In 2018, a surprise visit from Vice President Mike Pence put Oral Roberts University's IT security under a powerful microscope. But the Secret Service was so impressed, they commended the school.
“When the secret service compliments you, it makes everybody feel good, right?” says Mike Mathews, VP of Innovation and Technology at the university. “But all it would take is one newspaper report about a data violation at the school, and we'd lose everything. Credibility can be lost very quickly.”
To stay vigilant, Mathews would like to move the majority of ORU's IT services to cloud-based vendors. That would shift security pressures from the university to service providers with expertise in security.
“It's just a natural migration,” he says. “Five years ago, when I started, we were probably 30 percent cloud-based services. Now, we're nearing 75 percent.”
EdSurge caught up with Mathews to ask about best-practices in data security. He shared his take on why the cloud is more secure than on-premise deployments, how to choose vendors wisely, and tips for IT leaders seeking to improve data security in higher ed settings.
EdSurge: What do schools stand to gain by moving IT systems to the cloud?
Mike Mathews: Number one is security. Ransomware threats are increasing, and if we end up in the newspaper, it hurts the image of the university. It hurts the image of the IT staff. But very few universities or colleges can afford the amount of security required to keep data secure. How can we logically or even feasibly staff correctly for every system on the campus? It’s becoming impossible in today's world. But with a cloud-based service, their data centers are secure because security is their bread and butter.
Number two is, in a city like Tulsa, the power might go out three times a year. But I don't worry about any service I have in the cloud, because redundancy, or data backup, is built-in. This is also a relief to the IT staff who already work very hard. The last thing you want to do as a leader is wear people out on something preventable like having to come in on Saturdays to reboot systems because of power outages. Even though we have back-up systems for the outages, it is still a concern.
Then third is consistent performance for the end-user. You don't want students panicking that they have to be on campus to access the learning management system or their grades. We want students to have the same experience at Starbucks or at home as on campus. Cloud is the number one way to get there.
Isn't moving to the cloud expensive?
At the offset, the cloud looks more expensive. But, if you consider the total cost of ownership for the sustainability and security of your systems, moving to the cloud makes that effort more affordable.
I'll give you an example. One of our systems has been in the cloud for over 15 years. I don't have to worry about that system. I don't have to hire resources to support it, plan for server upgrades, or even budget for a room to house that system on campus. None of those costs apply when it's in the cloud.
We are one of the most aggressive universities, for our size, in technology, but we're one of the lowest spenders on tech at the same time. That's because we're aligned with vendors. We want the vendors to do what they do well, which is security. And we'll do what we do well, which is focusing our IT talent pool on integrating all our systems.
What steps should IT leaders take to ensure they choose the right cloud vendors?
It's tough. You have to be a bloodhound to get the information you need to protect your data and your image. Ask pointed questions, such as: How many of your clients are 100 percent in the cloud with your product? How many failures have you had? I tell them, “Be honest with me because I'm going to find out.” And if they are not honest with me, I won't do business with them.
Legal and financial teams need to do their homework too: How many violations has a vendor had? How many break-ins? What's their financial standing?
You even need your executive team looking into providers from their perspective. We work heavily with Ellucian and, when our executives meet with other school leaders, they are asking, “What do you know about the Banner system? What do you think of Ellucian?”
If schools offload data security, what will IT teams do?
Address bigger education issues like student engagement. Every minute that I save faculty is one more minute of student engagement they potentially have. It's proven— the Wall Street Journal/Times Higher Education College Rankings just announced three weeks ago that ORU was ranked number four in the nation in student engagement.
Also, there's room for innovation. We have won 10 innovation awards in the last two years, and the president loves this because our donations come from that credibility. By offloading IT services to cloud providers, we're not focused on the technology; we're focused on building buildings and growing the university. We have 11 consecutive years of growth now and we just completed over $28.5 million of campus improvements this summer with no debt on those improvements.
We only spend three percent of revenue on technology. That's possible because we work with vendors and make sure employees are focused on the highest priorities, not fiddling around with aspects of systems we do not need to.
Why do you want to move all of your IT services to the cloud?
When we get the majority of our IT services in the cloud, IT will become a utility that we don’t have to worry about, like water or electricity, and then we get to reposition our staff and resources towards innovation for the future.
