From the CIO

October, 2020 CIO Update

Since this month is Cybersecurity Awareness month, I’d like to remind everyone of some easy ways to stay secure. I am also happy to highlight our expansion of Zoom services as VCU continues to operate in a much more virtual way.

Cybersecurity Awareness Month

Since the beginning of the COVID-19 pandemic, many of us have had to significantly alter the way we live; For many of us this new way of living included an increased reliance on technology used for remote learning and working. While most of us were able to adjust and adapt to this new normal, these changes we experienced have also provided scammers and cyber threat actors with new opportunities to alter their tactics and procedures in targeting us.

From disruptions of teleconference meetings to scams pretending to offer COVID-19 relief; to scams targeting individuals for gift card purchases or new variants of malware designed to demand ransom by stealing and holding our data hostage; cyberspace continues to present new risks and challenges to both ourselves and our university. Compounding these threats, the work-from-home practice adopted by many during this pandemic has also rendered some security protections that are traditionally implemented in the university environment less effective.

In order to protect ourselves and our institution against cyber threats during this time, we should observe the following guidance:

• Be aware of suspicious emails that ask whether you are “available” or ask you to click on a link.
• Hover your mouse over a link (or tap and hold the link on a touchscreen device) to reveal the real destination of the link.
• Always check the address bar on your browser to make sure you are at the website you want to be at before entering your username and password.
• Always check the sender’s address on email messages, even if the message appears to be from someone you know.
• Scammers often try to trick their victims into buying gift cards for them; be careful of anyone trying to convince you to buy gift cards.
• Use university assigned computers to complete your work when possible; especially if you are working with sensitive university information.
• Make sure you use an antivirus and patch your computer system as well as software applications on your computer system periodically.
• Report any suspicious activities to infosec@vcu.edu. You can help to save others from becoming a victim of the scammers and you can also be entered into a raffle that can win you exclusive prizes as a Security Hero.

Expanding Zoom at VCU – Unbelievable Timing Plus Teamwork

This past Spring, VCU successfully navigated a transition from in-person to online instruction.  For thousands of users, it was a change as sudden as it was sweeping, but behind the scenes it involved a long, collaborative process and a final, happy coincidence of timing.

VCU first adopted Zoom in 2016 as a software-based alternative to the hardware codecs previously used for  video conferencing.  Over time, it grew in popularity as a desktop conferencing tool for individual users as well, as our user base swelled from 100 to 2000. Realizing this trend would only continue, Academic Technologies opted in late 2019 for an enterprise-level licensing plan where everyone at VCU with a valid eID would be granted an account. Efforts were made to fast-track the change before our limited license plan expired on March 18, 2020, a date that would later take on a significance we could not have imagined at the time. 

Working with TS Web Services, the Zoom admin team within Academic Technologies was able to integrate Zoom’s Single Sign-On feature with VCU’s Central Authentication Service, allowing users automatically obtain a Zoom account just by signing into vcu.zoom.us with their eID and VCU password. This solution not only sped up the account creation process for users, who no longer had to enter help tickets to request Zoom; it also eliminated the labor intensive-tasks required for AT staff to manually create accounts. Preparations continued as we worked with the vendor to create a new “HIPAA” sub-account for users in health-related schools and disciplines, which in turn allowed us to enable Cloud Recording for all users in departments not subject to  HIPAA regulations.

By early March, it had become painfully obvious that the campus (and the nation) would soon be shut down in response to COVID-19.  Requests for Zoom accounts began flooding in as desktop conferencing changed overnight from a specialized tool for a subset of early adopters to a basic necessity for thousands thrown into the “new normal” of telework and remote learning.  We negotiated and received 700 temporary free licenses from Zoom to help us meet demand, and over the next one and a half weeks manually created over 900 new user accounts before the enterprise license took effect. On March 16, VCU began its first full week on a “telework” plan, extending Spring Break to prepare for the move to virtual instruction.  At 3:00am on March 18, we made the leap to “Enterprise”, giving us access to a pool of 30,000 licenses, literally in the nick of time. Around 5 am the same day, Web Services made the planned changes to the Shibboleth configuration that would now grant immediate access to active faculty, staff, students and affiliates and sort them based on their MBU or declared major into the appropriate Zoom account level.

After upgrading existing “basic” level users to “licensed” status under the new plan, work continued to ensure our users had the resources and functionality they needed.

• The Zoom askIT page was overhauled to include many more resources (i.e. FAQs, links to training videos, how-to’s, announcements, alerts).
• A Zoom/Kaltura integration was established so that any recordings made to Zoom Cloud would send a duplicate, back-up copy to VCU Kaltura. Zoom Cloud storage is limited and set to auto-delete after 60 days, so the Kaltura-hosted versions serve as the permanent links. 
• Cloud recording was enabled for all non-HIPAA users, making it possible to record video conferences in many classrooms where this was previously not possible.
• Information was rapidly distributed to the campus about the new license plan, available resources, and most importantly, that support request tickets were no longer required to gain access to Zoom. This relieved our Zoom administrators who were drowning in tickets. 
• The ISO created a Best Practices guide for securing Zoom meetings against “Zoombombing”, etc.  
• The VCU Zoom administrators scheduled and delivered numerous Zoom training sessions and webinars to share best practices for scheduling and conducting meetings, applying security settings, etc.
• A Zoom blog was created to share real-time announcements, alerts and tips.
• In centrally supported classrooms, computer images were updated and deployed with the latest version of Zoom. Video equipment was assessed and deemed as Zoom-ready as possible, including some creative leveraging of document cameras in those rooms that did not have cameras installed. By the start of the Fall 2020 semester, software-based conferencing was available in all but a handful of classrooms on each campus.

This endeavor was successful due to the combined efforts of:

• TS Academic Technologies – MSS Video Production & Teleconferencing, Labs & Classrooms Computing, MSS Classroom Support, Learning Systems, Project & Communications Coordinator
• TS Application Services – Web Services
• TS Central Services – Fiscal and Administrative Services
• TS Information Security
• TS – Technology Support Services: IT Support Center
• IT personnel from various schools and departments across campus

Ensuring Zoom is regularly updated, constantly functioning, secure and integrated with related resources is an ongoing effort, with a lot of teamwork involved.  This is a great example of TS and the University coming together to meet the needs of everyone at VCU.

As we continue to operate in COVID conditions and plan for the Spring semester, I am thankful for everyone’s extraordinary work to help the entire VCU community to continue our mission.

Alex