Budgeting for CIS Benchmarks Implementation in Higher Education
As FY25 begins to take shape in colleges and universities across the country, there are many competing initiatives to consider. One of those initiatives,comes with a cost of doing it, and a cost of not doing it. And the cost of not doing it is greater, not just monetarily, but in terms of enrollment, donations, research, grants and overall school reputation.
Higher Education is the most targeted industry for cyberattacks around the globe. There are nearly 2,300 attacks a week and that number increases with each passing year. Because of this, Education was ranked as the least secure industry sector, as well as the one with the highest vulnerabilities and lowest readiness to address attacks. Having a strong cyber resiliency plan is no longer something that’s a “nice to have”. It’s imperative.
The cost of implementation vs. the cost of staying the same.
The average cost of a data breach in the education sector is $3.65M. Maybe you have to pay a ransom to get your data back. Maybe you lose research or other data, impacting grants and competitive standing. Maybe there is a loss of business, enrollment or donations as a result. There is likely going to be a significant loss of service and system availability, as well as a loss of trust. And all of that is before the actual costs of restoring your system.
Here’s a rough estimate of how much it would cost to implement CIS Benchmarks, the leading standard for establishing cyber resiliency in Higher Ed. Spoiler alert: It’s significantly less than the cost of a typical data breach. How much it costs your institution depends on a number of factors, such as:
- The size and complexity of your system
- Whether you’ll implement manually or through automation
- And how you’ll maintain your security posture after implementation.
The use of security AI and automation has been proven to not only lower costs, but also reduce the number of days/months it takes to recover from a breach.
What CIS Benchmarks do for Higher Education.
There are many approaches CISOs, CIOs and IT leaders can use to implement and maintain the kind of baseline security it takes to lock systems down against cyberattack. CIS Benchmarks has emerged as the right-sized approach for the education sector, taking into consideration ease and speed of implementation, cost to implement, and effectiveness. In addition, for those hoping to achieve Cybersecurity Maturity Model Certification (CMMC), CIS Benchmarks are a pathway to get you there.
The Center for Internet Security (CIS) is an independent nonprofit that has developed cybersecurity best practices culled from the global IT community. CIS Benchmarks are a roadmap of configuration baselines and best practices you can use in configuring operating systems, middleware, software and network devices to protect them from known vulnerabilities. They are updated regularly, as needed, to address emerging threats. To a large degree, CIS Benchmarks are a need-specific and right-sized version of the Security Technical Implementation Guides (STIGs) currently used to protect our nation’s most sensitive data.
The trouble with tribbles: How to secure configurations cost-effectively.
Like tribbles, CIS Benchmarks are a very good thing. But also like tribbles, the work it takes to execute more than 100 benchmarks can eat time and grow exponentially. Many of these benchmarks are going to turn off functionality in OTS solutions you use every day—functionality hackers use to wheedle their way into your system. And that causes other problems to fix. Before you know it, you have way more tribbles than you have the hands to corral them.
This is a critical juncture in your budgeting. Either you hire a new team of skilled IAs and IT people to implement and manage the ongoing, labor-intensive chore of hardening and continual updating. Or you let automation do the work.
Take the guesswork—and headache—out of cybersecurity.
CIS Benchmarks take the guesswork out of securing your system to recommended standards. And automation takes the headache out. Instead of the months it takes for a team of humans to implement CIS Benchmarks by hand, automation can do it in an hour. It can secure your system and keep your baselines hardened in perpetuity with the team you already have.
SteelCloud’s ConfigOS is a patented automation tool used to implement CIS Benchmarks in the education sector, as well as anywhere else security counts. It scans your system for CIS Benchmark-identified vulnerabilities, then fixes the vulnerability and cleans up any mess it left in its tracks. It literally pays for itself from its first use and not only makes CIS-level security possible in tight budgets, but also eliminates the human error of the long, laborious process of securing your system by hand.
Once you start looking into it, you discover CIS Benchmark implementation is a really big job. But the tools and expertise are available to get you through the process unscathed. If you’d like to talk to SteelCloud about including a CIS Benchmarks automation solution (and ruining the day of some hacker who thought you’d be an easy payout) in 2025’s budget, schedule a meeting and demo with us today.
