Cybersecurity tips for librarians
Create a Campaign for Information Security literacy
Refresh your knowledge of your institution’s information security and privacy policies. Research aspects of the policy, if necessary. Take advantage of any training resources available from the Information Security Office.
Connect with your institution’s Chief Information Security Officer or Director of Information Security and build a relationship to discuss ways that the library can participate in improving security and privacy culture on campus.
The library is a hub of learning for the campus community. Engage in teaching moments with students, faculty and staff that expand upon and extend normal password protection and phishing avoidance instruction taught by IT personnel to include responsibility for library resources.
Promote the use of confirmed, legitimate websites for collecting primary sources, including author and publisher sites. Discourage the use of pirate sites as the integrity of content coming from unofficial sources cannot be guaranteed.
Remind colleagues and students of the risks that come when sharing account passwords and campus credentials as they are likely tied to other personal information including HR or student grade information, and may unknowingly enable access well beyond the single system they are trying to share.
Provide clear, easy to understand and operate methods for securely accessing library resources from off campus.
Inform and educate faculty, staff and students on steps they should take if they discover that their credentials have been compromised or given to another individual.
Develop Mature Security Practices
Consult your institution’s IT or Information Security office to recommend scheduling a REN-ISAC Cybersecurity Peer Assessment. Start a conversation about how the library can support and assist with increasing the institution’s information security culture.
Partner with Campus IT or Information Security to promote available reading and videos on information security for self-service use by patrons at your institution. Examples and recommendations can be found on the SNSI Website.
Evaluate the library’s and campus’ requirements against the security capabilities of library-specific systems and applications and develop plans and pacing for timely software updates and patches.
Run and keep up-to-date endpoint protection and/or antimalware software on all library computers, both patron-facing and those that library staff use.
Back up important files and records for recovery in case of ransomware attack or system failure. If a campus-wide backup and recovery solution exists, begin to use it. SNSI recommends a 3-2-1 approach to backup: keep three distinct copies of the data, two of them local but on different mediums, and one additional copy being off-site (including cloud).
When looking into bringing on new electronic resources, make sure they comply with your institution’s security policies.
