IT professionals across Virginia Tech are pooling their expertise to protect university-owned computers from cyberattacks while reducing the work individual colleges and administrative units must do to meet security requirements.
They are testing and refining a shared set of security settings that IT teams across the university can adopt, drawing on a configuration already in use within Outreach and International Affairs.
Scott Farmer, director of Outreach Information Services, is leading the effort, which brings together staff from the Division of Information Technology’sIT Security Office, and distributed IT teams in colleges and offices across the university.
“We have people across the university working through many of the same challenges,” Farmer said. “If we bring that experience together, we can solve a problem once and give other teams something they can build on.”
The implementation of the minimum security standards was spurred by a 2024 directive from the Board of Visitors requiring every university-owned computer to meet the security standards set by the IT Security Office. Meeting those standards means adopting secure configurations for operating systems and applications, adding security software, and reviewing the effects of these changes, with a goal of maximizing safety while minimizing its encumbrance on daily work. For IT teams spread across the university, that’s often meant working through the same requirements separately.
The collaboration also supports the Division of Information Technology’s emphasis on expanding shared services and reducing duplication while drawing on the expertise of IT professionals in colleges and units.
“Universitywide coordination and buy-in are essential to the success of IT security initiatives like this one. Scott’s role supporting critical business processes gives him a valuable perspective on implementing a common set of security settings that will strengthen our security posture while supporting the university’s operational needs,” said David Raymond, chief information security officer. “His work will help units across campus improve their own security while contributing to a safer, more secure university network.”
Sharing the work and the expertise
The shared configurations cover Windows 11, Microsoft Office, and Microsoft Defender. Through Microsoft Intune, a cloud-based device management system, IT teams can apply and update the settings consistently on the computers they manage.
Broadly testing the solution is important, since a setting that strengthens security can also block specialized software or disrupt a routine task. Collaboration across teams helps identify those conflicts.
“A colleague in another college may catch something we haven’t encountered, or have a better way to handle it,” Farmer said. “That’s why having different teams involved matters. Each of us brings experience that makes the outcomes better.”
Farmer credited colleagues across the university for their counsel, guidance, and technical contributions. Matt Poor helped set up the initial permissions and objects, and Joseph Goodman developed an effective way to deploy a logging client. Scott Shetrone provided code to deploy a user backup agent, Michael Surratt extensively tested the security compliance settings, and Billy Wesley helped configure Windows Update rings.
For faculty and staff, the goal is stronger protection that doesn’t get in their way.
“If we do this right, our faculty and staff won’t even know,” Farmer said. “The settings are applied in the background when the computer connects to the internet.”
Because security requirements and software keep changing, the shared approach also gives IT teams a way to maintain the configurations over time. Updates build on what the group has already tested, so units can keep up without each repeating the entire process.
“Every hour we don’t have to spend solving the same problem separately is time we can put toward the people we support,” Farmer said.
Additional contributors
Jennifer Altman, Dylan Babcock, Chris Bateson, Kevin Bishop, Zeb Bowden, Rick Craig, Jim Dickhans, Doug Edmonds, Rudy Falana II, Peter Franchi, Caeland Garner, Brian Huddleston, Jeffrey Lewis, Charlie Lisanti, Lokesh Lalwani, Warren Lucero, Cody Moler, Shane Mullins, RJ Nagel, Joel Ojugo, Ryan Orren, Jason Price, Joshua Privett, David Riddell, Jeremy Sippel, Blake Smith, Gabe Smith, and Robert Vaughan.
