The Impact of Information Security in Academic Institutions on Safety and Security: Assessing the issues and developing solutions for policy and practice

Although academic institutions face unique information security (IS) threats and increasingly frequent and severe incidents, little research has been conducted at the policy, practice or theoretical levels to address these issues. Incidents such as information theft, data tampering, viruses, worms, and terrorist activity constitute significant threats to safety and security. The purpose of the project is to address this need for objective data and develop a practical roadmap for policy and practice. This study will assess the link between information security incidents, approaches, policy, and practice in academic institutions and will provide law enforcement and government with an objective profile of issues and methods to address them.
Specific goals of this project are: 1) create an empirically-based profile of the IS issues and approaches of academic institutions; 2) develop a roadmap to address these issues; 3) advance the knowledge, policy and practice of academic institutions, law enforcement, government, and researchers. Project design incorporates field survey, one-on-one interview, and forensic analysis research methods. Subjects are information technology (IT) directors of academic institutions; criteria for inclusion include the individual's role and institutional characteristics (e.g., geography, program, research). Instrumentation includes the Academic Institution Information Security (AIIS) survey (Burd & Cherkin, 2004), AIIS interview protocol, and LogLogic LogAppliance for firewall log file data. Data collection involves: inviting IT directors to participate; distributing surveys via Zoomerang, scheduling interviews, installing LogLogic; and sending two follow-ups at three-week intervals.
One hundred (100) IT directors will complete the survey, fifteen (15) additional directors will participate in one-on-one semi-structured interviews, and two (2) universities' networks will be monitored for forensic analysis. The survey, interview and forensic data will be integrated using the Research Methodology Process and analyzed using univariate, multivariate and content analysis. Firewall data will be analyzed using regular expressions.