is they’re harvesting your login. You’re at a fake login page, you’re putting in a username and a password, and they’re capturing that, and that’s the beginning of, how those ransomware attacks, how the business email compromise where businesses are having a direct deposit or payroll information change. All of that sort of begins with a seemingly innocuous email that’s has a little bit of sense of urgency, that knows a little bit about Brian or Drumm and says, you need to do this now or you’re gonna lose access”, or, “we can’t process this” , there’s always some little sociological, or psychological, rather, trick to it that, that gets us to click. Right? We know better, but we still click.

Drumm McNaughton: yes, we still do. Lately, what I have been seeing is, “your PayPal account is being closed”, or “thank you for your purchase of X, Y, Z software, if you didn’t do this, click on this link”.

[00:09:07] Evolving Tactics in Cyber Attacks

Brian Kelly: You’ll also see, and we talked a little bit about or earlier about, our preferences of Android or Apple or in mobile devices, and we’re starting to see those type of clickable frauds happen via text messaging. Instead of you, where we traditionally saw those in email and you’re seeing, you know what we’re calling phishing, voicemail phishing. So a call on your mobile phone saying, ” there’s a problem with your PayPal account”, or there’s a problem with this and getting a new callback a number. And you see that shift happening because we’ve done a good job from an enterprise perspective about identifying phishing, blocking those emails in our corporate or our campus email.

The bad guys, the adversaries are looking at shifting tactics and they’re saying, okay, I can no longer get people to click on those emails because they’re not reaching the recipient. Let me shift and send them a text message or let me call their phone and leave a voicemail because there’s not the same level of protection there yet. So it’s an interesting sort of whack-a-mole in a tactical shift, as you secure one area, it moves to another.

Drumm McNaughton: yes, Whack-a-Mole is a good description of that.

[00:10:15] Blending Personal and Professional Cyber Risks

Drumm McNaughton: And also too, for someone who is doing personal business on their corporate or their institution laptop. If you click on something like that for a personal thing, you’ve just given them access to your institution’s network because you’re doing the business on the same computer.

Brian Kelly: And we see a little bit of that blending, even with LinkedIn and other social media sites where, if they can’t attack you via your institutional email, they’ll send you a LinkedIn message.

Drumm McNaughton: And this LinkedIn message. I’m getting all sorts of things, I’ve got a lot of connections. And I’m seeing more and more of a photo of someone who wants to connect with me, and it’s obviously a young woman, very attractive, in her early, mid-twenties, whatever. And the profile, they graduated from the Wharton Business School 20 years ago. They’ve been the managing director of x, y, z fund. And if you go out and search for that fund, it’s a legitimate fund, but you can’t find their name there. So they’re becoming more sophisticated.

Brian Kelly: Absolutely. And I think that’s the caution is you doing those things that you described when you get a LinkedIn request trying to validate is this request legitimate? Is there a shared connection? Is there somebody that I know and I know well that’s already connected to this person that I could reach out to out of hand and say, “Hey, Drumm, I just got this wonderful LinkedIn connection from, Susan X, how long have you known her? How did you meet this person? ” And all of these defenses take time. The attackers out there on the internet, they know we’re busy they know we’re not paying attention. They know 90% of the world’s not gonna take that extra effort. They’re just gonna click accept. And that’s why it works.

We used to say the “stop, think, and then click”. Right? Trying to build off the “stop, drop and roll” in fire protection. That was a very popular buzz term for a while, is like, just stop and think before you, you click. And it still has some applicability I guess.

Drumm McNaughton: yes.

[00:12:20] Enterprise Risk Management in Higher Ed

Drumm McNaughton: So let’s swap over to some of the things that have been going on in Washington, because those have some implications with cybersecurity. We already talked a little bit about DOGE and the Social Security Administration risk. The Department of Ed is going through massive changes. Their role was oversight and protection of student data, but some of the things that they’re doing, I have to wonder, are we protecting the data like we should?

Brian Kelly: It’s a really, really good question. And, from my time at EDUCAUSE we worked with a number of folks at the Department of Education, the CISO and the CIO there, as well as really focused on FSA, the Federal Student Aid Organization within the Department of Education, and their role, as you said, was really oversight and ensuring the protection of student financial aid data and those Title IV programs and eligibility and really looking at our institutions and being not only the audit, but the enforcement arm of the Department of Education. Which really in, in my opinion, helped drive awareness at institutional level, from a leadership level, from the presidents, from the provost, certainly from the heads of financial aid where if your institution’s not in compliance you are gonna lose the ability to participate and be eligible for those programs. And that’s not only a concern from a student data perspective, but a financial viability of the institution. What is worrisome, from our perspective is, there’s no updates since 2024 from FSA on their website. They had a really active program that was providing guidance. Right? So there’s nothing within the last 10 months. So that’s a scary thing to look at, how are they engaging with our campuses? And, back to DOGE a little bit, you know how we know that the Department of Education was a target there as well, but more specifically, how’s that oversight role been impacted, and asking the listeners to think about that on their campus and their institutions with having conversations with their directors of financial aid and their CISOs, and saying, “what have you heard? What have you seen change?” Really being that conversation starter to help connect the dots, so to speak.

Drumm McNaughton: It also gets into something that we’ve talked about before, enterprise risk management. Are you game planning out, “what would happen if your data got frozen from a ransomware? What if your data was compromised and put out over the internet? Those are all things that you’ve gotta consider.

Brian Kelly: Right, and they’re all part of that, as you said, the holistic ERM or enterprise risk management on a campus that’s not a specific to IT or to information security is really having those conversations. In a lot of, the ransomware, as you’ve, we’ve talked about, conversations end up in we have a cyber liability or an insurance policy that will help us maybe pay that ransom, but that’s only part of it. You and I have talked about, our Air Force backgrounds and our military backgrounds, and there’s this term that we use, this acronym, this, ability to survive and operate our ATSO.

In a military context, you assume you’re going to be attacked. Right? You’re going into battle and there’s going to be an attack. How can you function during and after that is really important. That conversation around, are we protected against ransomware is only half of it. Right? How do we continue to deliver online classes? Are we able to, provide transcripts? Are we able to, order food in our cafeteria? You walk on a campus. Or anywhere. You go to a sporting event or a concert, everything is cashless these days. It’s all, using a card.

Those are in the spirit of having conversations in enterprise risk management is how would we, how would we, if this happened, how do we continue to function to, to feed our community? How do we continue to pay our community? Those scenario-based conversations are really, really important.

[00:16:23] Reputational Risks and Data Security

Drumm McNaughton: The other piece with that is the reputational risk. What have you seen? What’s happened when an institution has a cyber attack like this. Data’s compromised, it’s hurt enrollment, hasn’t it?

Brian Kelly: , It has, there’s not really good data out there. There’s not a good study or a good report to point to and say, when there’s been unfavorable media about an institution’s handling of data, enrollment or applications are down, I think that’s always a concern that you have across the board. I think that there’s just maybe some apathy now in society in general. And again, back to the United Healthcare, large, large number of individuals impacted, they’re still in business, their stock took a hit and they have to put that on their 10 K and now , there’s some SEC things and maybe penalties, but life goes on. Right?

We look at Target and Home Depot and all of these other larger breaches that, from a cybersecurity perspective, we would’ve thought that would’ve been business ending years ago, and it just seems like we just keep moving and waiting for the next breach.

[00:17:29] Accreditation and Data Security

Drumm McNaughton: And when I think about accreditation for institutions, I can’t think of a single accreditor who talks about data security. And to me that’s a pretty big gap.

Brian Kelly: Right. And I think until that shift happens, and it’s talked about in those contexts, it probably won’t bubble up to the level it needs to be from an accreditation perspective. That’d be an interesting way to approach it. Right? yes.

And I think maybe on the research side of our institutions there’s certainly more sensitivity to understanding that if you don’t protect that research data, someone from an intellectual property perspective or ability to publish ahead of you, there’s much more easily understandable impact on that side of the house.

yes.

[00:18:15] Intellectual Property and Cybersecurity

Drumm McNaughton: Well, when I take a look at, and military background comes out and listeners know I used to fly airplanes and spy on people for a living. So when I see the F 35, which is our latest fighter jet, et cetera, and then I take a look. And four years later, the Chinese come out with one of their jets.

Oh my gosh. Did they borrow the plans? No, they stole them.

Brian Kelly: Yes, I agree. It’s a, they built a copy, they followed the plans, and I think that’s an important, our institutions, our colleges and universities have a wealth of information, whether it’s in research or just in general academic construct, that is a valuable asset from an intellectual property. We just talked about federal student aid and financial aid and student data and our, employees and our professors and our, that data. But the intellectual property that we’re, the theft that we’re seeing, not only the F 35, but in, in everything. How that’s being used, stolen and taken is a really important part of what we do from a cybersecurity perspective and trying to understand who’s connecting to our networks, what data is moving in and out of those networks, who’s on our networks?

[00:19:29] Insider Threats and Network Security

Brian Kelly: You talked about making an errant click and then giving an adversary or someone access to the network. You’re also seeing individuals that are applying, some of these or creating personas you, whether it’s a fake LinkedIn persona, but also somebody applying to our institution so they can get credentialed in that institution, whether that’s North Korea or other nation states that are creating these personas. They’re applying under false pretenses and now they’re an insider threat, so to speak, they’re in our networks.

Drumm McNaughton: Brian, you bring up some really interesting points, but there’s also, in looking at this, it’s not only nation actors, there’s individual groups who are doing ransomware for money, but you’ve also got corporate espionage going on, and this comes back to that research data that many institutions have. You know that research data can be very valuable to another corporation, to a nation state.

Brian Kelly: It is. And I do think the larger research institutions have a good handle on this. I think it’s how we as a community spread that knowledge around to some of the lesser resourced, or lesser mature institutions, and learn from each other about best practices and sharing of information and access controls and things that, we maybe know of from a cybersecurity perspective, but haven’t always made it into the researchers top of mind. One of the things that comes to mind is, password managers, we’ve talked about those before, and things along those lines that can help protect that research data, protect that individual’s work and also assure our institutions that, from an identity and access management perspective, that the right people are accessing the right information at the right time.

Drumm McNaughton: Agreed. I’ve been using a password manager now for about five years and it gives they look unbreakable to me. I’m sure if somebody had, 15 CRAYs in parallel, they could probably do it. I don’t even know if CRAY computer’s still around, but that’s, that used to be the gold standard when I was.

Brian Kelly: Right, yes.

Drumm McNaughton: But, the password manager, you can have them for the enterprise. You can have them for the individuals in the enterprise. You can have them personal and it creates a, you can do up to a 26 character password that’s virtually unbreakable.

Brian Kelly: They are, and the nice thing about standards, there’s so many to choose from. You have Dashlane, you have one password, LastPass, you also Apple, Google and Microsoft all have that feature baked in. And here we are in late 2025 and passwords are still, the predominant way that we access and secure our information.

We’re starting to see the password managers are really good utility in that we as humans don’t have to remember those passwords, the managers could do that for us. So one of the risks is password reuse. Humans like to use the same password in multiple places, which makes it easier if an adversary gets that password for one thing.

You mentioned that it gives more complexity. Right? No way you and I are remembering a 26 character password, but now we can have that added strength in those tools. We’re seeing a lot of improvements in biometrics, both with Microsoft and Apple on their mobile devices. And Windows has a Windows “Hello” feature, which is based on your facial recognition. Right?

So those are all really, really important improvements. Again, asking listeners to go back in their own institutions and ask, “Hey, where are we with password managers? Where are we with implementing biometric logging controls? Like face passwords and those things. I think those are really important ways that ultimately make the user experience easier. So you had said, “Hey, it’s really helped me out over a few years, life changing”. I feel like password managers, you hate to say that they’re, they’ve made our, your life, my life easier. Imagine if we can do that for all the users in our environment and they come back and say, “wow, security’s really made my life better. They’re not the annoying messages anymore. They’re really giving us things that are important, but also make our days easier”. That wins the hearts and minds, so to speak. Right?

Drumm McNaughton: And there’s still people out there who use 1, 2, 3, 4 as their main password.

Brian Kelly: I believe you’re probably right.

Drumm McNaughton: I know for me to get onto my computer, I use a pass phrase and it’s got spaces in there too.

Brian Kelly: Absolutely. ’cause a sentence that past phrase, a saying, a poem, something that is a combination of a lot of our favorite things. It’s easier for our human brains to remember and it’s harder for those CRAY computers to guess or predict or crack. That’s a really good strategy as well.

Drumm McNaughton: yes.

[00:24:09] Leadership and Succession in Cybersecurity

Drumm McNaughton: Swapping over to the leadership aspect of cyber. When we spoke the other day, you mentioned something to me that was very concerning. You got a lot of senior leadership in cyber. They’re retiring, they’re moving on. What are we doing to fill that void that’s being created?

Brian Kelly: I don’t know what the answer is. I think we’re certainly seeing more cybersecurity curriculum in our higher ed. In our pipelines we’ve got master’s degree programs. So if you think of how I came up, it was through the military and some military training, and then I had a degree in communications and there wasn’t a developed career path. And listeners can’t see how old I am as they’re listening, but you were in some sort of computer science or communications curriculum, and we’re starting really to see high quality programs that are developing that next generation of cybersecurity leaders that are program specific, master’s degrees in cybersecurity.

But we’re gonna have that skills gap where generationally, you know, we talked to Cathy Hubbs at American Universitie’s retiring. Great person, great leader, great mentor in our community. She’s leaving the community. Harry Hoffman, who is replacing her, he’s coming from Northeastern. So you have this everybody’s moving around and how are we looking to elevate the next generation. There’s sites that are out there that help folks find their next job. There’s a lot of really high quality mentoring that’s both in LinkedIn and other channels that help build that community. I think looking inwardly at our own information security or cybersecurity leadership across our campuses, most institutions will have a CISO at this point in 2025. What we’re not a hundred percent sure, do they have a deputy CISO, do they have a director of information security? What does that look like and how are we as a community trying to encourage the succession planning and building out of the next generation. I think the pipeline is strong, but those are early career professionals. We need to make sure we’re identifying those mid-career professionals and giving them opportunities to step into those larger roles.

Drumm McNaughton: And that’s very critical. In business the same thing, curriculums are being developed more and more so there’s intern and externship opportunities. The same thing is really important for cyber.

Brian Kelly: Absolutely. Absolutely.

[00:26:35] Cybersecurity Awareness Month

Drumm McNaughton: So it’s interesting we bring this up because this is cyber awareness Month.

Brian Kelly: It is National Cybersecurity Awareness Month. This is where we as CISOs, we look forward all year long to October so we can send all those a aforementioned annoying messages, but to do campaigns and to really raise awareness on our campuses, and it’s a national initiative that has been going on for more than a decade now.

And I think from a perspective of how we’re engaging with our communities, you wanna have a way to bridge, as we talked about a little bit earlier, security best practices in our institutions and security best practices as an individual. So the initiative around the cybersecurity awareness month is really just that to help us message. There’s a tremendous amount of collateral and message templates and things that you can use on your campuses, at your organizations to help drive the conversation during the month of October. So as many of the things they say as you call off of this podcast, the takeaway is to go back and hopefully you can look around your institution and say, here’s the things I see that we’re doing in October. And if you don’t see those things go out and ask your IT leadership or your information security leadership around that. I think the published Core four that, they’ve put out for this year. We talked about most of them, strong passwords, password managers, multi-factor authentication is still a big push for National Cybersecurity Awareness Month. We want you to use multifactor not only for your institutional work, but for your personal, for your banking, for your email. The other two are recognizing and reporting scams. Right? So you had mentioned, “Hey, I see these LinkedIn requests”. You recognize that as a scam. Do you report it to LinkedIn? If it’s a scam at your institution, do you know who to report it to? And then the always the perennial favorite is the update your software. Right? Make sure you’re patching, make sure you’re using current versions. Those are really the core four that, that we’re advocating for in October during Cybersecurity Awareness Month.

As much as things change, they stay the same. Those are some really table stakes in our world of things that you can do, both at home, personally and within your institutions.

[00:28:51] Core Four Cybersecurity Practices

Drumm McNaughton: Review those four Core four again please.

Brian Kelly: Use strong passwords and or a password manager. Make sure that you’ve enabled multifactor authentication.

Be able to recognize and report scams.

And then update your software, which is really the make sure you’re patched or using current versions of software.

[00:29:10] The Importance of Timely Updates

Drumm McNaughton: yes, and the patching, when you told me that the Department hasn’t updated their software, things like that, for 10 months or since 2024. That’s scary when you think about it from a personal perspective. Microsoft comes out with a patch every month for their software.

Brian Kelly: yes, and Apple as well. I think that comment was more of, I couldn’t find guidance that they’ve provided to the community. Right? And again the currency of that guidance is really important because as you said the environment is changing, whether it’s our software and our updates, but also the threat actors. Currency in, I have an analogy of we look at our weather forecast to see the weather that’s coming in the future, or what weather is happening today. We don’t go back and look at weather forecast from 10 months ago to decide whether we’re gonna wear a rain jacket. The intelligence has to be timely, and I think that’s an important call out with the information we are maybe not getting from the government.

Drumm McNaughton: yes, I think that’s a real fair statement. Well, this has been fabulous, Brian. I really appreciate, you’re coming back on the show to talk about these things. It’s taken a very different direction than most of the podcasts because we’ve really touched on how the individual affects the institution and what’s going on in the greater. So thank you for doing that. I appreciate it.

Brian Kelly: You’re very welcome. Information security is everyone’s responsibility, or cybersecurity is everyone’s responsibility.

[00:30:38] Three Takeaways for Higher Ed Presidents and Boards

Drumm McNaughton: Absolutely. Three takeaways for higher ed presidents and boards. What do they need to be thinking about now and in the future when it comes to cyber?

Brian Kelly: yes, I think, first off is that resiliency, that sort of planning for “the attack is gonna happen”, and how are you going to continue to operate in that? I think you touched on the second one, that it’s personal, that it’s individual, information security it’s something that’s handled by a group on campus or our institution, somebody, everyone has a responsibility in it.

And then, lastly is having those conversations around what are we doing as an organization. Campus leadership, it’s important for them to engage with cybersecurity professionals and make sure we’re all talking to one another. Communications.

[00:31:19] Bonus Takeaway

Drumm McNaughton: Thank you. I would piggyback on that last one is, boards need to be having frank discussions around enterprise risk management, ERM, and how cyber fits into the ERM picture.

Brian Kelly: Right, and I think that, that those board conversations that they may be having about, again, folding back in enterprise risk, the board conversations about risk should include conversations about cyber risk.

Drumm McNaughton: Absolutely. What’s next for you?

Brian Kelly: I don’t know. I’m working on so many projects.

[00:31:52] The Cyber Canon Project

Brian Kelly: The one thing we hadn’t talked about, I wanna just take a moment to talk a little bit about the “cyber canon” and the cyber canon is this great collection of books that are cybersecurity focused, that was initially developed by my friend Rick Howard. He’s a former Army, cyber warrior, and he worked for Palo Alto Networks for a number of years, and now he’s created the cybercanon.org. And it’s like the Rock and Roll Hall of Fame for books we have. Books that every professional in our field should be reading, whether they’re just starting out or they’ve been in this career field for 35 years.

It has a tie to higher ed because Ohio State hosted the cyber canon, our friend Helen Patton, who was the CISO at Ohio State for a very long time, she brought the canon sort of home to live at Ohio State for a number of years and what’s next for me is really working with Rick and Helen and the cyber canon to try to bring that body of knowledge, that body of work, to curriculum in higher ed programs and getting our faculty and our students to read that, read those books, to comment, to go in.

I’ll make sure you have the link, and you can share with your listeners. It’s a great resource. It’s a really, really fun project to be part of, and of course I feel like a double geek when I go. I’m in cybersecurity and I love to read, but there’s such good work there and it’s really, really, it’s fun to be part of.

Drumm McNaughton: Very good. Thanks for that introduction to cyber canon. For the cyber folks out there and even for higher ed leadership, they at least need to have a good baseline of what’s going on in cyber.

Brian Kelly: Absolutely. And you’ll, if you remember back to your military days, in the Air Force we had the chief of staff’s reading list and there was always books that were in leadership or in tactics, but also general spectrum that you would need to know about your adversaries. And I think there’s really some good, and maybe that’s a takeaway for me, is to send you some of the books that campus leadership should be reading out of the canon.

Drumm McNaughton: It sounds like a plan. Brian, thanks again for being on the show. Great to catch up with you and take care my friend.

Brian Kelly: Likewise. Thanks so much.

[00:34:02] Conclusion and Final Thoughts

Drumm McNaughton: Thanks for listening today and a special thank you to my guest, Brian Kelly, and for his insights on what higher ed institutions can be doing to deal with the mounting cyber risk confronting them. Brian, always a pleasure having you on a show. I look forward to the next time our paths cross.

To my listeners, thanks again for listening. See you next week.