WhitepaperRansomware Readiness: A Field Playbook for East African Enterprises
The decisions that determine whether a ransomware event is a bad week or an existential one — and which of them have to be made before the encryption starts.
Cybersecurity for
Universities and Colleges
Networks designed to be open, populated by tens of thousands of unmanaged devices, holding student records and research data — secured without turning the campus into an enterprise.
Higher Education
What Security Means
In Higher Education
Open campuses, closed systems.
A university is the hardest kind of environment to secure well, because openness is not a weakness to be eliminated but a requirement of the institution. Students bring their own devices, researchers need unusual software and external collaboration, departments run their own systems, and the network has to accommodate all of it.
Attempting to apply an enterprise security model to that produces either a programme that is ignored or an institution that cannot do its work. The approach that succeeds accepts an open access layer and concentrates control where it matters: student records, finance, research data and identity infrastructure, each separated from the open network and from each other.
Our higher-education work starts with identity, because consolidating authentication is the single change that makes everything else possible, and ends with the two places institutions are actually losing: ransomware against administrative systems, and credential phishing aimed at student finance.
Threat Picture
Where Higher Education
Actually Gets Hit
Ransomware against administrative systems
Student records, finance and human resources are the systems whose loss stops the institution — admissions, registration, payroll and examinations all depend on them. They are also the systems most often on the same flat network as a teaching lab.
Credential phishing and financial-aid fraud
Student portal credentials are targeted for direct financial gain: changing disbursement details, redirecting refunds, or reselling access. Campaigns are timed to registration and disbursement periods and are highly convincing.
Research data and intellectual property
Funded research, pre-publication results and collaboration data attract both commercial and state-aligned interest, and are frequently held on departmental infrastructure outside central IT’s visibility.
Unmanaged devices on open networks
Tens of thousands of devices you do not administer connect every term. The realistic posture is not controlling them but ensuring they reach nothing of consequence from where they sit.
Departmental shadow infrastructure
Faculty-run servers, lab systems and legacy project sites accumulate for decades, often unpatched, sometimes internet-exposed, usually without a current owner. Discovery is the first and most productive piece of work.
Fragmented identity
Separate credentials across portal, email, library, learning platform and departmental systems make multi-factor authentication unenforceable, de-provisioning unreliable and compromise detection close to impossible.
How We Engage
Built Around
Your Constraints
The sequence below is what a higher education engagement looks like in practice — shaped by what your environment can and cannot tolerate.
Talk to our Higher Education team01
Discover what is actually connected
External attack-surface mapping plus internal discovery finds the departmental and legacy systems nobody has an inventory for. Institutions are consistently surprised by this stage, and it reprioritises everything after it.
02
Consolidate identity, then enforce
Bringing systems behind single sign-on makes multi-factor authentication, conditional access, de-provisioning and compromise detection achievable at once. It is the highest-leverage project available to most institutions.
03
Separate the administrative core
Student records, finance and identity infrastructure move behind their own boundary with their own administrative credentials, so an open access network stays open without being a path to the registry.
04
Awareness that fits the calendar
Targeted campaigns timed to registration and disbursement windows, aimed at the specific phishing patterns your institution actually receives, rather than a generic annual module nobody completes.
Obligations
What You Are
Held To
Each of these is a published instrument you can read. We map findings to them directly, so an assessment feeds your audit and supervisory cycle instead of sitting beside it.
- Data Protection Act, 2019
- Student records, staff records and research data involving human subjects all fall within scope, with the full set of data subject rights and the seventy-two-hour breach notification duty.
- Commission for University Education requirements
- Institutional governance and records obligations under the CUE framework intersect with information security, particularly around the integrity and availability of academic records.
- Research funder and collaboration agreements
- Grant conditions and data-sharing agreements frequently impose specific security controls on research data — often stricter than institutional baselines, and rarely tracked centrally.
- NIST Cybersecurity Framework 2.0
- A practical structure for an institution-wide programme, and one that maps comfortably onto a federated environment where central IT does not control every system.
Services
Where We Start
In Higher Education
Research
Reading For
Higher Education Teams
Whitepaper
WhitepaperThe Kenya Data Protection Act: An Engineering Checklist
What the Data Protection Act, 2019 actually asks engineering and security teams to build — translated out of legal language and into controls, logs and retention rules.
Research ReportThreat Modelling Autonomous AI Agents
A practical threat model for systems where a language model can take actions — tool access, prompt injection, credential scope, and the audit trail you will wish you had.
Questions
What Higher Education Clients
Ask First
You generally do not. You design on the assumption that the access network is hostile — segmenting it away from anything of value, requiring authentication at each service rather than trusting the network, and monitoring for compromise rather than attempting to prevent it on the endpoint.
Yes, with a federated model: central identity and central monitoring as non-negotiables, a published baseline departments are accountable to, and central IT providing the discovery and the support that makes compliance easier than avoidance.
Discovery, then identity consolidation with multi-factor authentication, then an immutable backup of the administrative core with a tested restore. Those three change the outcome of the incidents institutions actually experience.
Other Sectors