Cybersecurity Risk Management in Higher Education—It's Not Just an IT Problem

Higher education institutions are increasingly at risk from cyberattacks that threaten enrollment, accreditation, financial aid compliance, and reputation. In this episode of the Changing Higher Ed® podcast, Dr. Drumm McNaughton speaks with Brian Kelly, Chief Information Security Officer at Community Health Networks of Connecticut and former higher education CISO, about why cybersecurity must be treated as an enterprise risk—not just an IT issue.

This conversation is especially relevant for presidents, trustees, and senior leaders who need to understand how cyber risk intersects with governance, strategic planning, crisis management, and accreditation readiness.

Topics Covered:

• Why higher education is a prime target for cyberattacks

• How ransomware and data breaches disrupt core institutional functions

• The governance responsibilities of boards in overseeing cybersecurity

• Cyber implications for strategic planning and reputation management

• Why accreditation and compliance can be undermined by cyber breaches

• Protecting research and intellectual property from cyber threats

• Building a campus culture of shared cybersecurity responsibility

• The leadership succession gap in higher ed cybersecurity

• Core practices every institution should adopt during Cybersecurity Awareness Month

Real-World Examples Discussed:

• United Healthcare and Social Security data compromises

• PowerSchool breach exposing minors to identity theft

• Target and Home Depot breaches as case studies in reputational damage

• F-35 design theft highlighting the value of intellectual property

• Scam examples including PayPal fraud, fake purchase confirmations, and LinkedIn phishing

• Leadership succession in action: Cathy Hubbs' retirement and Harry Hoffman's appointment

Three Key Takeaways for Higher Ed Leadership:

1. Plan for resilience, not just prevention—institutions must continue to operate during and after cyber incidents.

2. Make cybersecurity a shared responsibility—leaders must ensure accountability across the campus community.

3. Include cyber in board oversight—cyber risk is part of governance, enterprise risk management, and accreditation readiness.

Read the transcript or extended show summary: https://changinghighered.com/cybersecurity-risk-management-in-higher-education/

#HigherEdCybersecurity #BoardGovernance #HigherEducationPodcast