Effective Practices and Lessons Learned

Chapters 4 through 7 described the current state of information technology (IT) security at 435 higher education institutions. In Chapter 8, we analyzed both quantitative and qualitative data to identify factors that appear to affect institutions’ security outcomes. In this chapter, we synthesize what lessons we have learned about the practice of IT security in higher education. A key advantage to surveying hundreds of institutions on IT security is the opportunity to assess what went well and what could have been done better, thereby enabling us to provide valuable insights for the rest of the higher education community. To quote Oscar Wilde, “The only thing to do with good advice is pass it on. It is never of any use to oneself.” Several common themes emerged from our survey data and in-person interviews concerning effective ways to improve institutional IT security. While many of these insights might sound familiar, their recurrence underscores the importance of incorporating them into our collective thinking about how best to structure and execute IT security activities on our campuses. We recognize that cultures, resources, and technical environments vary significantly across the institutions surveyed in this study and that no single practice described here will necessarily work everywhere. Our data underscore the diversity of our campuses.