Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Anthony Newman on cyberthreats to higher education
Guest:
Anthony Newman
Published:
Updated:
Duration:
40 min
Episode summary
In this episode of WE’RE IN!, Anthony Newman, executive director at Research and Education Networks Information Sharing and Analysis Center (REN-ISAC), highlights the need for protecting research infrastructure in higher education, dealing with credential dumps and monitoring the dark web for potential threats. He also discusses the challenges faced in higher education, such as securing a diverse range of resources, navigating risks posed by a litany of third-party vendors and recovering quickly from breaches.
Anthony also digs into the impact of AI in the cybersecurity landscape, emphasizing the need for trust and the potential benefits of automation.
Listen to hear more about:
How REN-ISAC supports its 700 member institutions within the higher education and research community
The role of trust and threat intelligence in higher education
The nature of advanced, persistent threats to research facilities, including China-linked cyberespionage
Listen to the episode
S3 E6 · Anthony Newman on cyberthreats to higher educationWE'RE IN! Podcast · 40 min
Key takeaways
Assume attackers are already inside Purdue designed its security around the idea that threat actors were probably already on the network, focusing on segmentation and fast recovery. With over a million identities a year, Anthony compares the environment to a Fortune 500 company.
Shadow purchases undermine university controls Faculty and staff can buy and install software themselves, so IT may not know what is running. Institutions are moving toward stronger policies that hold individuals accountable after ransomware incidents.
AI cloning breaks trusted channels Anthony warns that a few public videos are enough to mimic someone's voice and face, so phone calls and video calls can no longer be treated as proof of identity. Gift card phishing against students shows how this could escalate.
Vendor questionnaires need attestation HECVAT is free and widely used, but it only collects vendor answers without verifying them. Anthony sees it as a starting point that needs a next phase where vendors attest to their answers.
Trust is what ISACs offer REN-ISAC vets every new member with its community before sharing indicators of compromise and dark web findings. Its daily watch report is its most popular service.
Topics covered
Attack Surface Management
Zero Trust
Notable quotes
…we adopted, well before my time, the idea that we probably had threat actors already on on the network or in the environment.
It looks and sounds like me, but it's not me. And that's what was in the movies ten years ago.
And it's a great starting point. I would say it's not a great finishing point.
But I think that the key for me is is it's not replacing those analyst jobs.
Questions this episode answers
How do you secure a large research university network?
Anthony said Purdue assumed attackers were already in the environment and focused on segmentation to limit impact and on recovering quickly. Where open and protected resources cannot be separated, segmentation and stepped-up authentication are needed. Read this section
Are universities targeted by nation-state hackers?
Anthony said he was shocked by how often Purdue's perimeter was hit by APTs, with traffic from IP ranges in countries of concern. Classified research at most universities still runs in isolated enclaves without internet connections. Read this section
What is HECVAT?
The Higher Education Community Vendor Assessment Tool is a free questionnaire that institutions send to vendors, created with partners including Internet2 and EDUCAUSE. Anthony said it is a good starting point but does not verify whether answers are truthful. Read this section
How does an ISAC get and share threat intelligence?
REN-ISAC is part of the National Council of ISACs and combines feeds from other ISACs, government groups, open source, and paid sources. Its analysts pick the best source for each threat and publish a daily report for members. Read this section
How does AI change social engineering risk for universities?
Students already fell for emails impersonating faculty asking for gift cards. Anthony said public faculty videos make it simple to clone voices and faces, so attackers could follow up with convincing calls. Read this section
About the guest
Anthony Newman was appointed executive director of the Research and Education Networks Information Sharing and Analysis Center (REN-ISAC) in 2023 and, at the time of recording, led the organization, which is hosted at Indiana University. He previously served as chief information security officer at Purdue University, where he oversaw security for a large research network. He has worked in IT for about twenty years.
And welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer. And today, I'll be joined by Anthony Newman, executive director of the Research and Education Network's information sharing and analysis center. The REN-ISAC helps hundreds of global educational institutions worldwide stay ahead of the latest cyber threats by promoting best practices and sharing threat intel. Anthony previously served as chief information security officer at Purdue University in Indiana, where he oversaw the defense of a vastly complex network that spans tens of thousands of students, researchers, workers, and visitors. We'll hear from Anthony in a moment, but first, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
Anthony, it's so great to have you on the show. So last summer, you were appointed executive director, the Research and Education Network's information sharing and analysis center.
My role is really focused on leading the organization. So if you think of like a CEO, it's it's a lot of that. So it's fiscal responsibility, managing staff, making sure our services are kind of what our our members expect, And, you know, growing the membership or customer base, while also, you know, providing kind of best of breed services. That's, that's a lot of what the role consists of today. And so those services all revolve around the establishment of a trust community, performing some threat intelligence. We also serve as a CSIRT. And so because of that, we do a lot around credential dumps and and kind of monitoring dark web for those types of things, both for members and non members. So, yeah, a lot of it's mostly around the threat intelligence component. That's what I think in the last five years or so out of the twenty that we've been around, we've been doing a lot more of that.
And so the the REN-ISAC, you referenced the members, I I guess these institutions can be found across Five Eyes nations. What sort of security challenges? What constitutes a typical member and what sort of security challenges do they face?
So it's interesting. It is, you know, it's higher ed and research focused, again, across five eyes. We have considered expanding that recently. So that was something that that I proposed when I came in. I said, look, CISA is able to work with even foreign nations that are, you know, and sometimes, in some cases, not ones that we would typically work with. So if they can do it, we could probably figure out a way to do it as well. So we are exploring that. But but our our members range from really small education institutions, community colleges, all the way up to the largest research institutions that, you know, the world looks to for Department of Defense research, things like that, not only for The US, but for for other countries. And so it's it's that gamut of of really small to large.
And you have, as I understand it, a background yourself at a a large research institution. Can you tell me a little bit about your role as chief information security officer prior to joining the REN-ISAC?
Sure. Yeah. So I was I was CISO for Purdue University. They're an r one institution in Indiana. They, you know, primarily are I shouldn't say primarily people at Purdue would would hurt me. But but they're an engineering school, first and foremost, they they are a land grant university. They do a lot in the ag space, and they have some other great colleges. But you know, from a outside research perspective, and even from a thing, you know, a patent perspective, I think 70 plus percent of their patents are in the engineering world. And so they're really heavy into that space. They're growing in the secured research area. So you think about like classified research, they're growing pretty strongly in that area, even since I left. And just recently, they hired a former FBI agent to run their research security. So they are heavy in that space. And a lot of my job was protecting all of that infrastructure.
How do you go about securing an r one research institution SATA? That sounds like it encompasses quite a lot, whether ag, engineering, security sensitive, sounds like classified research even. That's a lot.
Yeah, it is. It's really difficult, and I'd say that we adopted, well before my time, the idea that we probably had threat actors already on on the network or in the environment. And that's a pretty common focus in those types of institutions. So it was more around recoverability, segmentation. So if there was any sort of breach or compromise, really limiting the the space in which it could have a negative impact, and then being able to recover quickly. As you know, universities are are not just research. They're not just education. They're they're also kind of a public private partner. And so you get a lot of non student, non staff, non faculty people that all of a sudden need accounts. And so you take a school like Purdue, you will have a million identities plus people logging in, logging out of various resources in any given year.
And so that's very complex. It I always compared it to, you know, a fortune 500 companies. So you take a company like GE, and you compare it and it's it's there's some pretty, pretty easy comparisons to make both from a revenue standpoint and from a staffing and needs perspective.
That makes a lot of sense. And honestly, I've I've heard that a lot of organizations say, you know, bring your own device policies can be quite challenging to work around and and still secure your networks. And I would imagine that higher education institutions can bring your own device mothership. Right? Everybody's everybody's got their got their own devices. There's no centralized... To those million people that you just referenced, nobody's sending them out corporate issue laptops there for Purdue. How can you improve organizational security while still navigating that and continuing to use devices?
Yeah. I mean, it's exactly what you said. So a school like Purdue, I think I use in a similar boat, a lot of those large r one institutions where you have a heavy on campus presence. You know, students, especially those first, second year students, they're bringing Xboxes, iPads, laptops all to school and expecting to not just perform their studies, but also live and play and communicate with friends and family. So, you know, the the biggest focus that that works for us, and I think works for most institutions, is ideally a line in the sand of protected resources versus kind of open, you know, network availability or direct Internet access, if that's possible. When that's not possible, and and in some institutions it's not, then that's where segmentation and then a strong authentication practice comes into play.
So the idea that as you escalate into various resources, you might require additional forms of authentication to access those. That's a bit more complicated. But in infrastructures where it's all kind of tied together, and you can't isolate or you can't segment, that's what's necessary to protect it. And then again, recoverability, that's what the name of the game is, especially with ransomware. That's the only way to move forward today.
Right, right. And I remember the ransomware threat is particularly acute these days, it seems like, from both a healthcare and lately a medical perspective. I remember last year, I think the National Student Clearing House reported that some 900 colleges and universities were affected by the MOVEit, the infamous MOVEit software zero day vulnerability that just absolutely hammered, I mean, thousands of organizations writ large, but especially the education sector. What do you remember from those days? How did... Were you were you at Purdue when that played out? Was that was that a challenge?
I was, and, I was. I mean, you think about, you know, the difference between higher ed and and corporate is corporate, in most cases, the company buys and controls the environment. And higher ed, especially if you take an institution as old as Purdue, it's not that way. It's moving towards that direction, but it's definitely not that way today. And so you have software installed that IT may not know about. Even in a tightly controlled environment where procurement prevents unauthorized kind of purchase ins from moving forward, all it takes is is a faculty member or a staff member saying, well, I make a decent amount of money. I'm just gonna go pay for this myself because my team needs it. And I have installed permissions, and then it's it's game over. And so, yeah, those are very challenging. What we're seeing in industry today is a lot stronger policies, a lot more push towards faculty and staff taking ownership if there is a ransomware attack.
So for instance, if if it's, you know, tracked back to an individual who did something they shouldn't have done up to and including being fired, terminated, and and possible lawsuits. I mean, I I think I think all those are on the radar now today with with higher ed. Race aware is is probably the the largest air... Area that we're seeing from an attack perspective, all still coming through the same mechanisms we've seen for the last ten years, though. So we're still seeing phishing being an entry point, broad admin access, being able to kind of pivot from that initial email to installing and taking it, you know, control of something.
Yeah. That... And it does... You know, based on the headlines, ransomware is everywhere, of course, but probably can't forget about some of the more advanced persistent nation state level threats that also have put some education sector institutions under scrutiny, particularly when you mentioned earlier some of the more government funded research, some of the more sensitive data that maybe is... Can be collected and processed in a university setting. How do you go about countering suspected state sponsored cyber espionage in a university context?
Sure. Yeah. So that was probably the biggest shock to me when I moved into the CISO role at Purdue, was how often our perimeter was being hit by APTs and what we perceived. We didn't do a lot of attribution because we didn't have a lot of time. We definitely saw the IPs... IP ranges matching to some of those countries that were of particular threat. So it's a it's a mix of, you know, understanding the threats there, reporting that up the chain. So to making, you know, in our case, making sure that the president, the board of trustees, and the CIO are all aware. When it moves beyond that, you know... So interesting component for for Purdue University particular. Don't think you mentioned, you know, China, the country itself, but but the president is... Was born in China. And so it it has an, you know, an additional threat. And then you add the type of research.
So if you, you know, Google CHIPS Act, and you see the schools involved in the CHIPS Act, Purdue is one of the top schools involved in that. And so you look at what what's happening with AI and and, you know, the future of technology, Purdue's at the forefront of that. And so foreign adversaries want to get their hands on any research that they can. I will say from a classified perspective, as it stands today at most universities, I won't speak for anything specific. Most universities in a classified environment still operate in an enclave type mentality. So those systems do not kind of touch the internet, have any direct connection. And so any type of attack that they would have to see, they would actually have to see a kind of a local type of attack. They... It wouldn't be it wouldn't be coming through a phishing example. And so we can rest assured that most of our nation's tough research is is still pretty well protected.
Obviously, as things change and progress, there will be an... I'm positive there will be a desire to have access to those resources wherever you are, and and that just adds additional threat.
Yeah. And I I wanted to circle back to something you mentioned, the chips and science act. What is the significance of that visa v the threat for listeners who might not be familiar with some of the work that these research institutions are undertaking?
Yeah. So so the majority of it is around, you know, protecting the, I'd say that the entire supply chain, if you look at it that way, of that type of technology. Most people don't realize is what AI so so AI will probably on the topic, that we talk about, but what most people don't realize is, is how impactful the last fifty years of silicon chips essentially has played into that. And and, you know, what used to be a video card maker NVIDIA, how closely tied they are now to the future state of AI. It goes back and forth, but but a lot of the new technologies we see in the world actually come from researchers that have, you know, tested, designed, tested, designed, failed, tested, and then ultimately, they hit a success, and then they release it.
It's waned a little bit in the last probably thirty years where we see more private industry doing, you know, some of that, but but researchers are still heavily invested in and the chips and science acts really is around protecting that. In fact, they actually... NSF had a... As part of that, a proposal or solicitation rather, to figure out a way to secure or protect research security in ways that, you know, probably requires some federal funding. And so that just went through in the fall. I think they only just talked to Congress recently about it and were asked about it. And so I expect if not already, an announcement should be coming out of of who will be awarded that. And that will lead to, you know, even further protection of of research security across The US.
And I I looked it up. I realized, of course, with any legislation worth its salt, there has to be a fun acronym, and it's... The CHIPS stands for creative... Creating helpful incentives to produce semiconductors. That's quite the acronym there. And you talk about AI and some of the cutting edge research that's actually being undertaken at these research universities. What's next there? Like, how is that impacting your work both at the ISAC and where you see AI trending in the education sector?
Yeah. So I'll just say I'm glad I'm not a CISO right now. Because my job is really, I'd say when there are incidents, you know, we we work at at them at a different level than maybe a school or institute, you know, research institution would. AI is amazing. I think, you know, I've I've kids, and I've talked to them often about how amazing it is, but how, you know, that's why I don't let them have social media. And that's why, you know, even if I were to have a video or a picture, I wouldn't, you know, I'd blur out their images, because it's, it's, it's very, very big risk that is not, you know, going away and means at all. So you think about, you know, today, we might have two factor solutions. In fact, I just talked to an executive at a school recently, this was just a few days ago. And it was a quick conversation. It was someone I knew, I texted them said, Hey, I want to run something past you.
And they texted back, they called later in the evening. That could have easily... All of all of that conversation because it was probably a thirty second conversation. You know, I've... I have a handful of videos out there of me that are probably public. With... Just with that information and and how I talk in my tone, anybody to be fooled into thinking that they were on the phone with me. Add to that, you know, spoofing a cell phone is pretty simple. Even with all of the the security pack... Practices, you know, then you start thinking about, you know, two factor and how that works. Well, two factor is great. But if two if two factor isn't there, or if it's something that we trust, like a phone call, or a FaceTime video, that, you know, many of us that have iPhones think, well, that's secure. But even that could be mimicked in a way where you're using AI.
It looks and sounds like me, but it's not me. And that's what was in the movies ten years ago. I think I think those are the things that are concerning. So, you you know, an institution like Purdue, we would have phishing examples where students would get an email, pretending to be a faculty member saying this is so and so from this class course that you have to take a chemistry course, virtually every freshman takes a chemistry course, it's a pretty good bet that that person might reach out to a student, you know, that faculty member asking for them to go buy a gift card, and they'll reimburse them in the next time they're in class. And we had students actually do that. And so you take that and you move it forward to now they can have a phone call with with... And faculty members' videos are all over the place publicly. It's... It would be very simple to mimic someone using AI.
And and even even with, you know, some of the weird things that happen in AI like hands and you know, feet movement, you could, you could probably get past that, like even our video today, right, like, had some technical challenges. And so you know, you get past that by just saying there's a problem, I'm going to turn off video and just have audio. So so it's it's very scary.
I was gonna say concerning to me, dear listener, Anthony is off video, and now I'm second guessing whether we're actually talking to an AI rendition of of Anthony Newman or not. But, no, I I I, obviously, it's had a dramatic impact on the potential for the threat landscape to really evolve in some quite significant ways as you laid out. On the flip side, how is AI potentially helping cyber defenders actually parry the next generation of threats?
Yeah. So I think that's what... That's why I, you know, I talk to my kids about the positive side of it. I I think from a threat perspective, you know, when someone might be looking for hashes or things like that, all of a sudden, now you if you have it in an automated way where you have AI doing that work, you no longer need an analyst to search for those clues, especially if you train it over time. You know, that that AI can actually detect anomalies that that are, you know, somewhat actionable pretty quickly. So you could... I I don't think any technology is really there yet commercially. You know, I think they're they're getting there. But I think that's what is going to be necessary to to move forward in a way where we can trust not only AI, but just technology in general. But I think that the key for me is is it's not replacing those analyst jobs.
It's it's making their jobs a lot simpler, and allowing them to do the the hard work of of thinking and reasoning versus, you know, taking some of those large language model models and, you know, some of the data that it can ingest. You know, to me, that's kind of the the dumb side of AI. But it's been... It does it really, really well. So, yeah, I think I think, you know, we'll we'll see. I think we're still probably a year away. But, you know, then again, I thought the video was going to be a couple years away, and they just put out a release, I think, a week or two ago that was pretty good. So it's moving a lot faster than I think anyone recognizes.
I saw those videos as well. I believe it's... Is it Cora, the the engine that's using those? Or is there some sort of really impressive array of, you know, smooth movement, not the herky jerky stop motion animation style you might expect? It's it's kind of... It's... Yeah. I agree with you. Surprising and incredible what's being done. To to bring it back to the research and education networks, ISAC, you know, how, a, how might this affect some of the services like the computer security incident response team that you alluded to earlier? And, b, kind of pivoting just generally how those are used, how often do REN-ISAC members really engage with these services, and how are they using them now? And I'm I'm referring both to the CISA and to the, for instance, the higher education community vendor assessment tool is another that that the REN-ISAC has available.
A few things. Our our members, regardless of their level, you know, their size, one of the things that we do around the CISA is if we identify that there's been a credential dump or something like that. We're doing a lot of that manually today. And so going kind of back to AI, I think I think, you know, relying on some of that over the next year or two to automate that is something I've tasked my team with. I didn't specifically task them with AI, but I just said, look, we should automate this if we can, because we don't get paid for it. We do it kind of because it's it's what we should do as a a leader in in cyber and and higher ed. But then what we do kind of in addition for our members is if there is a credential dump, many schools will actually want access to that. And we provide that to our members, whereas our non members, we don't. And that's primarily based around the trust.
So, you know, one of the things that we do that most ISACs do, and not everyone likes this, I'm actually one that that's on the fence, I will say, as this approach. We require vetting for anyone who's going to join. So unlike a business that might just sell a service because someone wants to pay, you know, if a school approaches us and they they want access, we will take the the person we work with, which we call management rep, and put it out to our communities. Our community is 760 plus institutions, almost 4,000 members. And and we basically say this person is joining. Are there essentially any grievances that would prevent them from joining? And we've had a few that would prevent someone from joining. But it's all around trust because we do discuss things like indicators of compromise, for instance, or we might share, hey, we see this IP address, you know, hitting our firewall constantly.
And so because of those types of of sharing, we do require vetting. That's also why we don't share, you know, some of what we see maybe on the dark web or, you know, out in in the wild with non members because we don't have that level of trust established. You know, on the HECVAT side, so that's the the vendor assessment tool you mentioned. So we were one of the groups that that helped create it along with Internet2 and Educause. I'm sure there were other partners this as well before my time. And I will say it's a great tool. So it's probably used dozens of times every week. We don't track that closely. What I will say is it's ready for its next kind of wave of development. So you think about any vendor, Synack as an example, you think of any vendor who wants to partner and do work with a higher ed institution. And now higher ed institutions and say, we have this form, go fill it out.
That's the extent of what HECVAT does today. They go fill it out, they submit it, and then it's up to the institution, some person at that institution to read through it and confirm, you know, hey, I've added everything they answered and they answered, you know, everything. What we don't know is did they answer everything truthfully? And that's where I say it's really ready for the next wave of of are they actually attesting to anything that could be, you know, where they could be held liable if something bad happens.
Yeah. I guess SolarWinds is actually a prime example of of that where you see a third party vendor having some issues. I think there were... Now we found out since then other, you know, potential challenges the company had. But, you know, ultimately, had SolarWinds filled something like that out, and they didn't talk about any of the the downstream partners that they might have, you know, been using, you know, the question is, well, what value does that have? And so heck that I think is ready for this next wave. We've had some conversations with Internet too. And educause will still host it for free. So it is a free and open source tool available to anyone, whether you're a member or not, you can go to our website and get it. And it's a great starting point. I would say it's not a great finishing point. So I would I would love to see a company come along and and take that further. The problem is it's not easily monetizable.
That's I mean, that's the main challenge. It's very difficult to come up with a way to to make money from it. But it's a great tool. And it helps especially smaller institutions make a lot of progress where maybe they only have one or two security staff or even less, they have IT who are not dedicated security, who have to, you know, identify, can we trust this company? You know, I've been in it twenty years, twenty years ago, when I would pay a company to do something. And that time, it was me recommending to my boss to pay a company to do something. No one trusted. No one asked about trust, like, can we trust this company? It was like, hey, they'll provide a good product, and we should buy this. No one really considered, you know, by installing this, are there any bath doors that we're installing that we just don't even know, because none of us are skilled or talented enough in the space to know what that looks like today.
Yeah. And the the trust piece also plays into a point you mentioned earlier of, like, vetting the members that are even gonna be a part of the ISAC and getting and discussing potentially sensitive security related information. You know, one one sort of philosophical point about these information sharing and analysis centers, I sometimes joke you almost need, like, an ISAC for ISACs because there are quite a few for various sectors, but how do you get the information? Maybe there's a pertinent threat facing the education sector that crops up in, like, the financial services sector or, you know, or the electricity sector. How do you go about fitting into that broader ecosystem of of security sharing? How do you as an ISAC do that? Like, what sort of threat feeds can you get? Can you... Are you in communication with other ISACs? You go through the federal Yeah. Government for some of that? Is it like... It just strikes me as a... It's such a difficult thing to tease out when everybody rightfully, arguably, wants to keep some of this threat information pretty close to their chest.
Yeah. So that's a great point. I'm glad you brought that up. It was something I I had hoped we would get to. So so, yeah, to to answer the first part of the question, yes, we we partner with everyone you mentioned. We are part of the National Council of ISACs. And so I think the majority of the ISACs are part of that, if not all. We meet regularly. We also go to Capitol Hill as a group to encourage Congress and and other folks to to support us. Today, WREN does not receive any federal federal funding, but other ISACs do. And so some of them actually sit under under DOD or CISA. And so we have various feeds from from all of those groups, as well as some open source that anyone could go and get, as well as some some paid threat feeds. And then what our analysts do today is is...
So there's a lot of crossover, obviously, between all of those. And so you might see the same kind of threat from multiple. You might also see articles, you know, like dark reading or or websites like that. Our our analysts will actually scour the web for each one of those and identify the best source. And we provide those into like a daily report to our members. That's probably our most sought after surface, which is interesting to me because it's a lot of busy work. But it's it's also, like, really good. And so you think 3,500 members, we provide really great services and other categories that automate, you know, things that firewalls can do from blocking various, you know, you know, potential threats. It's like, yeah, it's great. We have a very small percentage of schools take advantage of that. But our daily watch, everyone loves. It's almost like the the TLDR. Like, it's it's... It just saves a lot of time. And it gives you a snapshot of here's what you need to worry about today.
As far as, you know, our our trust and and how we how we handle all of that, today, I would say we're absolutely critical infrastructure. Twenty years ago, there was a question whether education should be. And I think that our trust that we've established is by far the the thing that really sets us apart from say, a service. Yeah, there are lots of paid services. For instance, if you know, you're a Cisco shop, you can pay Cisco for their... They have a variety of threat tools, but their their threat analysis assessments, you know, all that, of course, feed into their hardware. And so you could pay for that. You're gonna pay hundreds of thousands of dollars for that. And yes, it automates it. But it's also if you've dealt with any of that, it's very expensive. You have to hire skilled staff and schools can't knowledge can't afford the lights licensing for that, but they can't afford to pay the staff for that.
In our case, our max price today is like, it's less than $3,500 a year. And it gives you that that, you know, threat information, it does require a human to go through it and read it. But that's still far more affordable than than any other kind of for profit service I'm aware of. So to me, that's what sets us apart. You add the ability to ask random questions to 3,500 people. And I think that's a value add as well, especially for people who maybe are younger or getting started. I think it's a great, great area as well.
Just as long as you don't start a a REN-ISAC reply all chain, I feel like that could be... That could get messy fast. I've seen some of those spiral out of control at universities before. But it's interesting you mentioned that that discussion over whether education even is a critical infrastructure. And I know it's been firmly established, and I would just kind of reinforce that from some of my own experience in my past life reporting on some energy and environmental issues. I remember often encountering some of the few places in The US with nuclear... Significant nuclear capabilities, essentially. And I'm not talking about nuclear weapons, but, like, research into nuclear power with, like... Or nuclear medicine with, you know, various highly regulated environments were universities that would come up. And and so that that definitely... It wasn't something that was really on my radar, but then I realized from both the cyber defense and threat perspective, like, oh, yeah.
Yeah, for sure. I think that that's, you know, going back to what we talked about the... That a lot of what we see in the commercial space actually is is generated from higher at first. And so, like, you know, nuclear as as an example is one, but even even things that are just cool. Right? I think Purdue is involved in in one of these, but, you know, couple years ago, there was, like, the, widest paint and the the blackest paint. And so one, you know, absorbs sun energy, one reflects it. And, yeah, there's tons of applications for that. Both, you know, put it on your roof, for instance, and all of a sudden, have a extremely energy efficient roof. But but then you go as kind of to the darker side of that, like Purdue, for instance, has a nuclear reactor on campus, like it's, it's right there and great that they're doing research, but that's a threat. And and it's not in... It's well publicized. In fact, there are websites dedicated to it.
And you just don't... You think about, you know, the energy sector as an example. They don't share a lot of that information, but but research institutes love sharing that information. And many schools today don't have dedicated staff, you know, focusing on that. So there's a lot of crossover between our ISAC and other ISACs. There was the recent... Just very recent. If you if you happen to take any prescriptions, you're probably aware of it. But there was a recent issue with that impacted UnitedHealthcare and lots of pharmacies downstream. We obviously have many of our institutions that have health care centers involved. And so we were aware of that right away. And we're involved in and kind of helping schools navigate that. I I again, we because of what we cross, we we handle a diverse range of of threats that, you know, if you're in the, say, water ISAC or aviation ISAC, you deal with a spectrum.
That makes a lot of sense. And, you know, part of your work, it sounds like as executive director is building some alliances, opening up some of these lines of communication. What can you tell me? What's what's next for you? What's next on the horizon?
A couple things. One, we... We've been around twenty years, and I think it was 2018 REN ISAC started doing what they call peer assessment. So we perform general security assessments for schools, and we use peers. So members of our institution or of our REN ISAC net have been vetted. And we pay them a small stipend for essentially doing a general assessment. You take a school, let's say IU, as an example, you know, they might... If they were to pay an outside party to do a general assessment, they might pay anywhere from $250,000 to say, $500,000 for that general assessment. And primarily, it follows NIST eight hundred one seventy one. So Google NIST eight hundred one seventy one. And ask all the questions of the institution, and you could charge a $500,000. That's pretty much what it is. I've been through them, and that's... They're boring.
They do produce a great report that gives you all the risks, but but they're very boring. But leave all a script. Prior to me, they said, well, we should do this. And and we charge a lot less than that. It's mostly a cost recovery solution, but it helps higher eds. And and when I came, I said we should do more of that. So if you're familiar with CMMC, a lot of schools are going after that. Most schools don't wanna fail that first assessment, where it's somewhat public. And so we're exploring offering a pre assessment. So it'll be kind of an inexpensive tip your toe in in to CMMC world. We'll tell you where we think you would fall if you were to have an outside party assess you. You could fix those before paying that outside, you know, party to come in. We're doing more more pen testing. And that's been growing over the last year and a half or so.
And I think that'll continue to grow as schools recognize the value of that. And we're also talking about physical security. So that's something we haven't done in the past. But it's often what we're asked about when we have kind of open open forums. It goes towards physical security. Will say, I think that will be a niche. So so most r one institutions, as an example, have a local police department that sits on their campus, who also handles their their local security and and physical security. I see a place for that for the the small medium institutions, the r twos and and, you know, that around that same size, when they don't have that same ability. Growing membership. Right now, we have 760 ish members. There are over 4,000 institutions in The US specifically. And so I've tasked the team with growing that. We're trying to get more partnerships as well. So we can keep our costs low.
We did raise our fees to about 3,200 for the largest institution. And so again, that's that's not that much money for those large institutions. For smaller institutions, though, it's very expensive. And so we're looking, you know, to to grow partnerships. It's a lot of that kind of stuff for me, which which is, you know, again, I said earlier, I'm glad I'm not a CISO because my job's pretty easy now compared to what what they have to deal with.
Well, in an issue that you alluded to, which is the difficulty of finding some of the qualified cybersecurity talent to actually accomplish some of these things. Like, for instance, if you if you say you have a higher ed institution, even an r one school that undergoes one of these, like, maturity assessments that you're talking about, and they find just... They just tear it apart. Right? And they say, you've gotta work on x. You've gotta work on y. You've gotta work on z. Does does REN-ISAC kind of like step back there and say good luck or what what happens next? Right?
Yeah. No, that's a good point. Yeah. So so today, we don't do any of the follow-up work. I'd say we're capable of it. And that's something we we could explore. If we did it, we'd probably do it similar to the same peer model. So we probably wouldn't hire staff dedicated to that. We do point them in the direction, though. So for instance, I will say many r ones are already capable of of moving forward with that. It's the r twos. And and I don't wanna say below because that gives the the connotation that they're worse. It's just the the less staffed schools. Right. Community colleges, r twos, and and such. So I think those schools have a harder time. And we do give guidance, we don't do the work. Typically, one thing to note is, you know, you're aware of this, but listeners may not be so REN-ISAC is actually hosted at Indiana University. And so because of that, we abide by Indiana University kind of policy.
We're employees of Indiana University. We get benefits. And so we also have the kind of risk modeling of of Indiana University. So if you think about that, I'm a higher ed employee. And me taking on the potential risk of trying to fix a threat at a school and saying this is fixed, and giving it kind of a sign off my add risk to Indiana University. Oh, I will say
Yeah, that's not been shared to me. But that's my take, which is why I will probably tiptoe very carefully around friend doing that. But we but that's where partners come in, right? I think we have we have lots of partners that would be capable of doing a lot of that work. And and giving guidance more of advisory level guidance is really, I think, what we'd be after.
Of course. And and, you know, when you talk about pursuing, you know, more members among that 4,000 plus pool of potential members, you know, that's not gonna scale either if you nice guy can't swoop in and solve everyone's problems, lovely as that would be. But, yeah, it's it's it's been really great having you on the the show and gleaning some of these insights on the higher ed sector and some of the threats. There is one question that we ask all of our guests that's has to do with your LinkedIn or rather, what's something that we wouldn't know about you just by looking at your LinkedIn profile, Anthony?
Yeah. You know, I I love people. That's probably the the thing is and you can see maybe glean some of that from from LinkedIn. But yeah, I I love getting to know people. I love building relationships with people. I'm pretty easygoing even when I disagree with people. And so I... Yeah, I think that's probably to me, that's what life's all about. So, yeah, that's probably the biggest aspect.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little InfoSec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
We're in is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
