Implementing Controls for Institutional Assets

1. What cybersecurity controls should be implemented to protect the university’s knowledge assets?

YuSiP University should treat its knowledge assets as a complete information environment rather than as isolated files on departmental computers. The required controls should protect confidentiality, integrity, and availability while also ensuring that authorized people can locate accurate institutional knowledge when they need it. The NIST Cybersecurity Framework 2.0 (2024) emphasizes identity and access management, device protection, data protection, backups, monitoring, and incident response as connected parts of an effective cybersecurity program. In this case, the university should combine governance controls, technical safeguards, administrative procedures, and user awareness measures. No single tool will solve the problem because the phishing incident was enabled by weaknesses in authentication, information organization, access management, monitoring, backup practices, and employee behavior.

The first control should be the creation of a university-wide information-security and knowledge-management governance program. Senior management should formally assign responsibility for institutional knowledge to an information governance committee composed of representatives from information technology, records management, academic departments, human resources, research administration, legal or compliance offices, and university leadership. This committee should establish policies for where official documents may be stored, who owns each category of information, how documents are classified, how long records are retained, and how they are securely destroyed. The policy should clearly state that official university records may not be maintained only in personal email accounts, personal cloud storage, USB devices, or unmanaged computers. Personal tools may sometimes be used temporarily, but information must be transferred promptly to an approved university repository.

The university should establish a central knowledge-management and document-management platform. This platform should provide controlled repositories for personnel records, student records, policies, curricula, accreditation evidence, research and extension data, partner information, and learning materials. Centralization does not mean that every user should see every document. Instead, it creates a controlled source of truth in which documents have identifiable owners, approved versions, access rules, retention periods, and audit histories. The system should support version control, check-in and check-out or equivalent editing controls, document approval workflows, metadata, full-text search, automatic version history, restoration of deleted files, and records-export capabilities. The university should also maintain a documented inventory of important knowledge assets and identify the systems in which they are stored.

Table 1. Data Classification & Handling Matrix

Data classification is essential. YuSiP should adopt a simple scheme (e.g., public, internal, confidential, and restricted) to distinguish risk levels. Public data includes brochures, internal covers administrative procedures, confidential includes nonpublic research, and restricted covers student, personnel, and financial records. Labels must be applied to metadata and document headers or footers.

Classification mandates specific handling requirements. Restricted data requires encryption, strict role-based access, and continuous monitoring. Confidential information must be limited to approved internal groups and partners, while internal data requires basic authentication. Public data may be shared externally following approval. Clear rules should also govern transmission, sharing, printing, storage, and secure disposal, ensuring labels directly drive access controls.

Identity and access management should enforce least privilege and role-based access control. The compromised account had unnecessarily broad access to sensitive university records, suggesting permissions were assigned for convenience. YuSiP should define specific roles and grant each only the permissions required for its duties.

Access should be granted to groups rather than manually to individual files whenever possible. Departmental shared drives should be reviewed, and inherited permissions, anonymous links, former-employee accounts, dormant accounts, and excessive group memberships should be removed. Access to restricted materials should require explicit approval from the information owner. Privileged access should be separate from ordinary user accounts, and administrators should not use powerful accounts for routine email or web browsing. Temporary elevated access should expire automatically after a defined period. The university should conduct access reviews at least quarterly for sensitive repositories and whenever an employee changes position, transfers departments, takes extended leave, or leaves the institution.

Strong authentication is especially important because the incident began with credential theft. The university should require multifactor authentication for email, cloud storage, VPN, student-information systems, human-resources systems, research systems, document repositories, and administrative interfaces. CISA (2023) specifically recommends phishing-resistant MFA as part of a Zero Trust approach. The preferred methods should be passkeys or FIDO2/WebAuthn security keys, particularly for administrators and users who access restricted information. Authenticator applications with number matching may be used where phishing-resistant methods are not yet practical, but SMS should not be the primary method for high-risk accounts.

The university should implement single sign-on through a centrally managed identity provider, combined with automated account lifecycle management. When a user is hired, transferred, or separated, access should be provisioned or removed through a defined workflow. Terminated accounts should be disabled immediately, active sessions should be revoked, and tokens or API keys should be invalidated. Shared accounts should be eliminated except where technically unavoidable and formally approved. The identity provider should record successful and failed login attempts, unusual locations, impossible travel, unfamiliar devices, repeated MFA failures, and changes to authentication settings. Risk-based authentication can require additional verification when a user signs in from an unfamiliar location or attempts to access unusually sensitive information.

Zero Trust architecture should govern system access, evaluating every request based on identity, device health, location, and resource sensitivity rather than network location. Access from unmanaged personal devices must be restricted or blocked for restricted data, using compliance checks to enforce security patches, encryption, and endpoint protection.

Email security must include secure gateways to scan attachments/links, block malicious domains, and enforce SPF, DKIM, and DMARC. External-message banners, link-rewriting controls, and strict identity provider policies should prevent unauthorized MFA registrations and forwarding rules.

Continuous awareness training should educate staff on identifying phishing, classifying data, and reporting threats via simple tools like a “Report Phishing” button. Onboarding and periodic simulations help measure and improve user behavior without punitive measures.

University-managed endpoints require automated patching, full-disk encryption, host firewalls, and Endpoint Detection and Response (EDR) to block credential theft and unauthorized software. Local admin rights must be removed, and USB storage strictly controlled or encrypted.

The university should segment its network and repositories so that compromise of one account or computer does not provide broad access. Student systems, human-resources systems, research environments, administrative file stores, backup infrastructure, and guest networks should be separated according to risk. Sensitive research or regulated data may require additional network controls, including restricted subnets and controlled jump hosts. Internal firewalls should limit unnecessary communication between segments. Administrative interfaces should not be exposed directly to the public internet. Remote access should use approved VPN or secure application gateways with MFA, logging, and device checks.

Encryption should protect information at rest and in transit. Restricted files stored in document repositories, databases, laptops, and backup systems should use strong encryption with carefully managed keys. Transmission between users, applications, cloud services, and external partners should use secure protocols such as TLS or an approved secure file-transfer method. Encryption keys should be separated from the data they protect, rotated according to risk, and accessible only to authorized administrators. The university should avoid sending student records, personnel files, or sensitive research as ordinary email attachments. Where external sharing is necessary, it should use time-limited links, recipient verification, download restrictions, and access logging.

Data-loss-prevention controls can reduce accidental or malicious disclosure. A DLP system can identify patterns associated with student identifiers, personnel information, financial data, or research secrets and alert or block attempts to upload them to personal cloud services, send them to unauthorized recipients, copy them to USB devices, or paste them into unapproved applications. DLP should be implemented carefully so that it does not disrupt legitimate academic work. The university should define exception procedures, document business justifications, and review alerts for both false positives and emerging threats.

Backup and recovery controls must be expanded beyond the current approach. The university should identify critical knowledge assets and define recovery-point and recovery-time objectives for each category. Official repositories should be backed up automatically according to the importance of the data. Backups should include document versions, metadata, permissions, audit logs, and configuration information, not merely the latest file contents. At least one backup copy should be offline, encrypted, access-controlled, and isolated from ordinary administrative accounts. CISA (2023) recommends maintaining offline, encrypted backups and regularly testing their availability and integrity. The university should also consider immutable backups that cannot be altered or deleted during a defined retention period.

Restoration tests should occur regularly and should involve actual departments, not only IT staff. A backup is not proven by the fact that a job completed successfully; it is proven when the university can restore a usable document, preserve its permissions and history, and resume operations within the required time. The university should conduct tabletop exercises and technical recovery exercises for phishing-led account compromise, ransomware, accidental deletion, cloud-service outage, and loss of a departmental computer. Recovery plans should identify decision-makers, communication channels, alternate work locations, system dependencies, and procedures for validating that restored files have not been tampered with.

Continuous monitoring and audit logging should detect misuse of knowledge assets. The central repository, identity provider, email system, endpoint tools, network devices, and cloud services should send relevant logs to a security information and event management platform or equivalent monitoring service. Alerts should be generated for large downloads, unusual access times, access from unfamiliar countries, mass deletion or renaming of files, creation of public links, changes to permissions, disabling of security controls, and repeated access to records outside a person’s normal role. The incident in the case could have been reduced if the university had rapidly detected anomalous downloads and access to unrelated information categories.

Logs should be protected from unauthorized modification and retained long enough to support investigation. Monitoring must be balanced with privacy and academic freedom. The university should publish appropriate notices, restrict log access to authorized personnel, define retention periods, and use monitoring for security and compliance rather than unrestricted employee surveillance. Sensitive investigations should follow documented procedures and preserve evidence. Time synchronization across systems is important because investigators need to reconstruct the order of phishing, login, file access, downloads, and deletion events.

The university also needs a formal incident-response capability. It should maintain a written plan based on preparation, detection and analysis, containment, eradication, recovery, and lessons learned. NIST’s current incident-response guidance connects incident response with broader cybersecurity risk management and the 2024 NIST Cybersecurity Framework 2.0. The plan should identify the incident-response team, IT administrators, legal and privacy officers, communications staff, senior leadership, human resources, affected departments, and external contacts. It should define who can disable accounts, isolate devices, preserve evidence, notify affected individuals, contact law enforcement, and communicate with external partners.

For a similar phishing incident, the response should immediately disable or restrict the compromised account, revoke sessions and tokens, reset credentials, remove unauthorized MFA devices, examine mailbox forwarding rules, isolate affected endpoints, preserve logs, identify accessed and downloaded data, and search for persistence mechanisms. The university should determine whether the attacker changed permissions, created new accounts, deleted files, or moved laterally into other systems. It should notify information owners and privacy officials according to established procedures. After containment, the university should remove malicious artifacts, patch exploited systems, restore verified data, monitor the account and affected systems, and conduct a post-incident review.

Third-party and external-partner relationships require their own controls. The university should assess the security of cloud providers, learning platforms, research collaborators, document-management vendors, and partner organizations before granting access. Contracts should require appropriate authentication, encryption, breach notification, logging, data-return or deletion procedures, and restrictions on subcontracting. External users should receive accounts with limited, time-bound permissions rather than broad access to departmental folders. Partner access should be reviewed regularly and automatically disabled when the project or agreement ends.

Finally, cybersecurity controls must be integrated with knowledge-management practices to protect institutional memory. Every critical document needs an accountable owner, review date, retention policy, and secure backup. Departing employees should undergo a formal offboarding process to transfer file ownership and verify that official records are moved from personal storage to university repositories. Ultimately, YuSiP should prioritize foundational controls — phishing-resistant MFA, least-privilege access, centralized repositories, data classification, encryption, endpoint security, monitoring, and tested offline backups — backed by strong governance and regular audits. Connecting cybersecurity with knowledge management ensures that a single compromised account cannot expose unrelated institutional assets or permanently disrupt operations.

2. Who should be responsible for managing and protecting institutional knowledge, the IT Department, faculty, administrators, or everyone? Explain your answer.

Everyone should be responsible for managing and protecting YuSiP University’s institutional knowledge, but responsibility should not mean that everyone has identical duties. The university should adopt a shared-responsibility model in which senior leadership provides governance and resources, the IT Department provides the secure technical environment, departments and designated information owners manage the content, and every faculty member, administrator, and staff member follows approved procedures. This approach is stronger than assigning the entire burden to IT because institutional knowledge is created, interpreted, updated, and used by the academic and administrative communities. At the same time, “everyone is responsible” must not become an excuse for unclear accountability. Each important information asset should have a named owner who is answerable for its accuracy, classification, access requirements, retention, and protection.

The incident demonstrates why IT alone cannot manage institutional knowledge effectively. The IT Department can configure authentication, backups, access controls, monitoring systems, antivirus tools, and secure repositories. It can detect suspicious activity, disable compromised accounts, restore deleted files, and investigate breaches. However, IT personnel usually cannot determine whether a particular curriculum document is current, whether a research dataset contains confidential information, whether a personnel profile document should be accessible to a department chair, or whether an accreditation report has legal or institutional importance. Those decisions require knowledge of the university’s academic, administrative, legal, and operational processes. If IT is expected to decide all of these matters, it may either give too much access to users or restrict access so severely that legitimate university work becomes difficult.

The phishing incident also reveals that cybersecurity and knowledge management are connected but not identical. IT can establish multifactor authentication, email filtering, phishing detection, logging, and least-privilege permissions. These safeguards could have reduced the attacker’s ability to use the employee’s stolen password. Nevertheless, technical controls cannot solve the deeper problem that sensitive information was stored in personal cloud accounts, individual computers, USB devices, email accounts, and departmental folders with outdated permissions. The university must decide where official institutional knowledge belongs, who owns it, how it is classified, how long it should be retained, and how it should be transferred when employees leave. Those are governance and management questions as much as they are technical questions.

University leadership therefore has the highest-level responsibility. The president, governing board, or senior management should establish institutional expectations that knowledge is a university asset rather than an employee’s private possession. Leadership must approve policies, assign authority, provide funding, and require compliance across colleges and offices. Without executive support, departments may continue using convenient but unsafe practices, especially when a centralized system appears slower than personal drives or email attachments. Leadership should also establish an information governance committee or similar body representing IT, academic affairs, records management, human resources, research, legal or privacy functions, libraries, quality assurance, and major administrative units. This body can set university-wide standards and resolve conflicts between accessibility, academic freedom, privacy, security, and operational efficiency.

Leadership must also assign formal ownership of information categories. For example, Human Resources or an authorized administrative executive could own personnel information. The registrar or student-affairs leadership could own student records. The research office could oversee research and extension information, while academic affairs could own curriculum and instruction records. The quality assurance office could own accreditation documentation, and the procurement or external-relations office could manage partner profiles. Ownership in this context, as mainly defined by Coles-Kemp & Overill (2006), does not mean personal property rights. It means having approved management responsibility for deciding how the information is created, maintained, used, protected, and eventually archived or destroyed. Information-security guidance commonly distinguishes asset owners, who determine business and security requirements, from system owners, who operate the systems that store or process the assets.

The IT Department should remain responsible for the university’s technical security architecture and for operating the approved knowledge-management environment. It should lead the implementation of a centralized document and records-management platform with role-based access, multifactor authentication, version history, audit logs, encryption, retention controls, secure sharing, automated backups, and recovery testing. IT should also maintain identity and access management, including joiner, mover, and leaver processes. When an employee changes position, access should be reviewed and adjusted. When an employee leaves, access to university systems should be promptly revoked while institutional files remain available to the appropriate department. Access-rights guidance emphasizes that permissions should be assigned, modified, and revoked according to business requirements, with information owners authorizing access and security personnel implementing the controls.

IT should also provide security monitoring and incident response. In the case study, the unusual activity from the compromised account should lead to rapid containment, such as disabling active sessions, resetting credentials, invalidating tokens, reviewing downloads, and checking whether persistence mechanisms were created. IT should preserve logs and coordinate with relevant offices to determine which records were accessed or exfiltrated. It should test backups regularly rather than assuming that a backup exists simply because a system reports successful completion. The university’s failure to recover files stored on personal computers and personal cloud accounts shows that backups are meaningful only when important information is stored in locations under institutional control.

Faculty members have an important responsibility because they create and use a large portion of the university’s knowledge. Faculty develop syllabi, course materials, research findings, community-extension records, assessment evidence, and academic policies. They should save official versions in approved institutional repositories instead of treating personal laptops, USB drives, or private cloud accounts as the authoritative source. They should identify sensitive data in research projects, follow approved data-management plans, avoid placing confidential student or participant information in ordinary shared folders, and report suspected phishing or unauthorized access immediately. Faculty should also review their documents for accuracy and currency. A technically secure repository containing outdated course policies is still a knowledge-management failure because users may rely on incorrect information.

Faculty responsibility should not be interpreted as requiring every professor to become a cybersecurity expert or records-management specialist. The university should provide simple procedures, training, templates, and support. For example, the system could clearly label official repositories, provide standard folder structures, automatically record document versions, and warn users when they attempt to share sensitive information externally. Faculty should have a practical method for designating a document as current, superseded, draft, restricted, or archived. If the approved process is confusing or burdensome, users will continue to bypass it. Good governance therefore combines accountability with usable systems.

Administrators and department heads should serve as operational information owners or custodians. They are closest to the processes that produce and consume personnel documents, student records, policies, accreditation evidence, partner information, and administrative files. Their duties should include identifying important information assets, appointing document stewards, approving access based on job responsibilities, conducting periodic permission reviews, ensuring that documents have owners and review dates, and confirming that departing employees transfer institutional records. They should not simply create a shared folder and give broad access to an entire department. Instead, they should use role-based groups and apply the principle of least privilege, under which users receive only the access necessary for their work.

Department heads also have a special obligation to prevent knowledge loss caused by employee turnover. The case study states that institutional knowledge was dependent on individuals. A department should therefore maintain documented procedures, handover records, decision histories, contact information, project files, and current versions of policies in the official repository. Before an employee leaves, the department should review that person’s files, identify which materials are institutional records, transfer ownership, remove unnecessary personal content, and preserve relevant work. This process protects continuity without improperly monitoring or appropriating private information. It also helps the university retain practical knowledge that may not appear in formal policies.

Every employee, including faculty, administrators, student employees, and contractors, has a user-level responsibility. Users should protect credentials, use multifactor authentication, verify suspicious messages, avoid entering passwords into unverified pages, store institutional documents only in approved locations, respect classification labels, share information only with authorized recipients, and report mistakes quickly. The employee in the scenario is not the only person at fault, because the university’s environment made the consequences of one stolen password much worse. Still, users remain an important defensive layer. Regular awareness training should teach employees how to recognize impersonation of the IT Department, inspect links, use trusted bookmarks, report phishing, and understand why personal storage is inappropriate for official university records.

A culture of shared responsibility must avoid blaming individuals for system weaknesses. Phishing attacks succeed partly because attackers exploit normal workplace urgency and because organizations may lack strong technical safeguards. YuSiP should use the incident to improve controls rather than merely punish the employee. Mandatory multifactor authentication, phishing-resistant authentication for high-risk accounts, email-reporting tools, conditional access, download monitoring, and rapid account containment can reduce the likelihood that one compromised account will expose an entire departmental drive. Training should be reinforced through realistic exercises and timely feedback, not treated as a one-time annual presentation.

The university should formalize these responsibilities through a responsibility matrix. Senior leadership would be accountable for policy, funding, and risk acceptance. The information governance committee would coordinate classification, retention, and university-wide standards. Information owners would be accountable for the content and its business requirements. Departmental stewards would maintain documents and permissions day to day. IT would be responsible for the platform, identity controls, monitoring, backups, and recovery. Legal, privacy, records, research, and quality assurance offices would advise on specialized requirements. All personnel would be responsible for compliant use and prompt reporting. This arrangement is consistent with security governance principles that require roles and authorities to be established, communicated, understood, and enforced.

The university should also define accountability for each category of information. A personnel profile document, for example, should have a designated Human Resources owner, a classification reflecting its sensitive nature, restricted access for authorized personnel, an established retention period, and an approved repository. Student records should be owned by the appropriate registrar or student-services authority, with access determined by educational and administrative need. Accreditation documents should have a quality-assurance owner who ensures that evidence is current and traceable. Research data may require different controls depending on whether it includes confidential participants, intellectual property, partner restrictions, or publicly shareable outputs. These examples show why a single IT-centered rule cannot manage all institutional knowledge properly.

The university should introduce a data and document lifecycle. First, information should be created in an approved system with an owner and classification. Second, it should be stored in a repository with appropriate access controls and metadata. Third, it should be reviewed and updated according to a defined schedule. Fourth, older versions should be retained or archived when necessary, while obsolete copies should be securely disposed of. Finally, access should be removed when users no longer have a legitimate need. This lifecycle addresses every weakness identified in the incident: scattered storage, poor discoverability, excessive permissions, lack of classification, dependence on individuals, and outdated procedures.

Accountability should be measured rather than merely announced. YuSiP could track the percentage of information assets with named owners, the percentage of critical documents stored in approved repositories, the number of overdue document reviews, completion of access recertifications, backup-restoration test results, phishing-reporting rates, and the time required to disable accounts after separation. Departments that repeatedly fail to review permissions or retain official records should receive corrective support and, where appropriate, administrative consequences. At the same time, departments that improve their practices should receive recognition and resources. Measurement makes knowledge governance a continuing management function rather than a temporary response to the breach.

Ultimately, the best answer is that everyone participates, but responsibility must be distributed according to expertise and authority. IT should not be the sole owner of institutional knowledge because it cannot determine the academic and administrative meaning of every document. Faculty and administrators should not be left to protect information without secure systems and clear standards. Senior leaders must provide governance and resources, information owners must make content and access decisions, IT must implement and monitor technical safeguards, and every user must follow secure practices. A university-wide shared-responsibility model would allow YuSiP to treat institutional knowledge as a managed organizational asset, reduce the damage caused by compromised accounts, preserve knowledge when employees leave, and ensure that important information remains available, accurate, and protected.

3. How can the university balance knowledge sharing and information security?

YuSiP University can balance knowledge sharing and information security by adopting a “share by default, but protect by design” approach. The university should make legitimate institutional knowledge easy for authorized people to find and use while ensuring that access to sensitive information is limited, monitored, and regularly reviewed. This balance requires more than purchasing a new platform. It requires information classification, clear ownership, role-based access, secure collaboration tools, employee education, reliable backups, and a culture in which cybersecurity is treated as part of knowledge management rather than as a separate technical responsibility.

The phishing incident demonstrates why this balance is necessary. The compromised employee did not merely lose control of an account. Because the university lacked a centralized and governed knowledge environment, that account could reach personnel profiles, student records, policies, curriculum materials, accreditation documents, research data, and partner information through a shared departmental drive. At the same time, important documents were unavailable to the university because they existed only on individual computers or personal cloud accounts. The university therefore experienced both excessive sharing and insufficient sharing. Too much information was exposed to an inappropriate user, while other information was inaccessible to the institution when it was needed for continuity and recovery.

The first step is to establish a centralized knowledge management environment approved and managed by the university. This system should become the authoritative location for institutional documents, policies, procedures, curriculum materials, accreditation records, research administration files, and other shared knowledge. It should support document versioning, search, metadata, approval workflows, audit logs, retention rules, access reviews, and secure collaboration. The objective is not necessarily to place every file in one enormous folder. Instead, the university should create a structured institutional repository with separate libraries or workspaces for major functions and with clear rules about what information belongs in each location.

Centralization reduces the risks created by personal storage. When an employee saves a critical policy only on a personal computer or personal cloud account, the university may lose that knowledge when the employee leaves, changes roles, loses the device, or becomes unavailable. Personal storage also prevents consistent backup, access management, retention, and monitoring. A university-controlled platform allows the institution to preserve knowledge as an organizational asset rather than treating it as the private property of whoever happened to create it. Employees should still be able to work efficiently, but their official work products should be transferred into institutional repositories rather than remaining in personal accounts.

Centralization should not mean that everyone receives access to everything. The repository should use a logical structure based on functions, roles, and information sensitivity. For example, general institutional policies may be available to all faculty and staff, while curriculum-development documents may be available to members of relevant academic departments. Accreditation evidence may be shared with authorized quality assurance personnel and designated administrators. Personnel files and student records should be restricted to offices and employees with a legitimate business or educational need. Research data may require different controls depending on whether it contains personal information, confidential partner information, intellectual property, or publicly shareable results.

A formal information classification scheme is essential to make these distinctions understandable and enforceable. NIST (2024) explains that data classification uses persistent labels to characterize data assets so that they can be managed and protected appropriately; it also identifies classification as important for secure sharing, compliance reporting, monitoring, and broader cybersecurity decisions. YuSiP could adopt a simple classification model such as Public, Internal, Confidential, and Restricted. The categories should be defined in plain language and connected to specific handling requirements. A label has little value if employees do not know what they are permitted to do with information carrying that label.

Public information would include material intentionally prepared for external release, such as published announcements, approved course catalogs, public research outputs, and official website content. Internal information would include routine administrative information intended for university personnel but not for unrestricted public distribution. Confidential information would include nonpublic institutional documents, sensitive research materials, partner information, and internal planning records. Restricted information would include student records, personnel files, financial information, credentials, legally protected data, and research data whose disclosure could cause serious harm. Classification should consider confidentiality, integrity, availability, legal requirements, business value, and the consequences of unauthorized disclosure or alteration. ISO 27001 guidance similarly emphasizes classifying information according to organizational security needs and requirements relating to confidentiality, integrity, and availability.

Each classification should have corresponding controls. Public information can be broadly shared, although it should still be protected from unauthorized alteration. Internal information should require authenticated university access and should not be placed in personal accounts. Confidential information should require approved access groups, encryption during storage and transmission, restrictions on external sharing, and regular access reviews. Restricted information should receive the strongest safeguards, including multifactor authentication, tightly controlled permissions, encryption, detailed logging, download restrictions where practical, and formal approval before sharing outside the responsible office.

The university should assign information owners for major categories of knowledge. An information owner is not necessarily the person who created a document. Rather, the owner is the department or responsible official accountable for deciding how information should be classified, who may access it, how long it should be retained, and when it should be reviewed. The human resources office might own personnel records, the registrar might own student records, the quality assurance office might own accreditation evidence, and a research office might govern sponsored research information. Ownership prevents the common problem in which files are technically stored somewhere but nobody is responsible for their accuracy, access rights, or lifecycle.

Access should be based on least privilege and role-based access control. Least privilege means that users receive only the access necessary for their duties, while role-based access means that permissions are connected to job responsibilities rather than informal requests or permanent personal exceptions. An administrative staff member may need access to certain departmental procedures but not to all personnel files, student records, or research data. A faculty member may need access to curriculum materials and selected research resources but not to confidential human resources documents. A department chair may require broader access, but that access should still be limited to the information needed for the role.

The compromised account in the incident illustrates why broad shared-folder access is dangerous. If one account is phished, excessive permissions allow the attacker to move laterally across unrelated knowledge domains. YuSiP should separate departmental workspaces and use group-based permissions that reflect current organizational roles. Shared accounts should be eliminated wherever possible because they make accountability difficult and allow attackers to hide behind collective credentials. Access should be automatically adjusted when an employee changes departments, goes on extended leave, or leaves the university. Departing employees should lose access promptly, and their official knowledge should remain in the institutional repository.

Multifactor authentication should be mandatory for university accounts, especially for access to sensitive repositories, administrative systems, remote connections, and cloud services. A stolen username and password should not be sufficient to access institutional knowledge. Phishing-resistant authentication methods, such as security keys or passkeys, would provide stronger protection than passwords alone. The university should also use conditional access controls that consider device health, location, unusual login patterns, and risk indicators. For example, a login from an unfamiliar location followed by mass downloads should trigger additional verification or automatic restriction.

Knowledge sharing must also be designed around secure collaboration. Employees should have approved methods for sharing files internally and externally rather than relying on personal email, USB devices, or consumer cloud accounts. The university platform should provide controlled links, expiration dates, password protection where appropriate, recipient restrictions, and the ability to revoke access. External partners should receive access only to specific documents or project workspaces, not to broad departmental folders. Before sharing information with a partner, the responsible office should confirm the contractual, legal, and research requirements governing that information.

Searchability is an important part of secure knowledge sharing. Employees often use unsafe workarounds when official information is difficult to find. If policies are buried in folders, duplicated across email threads, or stored under inconsistent filenames, users may download copies, keep outdated versions, or ask colleagues to send documents through insecure channels. YuSiP should create a searchable knowledge portal with standard naming conventions, metadata, document owners, publication dates, review dates, and status indicators such as Draft, Approved, Superseded, or Archived. Search results should respect user permissions so that the system does not reveal sensitive document titles or content to unauthorized users.

Version control is equally important. The incident revealed that outdated policies and procedures were still being used. A controlled repository should identify one approved version of each policy and preserve prior versions for historical and audit purposes without presenting them as current guidance. Every important document should have an owner, approval date, effective date, next review date, and revision history. Automated reminders can notify owners when documents require review. When a policy is replaced, links to the old version should redirect users to the current version or clearly state that the document is no longer authoritative.

The university must also protect the integrity and availability of shared knowledge, not only its confidentiality. The attacker deleted documents, and some could not be recovered because they existed only in personal locations. YuSiP should implement a backup strategy based on multiple copies, separate storage environments, regular recovery testing, and protection against unauthorized deletion or ransomware. Backups should include version history and immutable or offline copies so that an attacker cannot simply delete both the working files and their backups. Recovery exercises should confirm that the university can restore critical policies, records, research data, and operational documents within acceptable timeframes.

Data retention and secure disposal should be included in the knowledge management program. Keeping every document forever increases the amount of information that can be exposed and makes it harder to identify authoritative content. The university should establish retention schedules based on legal, regulatory, academic, financial, research, and operational requirements. Records that must be preserved should be protected from alteration, while obsolete duplicates and unnecessary sensitive files should be securely deleted. Retention should never be used as a substitute for organization; a repository filled with obsolete documents can be almost as harmful as a repository with missing documents.

Technology alone will not solve the problem. Faculty and staff need practical training that connects security behavior to their daily work. Training should explain how to identify phishing messages, verify unusual requests, classify documents, use approved sharing tools, report mistakes, and avoid personal storage for official records. Instead of presenting cybersecurity as a set of abstract rules, the university can use examples from the incident. Employees should understand that an apparently harmless shared folder may contain highly sensitive information and that a single compromised account can expose multiple knowledge domains.

The university should establish a supportive reporting culture. Employees may hesitate to report that they clicked a suspicious link because they fear punishment or embarrassment. Delayed reporting gives attackers more time to access files, create persistence, or delete evidence. YuSiP should make reporting simple, immediate, and nonpunitive when employees act in good faith. Security teams should explain that rapid reporting is a protective action. The university can reinforce this culture through simulated phishing exercises, provided that the exercises are educational rather than humiliating.

Governance should bring together information technology, records management, academic leadership, human resources, legal or privacy officials, research administration, quality assurance, and representatives from faculty and staff. This group can define classification standards, approve repositories, resolve ownership questions, set retention rules, and review security incidents. Governance is especially important because information does not fit neatly into technical departments. Student records involve privacy and academic administration; research data involves intellectual property and external obligations; accreditation records involve institutional accountability; and policies affect the entire university.

Finally, YuSiP should measure whether its approach is working. Useful indicators include the percentage of critical documents stored in approved repositories, the number of files lacking owners or classifications, the percentage of access reviews completed on time, the age of overdue documents, the number of personal-storage exceptions, phishing-reporting rates, backup restoration success, and the time required to revoke access after employee separation. These measures should be used for improvement rather than merely punishment. A department with many unclassified files may need assistance, better templates, or a simpler workflow rather than criticism alone.

The correct balance is not achieved by restricting information until nobody can use it. Excessive secrecy encourages employees to create unofficial copies and bypass controls. Nor is it achieved by making every document available to every employee. Open access without classification and authorization creates precisely the type of exposure that occurred in the incident. The university should instead create trusted spaces in which authorized people can discover, use, update, and share information efficiently, while sensitive knowledge is protected according to its risks.

Get abbegail lopez’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In practical terms, YuSiP should begin by identifying critical information assets and moving them from personal storage and uncontrolled departmental folders into university-managed repositories. It should then classify those assets, assign owners, redesign permissions, require multifactor authentication, establish version and retention controls, strengthen backups, and train employees in secure knowledge practices. Over time, the university can develop a mature knowledge environment in which institutional knowledge remains available when needed, current when used, and protected when sensitive. This approach directly addresses both sides of the incident: it prevents unauthorized access to information that was too broadly exposed and prevents permanent loss of information that was insufficiently institutionalized.

4. If you were the university administrator, what three actions would you prioritize immediately after the incident?

If I were the university administrator responding to the incident at YuSiP University, I would prioritize three actions immediately. First, I would contain the breach, secure the compromised account, and preserve evidence. Second, I would determine the full scope and impact of the incident, including which information was accessed, downloaded, altered, or lost. Third, I would establish an emergency knowledge governance and recovery program that protects institutional information while creating a reliable centralized knowledge management structure.

These priorities are connected. Containment prevents the attacker from causing additional damage. Investigation allows the university to understand its legal, operational, academic, and reputational exposure. Knowledge governance addresses the deeper weakness revealed by the incident: the university did not know where all of its important information was stored, who could access it, whether it was current, or whether it could be recovered. As a university administrator, I would treat the incident as both a cybersecurity emergency and an institutional knowledge emergency.

First Action: Contain the Breach and Preserve Evidence

My first immediate action would be to activate a formal incident response team and contain the compromised account and affected systems. The team should include information technology personnel, cybersecurity specialists, the university administrator, legal counsel, records management personnel, representatives from the College of SeeEyeSee, communications staff, and, where appropriate, privacy and compliance officers. The incident should not be managed informally by one IT employee because the affected materials include personnel files, student records, policies, curriculum documents, research data, quality assurance records, and partner information. Each category may have different privacy, contractual, academic, and operational consequences.

The compromised employee’s account should be disabled or temporarily suspended immediately. All active sessions, authentication tokens, application passwords, email sessions, virtual private network connections, and cloud access associated with the account should be revoked. The employee should receive a new password through a secure process, but a password reset alone is not sufficient. An attacker may already possess session tokens or may have created forwarding rules, application permissions, unauthorized mailbox delegates, or persistence mechanisms. The account should therefore be re provisioned and carefully reviewed before it is returned to normal use. The Cybersecurity and Infrastructure Security Agency, commonly called CISA, recommends re provisioning suspected or confirmed compromised accounts, auditing account access, and isolating the affected workstation after a phishing incident.

The employee’s workstation should be disconnected from the network while preserving its condition for examination. It should not simply be wiped or restarted because doing so could destroy useful evidence about the phishing message, the fake login page, browser activity, malicious files, saved credentials, and possible malware. IT personnel should capture relevant logs and forensic images according to a documented procedure. Evidence should include the original phishing email, full email headers, the fraudulent web address, browser history, authentication logs, firewall records, endpoint alerts, shared drive audit logs, cloud access logs, file download records, deletion events, and evidence of changes to permissions or account settings.

NIST’s incident handling guidance emphasizes acquiring, preserving, securing, and documenting evidence before or during containment. It also identifies containment, eradication, and recovery as distinct activities. This distinction is important because the university must avoid confusing restoration with resolution. Restoring deleted files from backup may repair visible damage, but it does not prove that the attacker has been removed or that the original vulnerability has been corrected.

At the same time, the university should block the phishing domain, malicious links, and related indicators across email security systems, web filters, endpoint protection tools, and firewalls. Security personnel should search for the same indicators across the entire university environment. The attacker may have sent additional phishing emails, attempted to access other accounts, or used the compromised credentials against systems unrelated to the shared departmental drive. The university should also review whether the employee reused the same password on other university platforms or external services. If password reuse is possible, affected credentials should be changed promptly, especially for systems containing sensitive information.

Access to the shared departmental drive should be restricted temporarily while the investigation takes place. This does not necessarily mean shutting down every university system. Instead, the response should be proportionate and risk based. Sensitive folders containing personnel records, student records, research data, and partner profiles should receive the most restrictive temporary controls. Suspicious accounts, unexplained administrator privileges, external sharing links, anonymous access, and stale permissions should be disabled until verified. Any files that may have been modified by the attacker should be placed in a protected state so investigators can distinguish original records from altered records.

The university must communicate quickly and carefully with employees. A brief internal notice should explain that a phishing incident occurred, instruct employees not to open related messages, and provide a verified contact method for reporting suspicious activity. The notice should not blame the staff member. Blaming an individual can discourage future reporting and encourage employees to conceal mistakes. The incident resulted from a combination of social engineering, credential weakness, inadequate monitoring, broad access permissions, and fragmented information management. Accountability is necessary, but the institutional response should focus on correcting the system rather than humiliating the employee.

The first action also requires maintaining an incident timeline. The response team should record when the phishing message was received, when the credentials were entered, when suspicious activity began, what files were accessed, when the account was disabled, what systems were isolated, and when recovery occurred. A precise timeline supports technical analysis, communication with leadership, possible regulatory reporting, insurance requirements, and later lessons learned. It also prevents confusion when several departments provide different versions of events.

Second Action: Determine the Scope and Impact

After containment begins, my second priority would be a structured investigation to determine what information was exposed, downloaded, deleted, or changed. The university should assume that the attacker may have accessed more than the files already identified until evidence demonstrates otherwise. The investigation should cover the compromised account, the shared departmental drive, email, cloud applications, identity management systems, endpoint devices, backup systems, and any other service that accepted the employee’s credentials.

The affected information must be categorized. The personnel profile document, or 201 file, may contain employment, identification, financial, medical, disciplinary, or other confidential information. Student records may include grades, addresses, identification numbers, academic progress, financial information, or disability related records. Research and extension data may contain unpublished findings, intellectual property, confidential participant information, or contractual restrictions. External partner profiles may include business contacts, agreements, or information provided under expectations of confidentiality. Institutional policies, curriculum files, and accreditation documents may appear less sensitive, but their unauthorized alteration could affect academic quality, compliance, accreditation, and decision making.

The investigation should create a data exposure matrix. For every affected information category, the university should record where the data was stored, the responsible department, the classification of the data, the users who could access it, the evidence of access, whether it was downloaded, whether it was changed or deleted, whether it was recovered, and what legal or operational consequences may follow. This matrix would immediately expose the knowledge management weakness. The university currently does not have a reliable inventory of its information assets, and therefore cannot confidently answer basic questions about the incident.

The 2024 NIST’s Cybersecurity Framework 2.0 recommends maintaining inventories of data and associated metadata, identifying and managing organizational assets, and prioritizing assets according to classification, criticality, resources, and impact on the organization’s mission. Applying this principle to YuSiP University means that data should be treated as an institutional asset rather than as the private property of the employee or department that happens to store it.

The investigation should examine access logs for unusual behavior. Important questions include whether the account logged in from unfamiliar locations, whether it used unusual devices, whether large numbers of files were downloaded in a short time, whether the attacker accessed files outside the employee’s normal responsibilities, whether files were compressed before download, whether new sharing links were created, and whether the attacker attempted to delete backups or alter permissions. The university should compare the activity with the employee’s normal work pattern. An administrative staff member accessing personnel, student, research, and partner records all at once may be technically possible but operationally unusual.

The university should also determine how long the attacker had access. The initial phishing event may not represent the beginning or end of the compromise. Attackers can retain access through stolen tokens, mailbox rules, malicious OAuth applications, new forwarding addresses, or additional compromised accounts. A review of identity provider logs, email rules, cloud application authorizations, remote access records, and administrator activity is essential.

The impact assessment must include the possibility of data integrity damage. A file that was not downloaded may still have been modified. An altered policy, curriculum document, accreditation record, or research dataset could be more damaging than a deleted file because employees might rely on it without realizing it is false. Restored documents should be compared with known good versions where possible. Hash values, version histories, document metadata, approval records, and paper copies can help establish whether recovered documents are trustworthy.

The university should involve legal counsel and privacy officials early. The appropriate notification requirements will depend on the university’s jurisdiction, the type of data involved, contractual commitments, and whether the information belongs to students, employees, research participants, or external partners. The administrator should avoid making unsupported claims such as saying that only a small number of files were involved or that no personal data was exposed. Communications should be accurate, limited to verified facts, and updated as the investigation develops.

External parties may need to be notified. If partner profiles or contracted research materials were accessed, the university should review agreements for notification obligations. If student or employee information was involved, the university should prepare a transparent explanation that describes what happened, what information may have been affected, what protective actions are being taken, and where individuals can obtain assistance. Communication should be coordinated so that departments do not send contradictory messages.

The investigation should conclude with a written incident report that identifies the initial cause, the path of compromise, affected systems, affected information, security gaps, response actions, recovery status, and remaining risks. The report should distinguish confirmed facts from assumptions and unresolved questions. It should also identify whether the employee had a legitimate need to access the full shared drive. If not, the investigation should treat excessive access as a separate control failure rather than merely an unfortunate consequence of phishing.

Third Action: Create Emergency Knowledge Governance and Recovery Controls

My third priority would be to establish an emergency knowledge management program that brings important university information under institutional control. This does not mean immediately purchasing a software product and transferring every file without planning. A system is useful only when the university defines ownership, classification, retention, access, version control, backup, and review responsibilities. The goal is to ensure that knowledge remains available, accurate, protected, and recoverable regardless of where an individual employee works.

The university should first issue an emergency directive requiring official university records and work products to be stored in approved institutional repositories. Employees should be prohibited from using personal cloud accounts, private email accounts, unapproved USB devices, and unregistered personal computers for official university information. The directive should recognize practical realities and provide a supported alternative. Employees are more likely to comply when the university supplies secure shared storage, adequate capacity, clear procedures, and technical assistance.

A rapid discovery exercise should identify where critical information currently exists. Departments should inventory files stored on personal drives, departmental computers, shared folders, email accounts, USB devices, and personal cloud services. The university should prioritize high value information first, including personnel records, student records, research data, institutional policies, curriculum materials, accreditation documents, contracts, partner profiles, financial records, and emergency procedures. The purpose is not to inspect every personal file indiscriminately. The purpose is to locate official institutional knowledge, preserve it, classify it, and move it into controlled repositories.

The university should adopt a practical data classification scheme. For example, information could be classified as public, internal, confidential, or restricted. Public information may be released without significant harm. Internal information may be used by university personnel but should not be broadly published. Confidential information may include internal personnel, research, contractual, or administrative data requiring limited access. Restricted information may include sensitive student records, highly confidential personnel data, research participant information, authentication information, or legally protected records. Each classification should have rules for access, encryption, sharing, retention, printing, transmission, and destruction.

Classification must be based on potential harm and institutional importance, not simply on the department that owns the file. A curriculum document might normally be internal, but an accreditation report under active review may require restricted access. A research dataset might be public after publication but confidential while it contains unpublished findings or identifying information. A personnel record should not be placed in a general departmental folder merely because several staff members occasionally need to reference it.

The university should implement role based access. Employees should receive access according to their responsibilities, not according to historical convenience. A staff member should be able to access the records necessary for assigned duties without automatically receiving access to every document in the department. Access groups should be reviewed by department heads and information owners. Former employees, transferred employees, temporary workers, and contractors should have their access removed or adjusted promptly.

Multifactor authentication should be required for email, cloud storage, remote access, administrative systems, and other services containing institutional information. Phishing resistant authentication should be used where feasible, especially for administrators and users with access to sensitive records. Password resets and multifactor authentication will not solve every problem, but they significantly reduce the value of stolen passwords when properly implemented.

The university should establish authoritative repositories for each major information category. Personnel records should have one controlled system of record. Student records should remain in an approved student information system. Policies and procedures should be maintained in a searchable policy repository with document owners, approval dates, effective dates, review dates, and version histories. Curriculum and instruction documents should have designated owners and controlled review processes. Research data should be managed according to research ethics, funding, contractual, and preservation requirements. Accreditation materials should be stored in a controlled repository with clear evidence of approval and final versions.

Every important document should have an owner. Ownership does not mean that one person keeps the only copy. It means that a responsible office or role determines whether the document is accurate, who may access it, how long it should be retained, and when it must be reviewed. The university should also identify custodians who manage the technical storage and security controls. Separating ownership from custody prevents confusion when an employee changes jobs or leaves the institution.

Version control is essential because outdated knowledge can create risks even when no attacker is present. Policies and procedures should display their current status and effective date. Superseded documents should be archived or clearly marked as obsolete. Employees should be directed to the authoritative version rather than encouraged to search through old email attachments or departmental folders. A document review schedule should require departments to verify critical materials at least annually or whenever laws, technology, academic requirements, or university processes change.

Backup and recovery controls must be strengthened. The university should maintain multiple backup copies, test restoration regularly, and protect backups from ordinary user credentials. At least one backup copy should be isolated from the primary environment so that an attacker who gains access to shared drives cannot easily delete or encrypt the backups. Recovery testing should include not only whether a file can be restored, but whether the restored version is complete, trustworthy, and usable by the responsible department.

The university should combine technical controls with awareness training. Employees need practical training on identifying fake login pages, checking sender addresses, avoiding urgent links, reporting suspicious messages, and using approved repositories. Training should be repeated and reinforced through simulated exercises, but simulations must be educational rather than punitive. Managers should also receive training on access reviews, document ownership, and the dangers of allowing institutional knowledge to remain in personal storage.

Finally, I would establish measurable accountability. Within a defined period, every department should report its critical information repositories, data owners, access groups, backup status, and unresolved risks. The university should conduct periodic access reviews, phishing exercises, restoration tests, and policy audits. Metrics could include the percentage of critical data located in approved repositories, the percentage of sensitive systems protected by multifactor authentication, the number of stale accounts removed, the percentage of critical documents with assigned owners and review dates, and the success rate of backup restoration tests.

The three immediate actions are to contain and preserve, investigate and assess, and govern and recover. The first protects the university from continuing compromise. The second establishes what happened and who may be affected. The third corrects the knowledge management weaknesses that made the incident more damaging than it should have been.

The central lesson is that cybersecurity and knowledge management cannot be separated at YuSiP University. Information that is scattered, unclassified, outdated, and controlled by individuals is difficult to secure and difficult to recover. By creating authoritative repositories, assigning ownership, limiting access, enforcing multifactor authentication, maintaining tested backups, and reviewing information regularly, the university can transform the incident from a destructive loss of knowledge into the foundation of a stronger institutional knowledge environment.

5. How can cybersecurity awareness become part of the university’s knowledge management culture?

Cybersecurity awareness can become part of YuSiP University’s knowledge management culture when the university treats secure information handling as a normal responsibility of creating, storing, sharing, updating, and preserving institutional knowledge. The phishing incident involving the College of SeeEyeSee shows that cybersecurity cannot remain the exclusive responsibility of the Information Technology Department. The employee’s stolen password gave the attacker access to a shared departmental drive, but the deeper weakness was the absence of an organized system for classifying, protecting, updating, and preserving knowledge. In this case, cybersecurity awareness should become integrated into the university’s everyday knowledge practices, leadership expectations, employee training, document procedures, and institutional values.

NIST (2024) explains that a cybersecurity and privacy learning program should be managed as a continuing life cycle rather than as a one time training event. The publication emphasizes behavior change, risk management, organizational learning, and the development of a security and privacy culture. This approach is especially relevant to YuSiP University because the university’s problem is not simply that one employee clicked a fraudulent link. The institution also lacks consistent rules for where knowledge should be stored, who should access it, how sensitive documents should be identified, and how important information should be preserved when employees leave.

A knowledge management culture is the collection of shared attitudes, practices, responsibilities, and systems that determine how an organization creates and uses knowledge. At YuSiP University, such a culture would mean that employees understand institutional documents as university assets rather than as personal possessions. A personnel profile document, student record, accreditation file, research dataset, curriculum document, and policy manual should not be treated like ordinary files. Each item has a purpose, an owner, a level of sensitivity, an authorized audience, a retention requirement, and a process for revision. Cybersecurity awareness becomes meaningful when employees understand that protecting these documents is part of preserving the university’s memory, reputation, legal obligations, and ability to serve students.

The first step is for university leaders to communicate that cybersecurity and knowledge management are connected institutional responsibilities. The president, vice presidents, deans, department chairs, directors, and information technology leaders should publicly explain what was learned from the incident. Their message should avoid blaming the individual employee because a blame oriented response may cause employees to hide mistakes. Instead, leaders should explain that phishing succeeds when attackers exploit both human trust and weak organizational processes. Employees should be encouraged to report suspicious messages immediately, even if they have already clicked a link or entered credentials. The objective should be rapid containment and learning rather than punishment.

Leadership must also establish clear accountability. The 2024 NIST Cybersecurity Framework version 2.0 identifies organizational leadership as responsible for cybersecurity risk and for fostering a culture that is risk aware, ethical, and continually improving. At YuSiP University, this means that each major knowledge area should have an accountable owner. The registrar or an authorized records office might oversee student records. Human resources might oversee personnel information. The research office might oversee research and extension data. The academic affairs office might oversee curriculum documents. The quality assurance office might oversee accreditation records. The information technology office would provide the technical controls, but the business owners would remain responsible for determining appropriate access and retention.

The university should then create a formal information classification system that employees can understand and apply. Classification is essential because awareness is difficult when employees do not know which information requires special protection. YuSiP University could establish categories such as public, internal, confidential, and highly confidential. Public materials might include approved news releases or published course offerings. Internal materials might include routine administrative communications. Confidential materials could include faculty evaluations, partnership information, and internal financial documents. Highly confidential materials could include student records, personnel files, credentials, research data subject to restrictions, and documents containing personally identifiable information.

Every classification category should have practical handling rules. A confidential or highly confidential document should not be stored in an employee’s personal cloud account or on an unencrypted USB device. It should be placed in an approved university repository with access controls, backup, audit logging, and retention rules. Employees should know whether a document may be emailed, whether it may be shared externally, whether encryption is required, and how it must be destroyed. These rules should be included directly in the university’s knowledge management procedures so that cybersecurity is part of the document life cycle rather than a separate technical policy.

The university also needs a centralized knowledge management system. Centralization does not necessarily mean that every document must exist in one physical database, but it does mean that approved institutional knowledge must be governed through university controlled platforms. The system should provide department based repositories, role based permissions, version control, search functions, document ownership, retention schedules, audit trails, and reliable backups. It should also make it easy for employees to find the current version of a document. If the authorized policy is difficult to locate, employees may rely on an old attachment in an email or an obsolete copy stored on a personal computer.

Cybersecurity awareness should therefore include instruction on where knowledge belongs. Employees should learn that personal cloud drives, private email accounts, local computer folders, and removable media are not acceptable repositories for official university records unless a specific policy permits their use. During onboarding, new employees should receive an explanation of approved storage locations, document naming standards, classification labels, sharing procedures, and incident reporting. Existing employees should receive refresher training when a new system is introduced or when an incident reveals a significant weakness.

Training should be role based instead of identical for everyone. A faculty member handling research data has different risks from a payroll employee handling personnel records. A registrar employee needs detailed guidance on student privacy and controlled disclosure. A department chair needs to understand access reviews and the responsibilities associated with approving permissions. A researcher needs to understand data sharing agreements, external collaborators, and secure storage. A student assistant may need simple instructions about phishing, passwords, removable media, and reporting. NIST’s awareness guidance supports audience specific learning and a life cycle approach that can be adapted to different organizational roles.

The university should use realistic examples from the incident. Employees could be shown how a fake mandatory security update might appear, how to inspect a sender address, how to access the official IT portal without using an email link, and how to report a suspicious message. They should also examine the consequences of unauthorized access to the shared drive. The issue was not merely that files were downloaded. The attacker could reach personnel profiles, student records, institutional policies, curriculum materials, accreditation documents, research data, and external partner profiles because permissions and repositories were not adequately organized. Connecting the phishing example to the university’s actual knowledge assets makes training more memorable and relevant.

Awareness must continue after formal training. The university should provide short monthly learning messages, simulated phishing exercises, department discussions, security reminders inside document systems, and periodic demonstrations of secure sharing. These activities should be brief and practical. A monthly message might explain how to recognize a fraudulent login request. Another might explain how to classify research data. A later message could show how to request access to an accreditation folder. Security awareness should appear during events that naturally involve knowledge handling, such as policy revisions, research onboarding, accreditation preparation, employee transfers, and annual records reviews.

The university should also create a network of departmental knowledge and security champions. Each college, office, or department could appoint a trained employee who helps colleagues apply classification rules, identify outdated documents, report suspicious activity, and communicate questions to the information technology and records management teams. These champions would not replace security professionals. Their purpose would be to translate university procedures into local work practices. They could also identify department specific problems, such as shared folders that contain former employees’ accounts or sensitive documents that lack owners.

A strong culture requires convenient secure behavior. If the approved knowledge management system is slow, confusing, or difficult to access, employees will continue using personal drives and email attachments. The university should therefore design its systems around actual work needs. Employees should have simple methods for creating a controlled shared folder, inviting an external partner, requesting permission, restoring an earlier version, reporting a suspicious file, and finding the latest policy. Security should be built into the system through multifactor authentication, automatic classification prompts, restricted external sharing, encryption, backup, and alerts for unusual downloads or deletions.

Access permissions should be reviewed regularly. The compromised account was able to reach a broad collection of valuable documents, suggesting that access may have been granted according to convenience rather than job necessity. The principle of least privilege requires users to receive only the access needed for their responsibilities. Departments should conduct periodic access reviews, particularly after employee transfers, promotions, resignations, and changes in duties. Former employees’ accounts should be disabled promptly. Shared folders should have named owners who review their membership and remove unnecessary access.

Awareness should include a clear incident reporting culture. Employees need to know what to do if they click a suspicious link, lose a device, send information to the wrong person, discover an incorrect permission, or find that an important document has disappeared. The reporting process should be easy, available through multiple channels, and supported by a promise of fair treatment. Early reporting can allow the university to reset credentials, revoke sessions, isolate devices, preserve evidence, and prevent further access. Delayed reporting increases the chance that an attacker can move through connected repositories and destroy or copy more knowledge.

Knowledge preservation is another central part of the culture. Important institutional knowledge should have an identified owner, an approved location, a backup schedule, a retention period, and a succession plan. Departments should conduct knowledge audits to locate documents currently stored on personal computers, USB devices, email accounts, and personal cloud platforms. The university should migrate official records into controlled repositories and document the knowledge needed to continue essential functions if an employee leaves. This reduces the risk that institutional memory will disappear because one person maintained the only copy.

Documents should also be reviewed for accuracy and currency. Outdated policies can create security risks because employees may follow obsolete procedures or use old contact information. Each controlled document should display its owner, approval date, review date, version number, classification, and next review date. The system should notify owners when a review is due. Employees should be encouraged to use the current version rather than saving local copies. Cybersecurity awareness in this context means recognizing that inaccurate knowledge can be as harmful as unavailable knowledge.

The university should measure whether awareness is changing behavior. Completion rates alone are not sufficient because an employee can complete a course without changing daily practices. More useful measures include phishing reporting rates, the number of employees using approved repositories, reductions in personal storage of institutional records, results of access reviews, the time required to report incidents, the number of outdated documents removed, and the percentage of critical documents with assigned owners and verified backups. NIST’s publication recommends metrics and evaluation methods that help organizations improve their programs as risks and organizational needs change.

Metrics should be used for improvement rather than public embarrassment. If a department has a high rate of phishing simulation failures, the response should involve better coaching, clearer processes, and closer support. If employees repeatedly store files outside the approved system, the university should ask whether the system is accessible and suitable. A learning culture treats mistakes and near misses as information about the institution’s controls. This approach makes employees more willing to report problems and helps the university correct systemic weaknesses.

Finally, cybersecurity awareness should be incorporated into university governance and performance expectations. Policies should assign responsibilities for data classification, repository management, access review, incident reporting, records retention, and document updating. Security and knowledge management should be discussed by a cross functional committee that includes information technology, records management, legal or privacy officers, academic affairs, research administration, human resources, and representatives from colleges and departments. New projects should include a security and knowledge management review before collecting or storing sensitive information. Employee evaluations for managers and custodians of institutional knowledge can include responsibility for maintaining secure and accurate records.

In conclusion, cybersecurity awareness can become part of YuSiP University’s knowledge management culture by making secure information behavior a normal part of institutional work. The university should combine leadership commitment, centralized repositories, classification rules, role based training, continuous communication, departmental champions, least privilege access, incident reporting, knowledge preservation, document updating, and behavior based measurement. The author of NIST Special Publication 800 50 Revision 1 presents cybersecurity learning as a continuing organizational program designed to encourage behavior change and develop a security and privacy culture, not as a single annual lecture. Applied to YuSiP University, this principle means that every employee who creates, accesses, shares, or preserves university knowledge also participates in protecting it. The lasting lesson of the SeeEyeSee incident is that cybersecurity is not only about defending computers. It is about safeguarding the university’s collective memory and ensuring that knowledge remains confidential, accurate, available, and usable for the people and communities the university serves.

REFERENCES

Coles-Kemp, L., & Overill, R. E. (2006). The Information Security Ownership Question in ISO/IEC 27001 — an implementation. Australasian Journal of Paramedicine. https://doi.org/10.4225/75/57b656ae34767

CSF Tools. (2024, March 1). Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving — CSF Tools. CSF Tools — the Cybersecurity Framework for Humans. https://csf.tools/reference/nist-cybersecurity-framework/v2-0/gv/gv-rr/gv-rr-01/

Cybersecurity and Infrastructure Security Agency (CISA). (2023). #StopRansomware guide. U.S. Department of Homeland Security. https://www.cisa.gov/stopransomware/ransomware-guide

ISO/IEC 27001 Control 5.12: Classification of information — Evolveum Docs. (n.d.). https://docs.evolveum.com/midpoint/compliance/iso27001/5.12/

NIST cybersecurity framework 2.0: (2024). https://doi.org/10.6028/nist.sp.1299