Hello, everyone.

Have you ever received suspicious emails or other forms of unfamiliar correspondence?

These are common occurrences in our tech savvy world, and the decisions we make during these times can mean all the difference.

In Pensacola State College, we're tackling these issues with vigor.

Steve Whiting is executive director of technology operations at the college.

He's joining me now to discuss various facets of information security that can benefit everyone.

Welcome.

Thank you for the invite, Doctor Larry.

All right, so the million dollar question, what is information security and why is it such a big deal at Pensacola State College?

Information security is protecting confidential and sensitive information from unauthorized access, misuse, or damage.

The college receives a vast amount of sensitive and confidential data every day.

Virtually every department uses it.

Many departments gather it, and a lot of departments then maintain it.

Our information security program is built upon three pillars confidentiality, integrity and accessibility.

So confidentiality means that those with access as can only access the data that they need to perform the job.

Integrity means the data is trustworthy.

And then accessibility are those users are able to access the data whenever they need it, wherever they need it.

If any one of those three elements are compromised, then it keeps the college from performing our mission.

Understood.

And I know as employees here at Pensacola State College, we receive no before security tips via email.

They discuss various scams per se, and I'm really appreciative of that, Steve, because it really keeps us on guard in a good way.

It does.

So the college is a prime target.

All colleges are prime targets.

Basically, for the nature of who we are.

We have open access and we have a collaborative environment.

So those notices that we get from our part they inform us of the threats that come.

They include phishing, right.

Mainly from those emails.

And, bad actors are, trying to entice us to give our credentials away.

It can come with social engineering, where they actually call us or text us, trying to get us to do the same.

Some threats can be internal.

They can just be mistakes.

We send the email to the wrong person.

That can happen.

It can.

And so sensitive information rarely, but unfortunately it can be malicious.

And so we have to be cognizant of that as well.

And then the one that gets all the headlines is ransomware.

And so that is when a bad actor gets access internally and then blocks us from accessing our own systems.

So these threats are constantly evolving and we have to be diligent.

A great example via email that we receive was a scam regarding multi-factor authentication.

That's just one example, but can you provide us with another a scenario per se where they will send you a link?

And you go to a form thinking that either, your access is going to be cut off or you need to update your banking information and so on that form.

You're providing your credentials, thinking that you're using a college resource and you're not.

We're ahead of the curve in Pensacola State College.

But I'm curious.

What steps has a college taken to protect students and employees?

So we have a multi, layered or a tiered approach to information security.

I'll kind of start internal and work external.

So internally we try to keep the bad actors out.

So we have a very robust firewall in the threat protection system there.

Our users are required to multi-factor authenticate, to a right decision, to their username and password.

Should a bad actor get in?

We have detection on our endpoints.

We have automation and response.

Related to that.

Regular security awareness training, as you mentioned before.

And I love it.

It's a primary tool that we have of informing our users of what to look out for.

And so we do that for our faculty and staff.

Our students get periodic information on that as well.

We have data encryption.

Should a device get lost or stolen?

It's encrypted in transit and at rest.

And then we have data loss protection tools for those accidental transmissions or even those that are malicious to help us alert on that.

All right.

Some might say information security is a two way street.

Let me paint a scenario for you under shared responsibility.

Let's say someone sets their password at password.

So passwords.

Strength.

How important is that?

Well, we do have some tools to prevent our users from doing that.

But everyone has a role on our information security team.

So I'll give you a a few key things individuals can do, to help us.

And one is strong password security.

We all have a tendency to use our favorite password and reuse it.

And my request at our training meetings is, please don't do that with your Pensacola State, credentials.

Be very cautious of emails, links in them and attachments and only click the link or download the attachment if you're sure that it is something intended for you and it's a valid sender.

I mentioned our MFA.

Yeah.

You need to familiarize yourself.

If you change your device of how you change or migrate your multi-factor credentials, it's just like getting a new key for your home or your car.

Your multi-factor device is your key to access to our system.

And then know how to contact us if you're ever in doubt.

Reach out to our information security, our technology support staff, and they will advise you on the legitimacy of that love.

So we must be legally compliant as a college.

Are there any specific requirements that fall underneath that umbrella?

There are this, multitudes of legislation, and federal, federal and state.

So I'll highlight just a few of those.

The Family Educational Rights and Privacy Act for APA.

Yes.

That protects our student education records.

The Health Insurance Portability and Accountability Act.

So HIPAA, that would be health records.

And we receive those, from the public at our health sciences.

And some of our services that are provided as well.

And so from the public and our employees, health records are governed by that.

And then the Gramm Leach Bliley act is a financial act, and it governs our financial aid and student financial services.

But in addition to these, we undergo regular, audits.

We maintain incident response plans, and we're prepared for those for any potential breaches.

Compliance isn't just about avoiding penalties, though.

Absolutely.

It's about building trust with our students, our faculty or staff and our community partners.

What are some important takeaways about information security?

Of course, we know not only for our employees here at Pensacola State College, but for anyone watching.

Well, information security is a shared responsibility.

All of us are members of our information security team.

We have great tools at the college.

Our administration has equipped us with that.

But technology and automations can only go so far.

They're only as good as our employees are.

I have some great staff that works for me.

They are, capable, competent, committed to protecting the information here at Pensacola State College.

Our people, our end users, are our first and our best, tool, protecting our information.

And so together, we can create a safe and secure learning environment at Pensacola State.

And I tell you what, Steve, I have learned a lot.

And I know our viewing audience has as well.

Such a pleasure to have you on Pensacola State today.

Thank you so much.

Thank you.