Several security enhancements have been made through the Fortify program this year:

• Successful implementation of multi factor authentication (MFA) for the student systems iLearn, eStudent and ApplicantPortal, providing enhanced system and data security for more than 60,000 active users.
• Automated software updates, bolstering browser and critical application security for approximately 6000 staff computers at the University and Hospital.
• Activation of Microsoft’s Company Portal application, providing a safe way for staff to download commonly used software.
• Encryption of staff laptops, ensuring data is protected in the case of loss or theft.
• Regulation of Office application macros to minimise malware attack risks.

Upcoming changes

Wave three of Fortify will include further important changes to enhance our digital security:

PC (Windows) users

• User access to PCs will be limited to standard functions. Higher privilege access to install or run software will be provided through various new tools. This transition is scheduled to occur between January and March 2024. PC users can use the Company Portal application to download a wide range of software.
• Privilege management software will automatically detect if certain tasks require additional permissions to run. It will handle these situations appropriately after verifying the staff member’s identity.

Multi factor authentication

• From 11 December 2023, students will be required to use multi factor authentication (MFA) to access Microsoft 365 applications.
• From 13 December 2023, both students and staff will be required to use multi factor authentication (MFA) to access ServiceNow (OneHelp).

Information about multi factor authentication can be found on the staff portal (and the staff intranet from 5 December).

The improvements are part of the Timetabling, Scheduling and Exams Upgrade project, which involves the upgrade of the University’s scheduling and exam timetabling products to SaaS (including the introduction of the new Resource Booker system).

What’s changing?

The Resource Booker upgrade will simplify room information and bookings for staff, with a mobile-friendly interface and the ability to sync bookings to external calendars such as Outlook and iCal.

Staff will be able to use a single system to check availabilities and request and manage their bookings using Resource Booker’s improved functionality and intuitive design. From January 2024, all room bookings should be made using Resource Booker. All existing bookings for 2024 will be automatically transferred to the new system.

How can I access the new Resource Booker system?

A link to Resource Booker will become available on the new staff intranet in January 2024 and will be shared with staff at this time.

Existing browser bookmarks to the old Web Room Booking link should be updated, or staff may wish to add Resource Booker to their personalised intranet homepage quick links.

How can I learn to use the new system? 

A webinar explaining the features of Resource Booker will be held from 11.30am to 12.30pm on Wednesday 15 November. Registration is not required – simply join the following Zoom meeting link on the day: https://macquarie.zoom.us/s/83350042485

A user guide for the new system is also available here: Resource Booker User Guide

Questions?

Contact Louise Goddard (louise.goddard@mq.edu.au) or Saima Siddiqui (saima.siddiqui@mq.edu.au).

The Fortify program will implement cybersecurity controls on staff laptops and workstations in three waves over the coming months:

Wave one: Software update automation
Wave two: Secure Microsoft Office macro use
Wave three: Centralised software installation and mgmt.

Our goal is to implement these updates with minimal disruption; however, some staff might observe slight modifications to their systems. We appreciate your support and understanding as we work together to bolster our cybersecurity defences, ensuring the continued safety and integrity of our digital environment.

Upcoming change: Software update automation will enable automatic updates for operating systems and crucial desktop applications such as Office suite, web browsers, email clients and PDF viewers on University-managed laptops and workstations running Windows.

Timeline: Starting June 2023

Impacts for staff:

• Patch updates will be performed automatically and seamlessly in the background, requiring no user intervention.
• System restart alerts may be received occasionally.
• You will occasionally receive prompts to re-login to your Windows account and office apps using your staff email, password and MFA code from your phone’s authenticator app.

More detailed communications will be sent to those directly impacted, outlining specific changes and providing clear instructions as needed. We welcome and encourage questions during this process: If you have any questions, concerns or feedback, you can reach the project team through the dedicated OneHelp form .

We appreciate your support and understanding as we work together to bolster our cybersecurity defences, ensuring the continued safety and integrity of our digital campus.

The shift, part of the University’s ongoing program of work to protect Macquarie from cyber threats, will provide staff and students with a higher level of protection from account compromise.

The University is communicating this change to students. Students are being encouraged to set up their MFA by visiting this webpage.

Staff seeking more information or assistance with MFA can visit the FAQs here.

Data breaches experienced last year by large Australian organisations exposed the personal details of millions of Australians, releasing identification details into the cyber-fraud community and allowing fraudsters to construct elaborate scams.

While University systems block a large number of scams, many are also delivered through phone calls, text messages and social media. Protect yourself and Macquarie from scams by remembering these steps:

1. Stop before responding to a request for information or an urgent alert.
2. Check the request is genuine through a trusted channel.
3. Report and block scams sent to you on social media. Forward email scams to spam@mq.edu.au.

A note for LastPass users

The recent LastPass data breach may allow attackers to obtain credentials if a LastPass account password can be guessed. While it is still unclear if the LastPass breach will lead to account compromise, as a precaution, it is recommended that LastPass users reset all passwords that are stored in LastPass, as well as their LastPass master password.

For more information about cyber security for Macquarie staff please contact cybersecurity@mq.edu.au.

While the University employs sophisticated measures to protect us from attacks, it is the responsibility of every staff member to use University systems safely and handle sensitive information securely.

A cyber awareness training module has been developed to ensure staff are aware of potential risks, understand how to stay safe online and know how to identify and report cyber security incidents.

On completion of the module in Workday, staff will be able to:

• Explain the importance of cyber security.
• Identify and protect sensitive data.
• Recognise and avoid popular attacks.
• Apply cyber security measures to protect our digital infrastructure and data, and keep devices safe.
• Identify and report security incidents.

The course takes approximately 30 minutes.

How do I complete the module?

Staff (including employees of Macquarie University Hospital and MQ Health) will be invited by email to complete the module within the next fortnight.

That much is true of Information Technology at Macquarie, at least until very recently.

Unfinished restructures and adjustments to the IT operating model, coupled with IT leadership changes and a history of taking on more projects than was feasibly possible to deliver, meant that IT was not set up to provide the seamless technology support offering we needed.

Challenges and Opportunities

When Tim Hume joined Macquarie in June 2019 as Chief Information Officer he saw these issues and many more. Tim’s first six months was a solid ‘listen and learn’ phase to make sure he understood the challenges as well as where the opportunities might exist.

“One of my first observations was that IT had many dedicated staff working very hard to meet the needs of a university that they cared deeply about,” says Tim.

“However, I found that we were not structured or governed in a way that meant we could efficiently and effectively meet the changing IT and Digital needs of the University.”

Tim says there was no clear governance of demand for IT services or projects, and they were seen as both a service unit as well as a provider of infinite, unprioritised projects that were effectively ‘free’ with no real funding governance to ensure that the right projects were being worked on that aligned with University strategy.

“Budgets were under pressure and business units were frustrated with project delivery timelines,” says Tim.

“IT staff did their best to manage the competing demands of the University, however demand always exceeded supply.”

First cab off the PST rank

The introduction of the IT project prioritisation process followed by the commencement of the University Operating Plan helped address some of the issues, but more radical structural change was needed to set up MQ IT for long term success.

Information Technology was one of the first professional services areas to embark on their Professional Services Transformation (PST) journey in 2020 to restructure and meet these changing needs, while embracing the PST design principles of coordination, simple processes, career opportunity, user experience and cost effectiveness.

This wasn’t just change for change’s sake. A three-step plan of work was designed to transform IT and Digital at Macquarie with very clear objectives:

• Bring together diverse faculty and office teams into one central offering to allow more consistent processes and economies of scale as well as better career progression paths.
• Move to a structure that reflected core discipline areas to improve the capability, capacity and depth of knowledge, as well as aligning to the industry standard SFIA (skills for the information age) capability framework. This also supported skills development strategies and professional growth.
• Broaden the remit of the project delivery teams to better align with and meet the needs of the Digital Transformation stream of the University Operating Plan. The project delivery organisation is flexible and scalable to allow for changing funding envelopes and priorities from year to year.

The finish line is in sight

Now more than a year on from completion of most changes, Tim hopes these radical changes for IT  at Macquarie are ones that will set us up for many decades to come. Tim admits this was a hard time on a personal level for all involved, but reminds us that the turmoil of transformational workplace change doesn’t last forever.

“You always come out the other side for the better,” says Tim, who is positive about the changes so far.

“Transformation takes time to get right, but we need to allow it to settle into the ‘new normal’ with regards to operating model and ways of working before we can properly assess the progress we have made.”

The last stage of the MQ IT transformation is the orderly transition of frontline technology service delivery to the newly-formed shared services centre under a Head of IT Shared Services – a role currently being recruited for by Executive Director for Shared Services, Maria-Claudia Romero.

“IT has successfully delivered its savings as part of the PST transformation process and no further job reductions are expected during this transition,” he says.

Creating new opportunities

One of the key objectives of the whole change process, and indeed of the PST objectives more broadly, was to build better career pathways for everyone in the new structure.

A standardised set of position descriptions were rolled out within IT that relied on core skills and competencies and meant that staff could move between roles more easily, sometimes with training or a ‘ramp up’ period to learn new skills or technologies. Management positions were renewed.

Change runs all the way to the top as well, with Tim’s job title recently changing to Chief Information and Digital Officer to better reflect the digital leadership Tim has undertaken as leader of the Digital Transformation stream of the Operating Plan.

Tim says that as one of the first functions embarking on their PST journey, he believed it was imperative to meet with staff and clients in their teams or one-on-one to help ensure the change went as smoothly as possible.

“This part of our transformation was a big investment of time and effort, but this was rewarded with a smooth consultation and implementation process,” he says.

The future is bright for MQ IT

This new way of working will set Tim and his new team of Directors up for success in some ambitious projects he is undertaking. Tim says 2022 is a very full year of delivery, including a large program of work to transition our data centres to the cloud, along with a transformation of our core management systems (student, curriculum and finance), delivering a ‘one-stop-shop’ student portal, transformation of our core learning and teaching systems to next gen digital learning environments and defining our Student CRM strategy – to name just a few!

These projects might sound widely ambitious, and some have been attempted (and abandoned) before. However, the successful streamlining of the Information Technology landscape at Macquarie over the last two years has provided us with an excellent starting point for these transformational projects.

Those three years and 30 significant ‘go-lives’ have finally ended, with the team taking a collective deep breath and deserving huge congratulations from the Macquarie community. Let’s look back at some of the highlights and achievements of this immense program.

After a busy 2018 procuring a new curriculum management system (CMS) and investing in the existing student management system (SMS), in 2019, the Beacon Board recognised that the streams of activities required to launch the new curriculum were interdisciplinary and created 6 sub-projects:

• Curriculum Management System (CMS) and Coursefinder
• Student Management system (SMS)
• Student Curriculum Implementation (SCIP) – Technical
• Student Curriculum Implementation (SCIP) – Student migration
• Student engagement and communication
• Organisation readiness and change management

By this stage, there were about 30 people on the Beacon team. Their aim to transform business enabled by technology was a new approach that brought together business and technology areas of the University.

This team of busy people completed over 30 project milestones, such as MQ2020 curriculum transformation and management, Coursefinder, Double degree advisor; personalised Mystudyplan; technical and student migration, implementation of the WAM (weighted average mark), TCSI (new event-based government reporting implementation), AMIS single sign-on (SSO) for staff and students, deployed the Applicant Portal/Enhanced Admissions, incorporated HDR management into one system, and integrated MI studylink with AMIS to assist with applicant management. The team even managed to build a small automation bot for HDR Scholarships for the Graduate Research Academy.

The AMIS single sign-on (SSO) was celebrated by our students as it removed the need to use a separate password to access eStudent – a pain point that had been reported by our students for years but never successfully solved. By deploying the MQ OneID, students also no longer need to contact the Helpdesk to constantly change their expired passwords.

When the pandemic hit in 2020, the Beacon team also provided support for issues such as moving teaching and learning online and the early enrolment push; in addition to the projects they were slated to deliver. They delivered all the student and staff engagement and change management. They also improved 62 process pain points noted by staff while coming in under budget and delivering more than they were established to deliver!

“I congratulate the Program Beacon team on its work,” says Vice-Chancellor Professor S Bruce Dowton, “What has been achieved to date is of foundational importance for the ongoing work in modernising our approach towards an outstanding student experience in every way.”

It’s no surprise that the Program Beacon team have received the recognition they deserve. Dr Brad Windon and Roz Howard were nominated by ATEM (Association for Tertiary Management Awards) for Excellence in Practice awards; was highly commended in Innovation; and the Team also won the Universities Admissions Centre (UAC) Award for Excellence in Student Engagement.

Team members Nerida Lithgow, Kylie Ebert, Lilia Draganov and David Indge were particular called out by the UAC for establishing the Macquarie Rovers – an initiative that engaged students to support students through authentic messaging and visibility around curriculum changes. The Macquarie Rovers was seen as an excellent and sustainable engagement model that enhanced the student experience through peer support approaches.

Pictured: Two of our Macquarie Rovers team in action on campus in 2020, speaking with students about the curriculum changes.

“I am so very proud of the Beacon Team for delivering all our significant milestones,” says Roz Howard, Program Director for Program Beacon.

“It has been such a privilege to lead and have worked with such passionate, can-do and resilient colleagues. Thank you to past and present project teams, business colleagues across the University and Executives for your unwavering support.”

If you’re only just getting your head around Zoom, here’s some helpful tips for getting the most of out of the platform… and making sure your meetings don’t descend into chaos!

HAVE A CLEARLY DEFINED MEETING HOST

Just like a Chair in face-to-face meetings, an active Zoom host is essential to make sure meetings run efficiently.

If you’re hosting a meeting on Zoom, make sure you:

• Send an agenda prior to the meeting so you can refer to it and keep everyone on track.
• Only invite people who really need to be there, to ensure things don’t get too crowded. You can always record the meeting and circulate it to a wider group afterwards if you need to.
• Share your screen so participants can refer to the same key documents.
• Ask specific people to respond to questions where possible. This helps alleviate people talking over the top of each other.
• Encourage people to use the ‘raise hand’ tool when they have a question or comment when someone else is talking.

HARNESS THE POWER OF VIDEO

While it’s tempting to hide behind a blank screen (especially when you’re not looking your best or have kids running around in the background), turning video on helps you communicate and connect with your team more powerfully. Try to look into the camera when you’re talking as well – the face displays can be distracting, but eye contact helps build trust in virtual communications.

If you’re worried you’re looking a little rough for that early morning meeting, Zoom even has a ‘Touch up my appearance’ filter function to hide those dark circles!

HAVE FUN WITH BACKGROUNDS

If you’re worried about colleagues seeing your piles of dirty dishes and overflowing washing basket, or just want to have a bit of fun, you can apply a virtual background (here’s how). There’s a number of default Zoom background to choose from, or why not find a background that illustrates your area of expertise? You can even design a bespoke background to promote your event, research group or the University itself.

DON’T STRESS ABOUT INTERRUPTIONS

If you have children or pets at home, it’s quite likely they will interrupt you during a Zoom meeting. Be upfront at the start of the meeting about potential interruptions and make sure you’re on mute when you don’t need to be speaking, to minimise any background noise.

With many staff in the same boat, you might be surprised to find these shared challenges actually brings us closer together as colleagues (check out #petsofMQ on Twitter to meet some interruptions of the cute and furry variety!)

SAFETY FIRST

With the massive global uptake of Zoom, the platform has become a target for hackers and ‘zoom bombers’, as reported in The Guardian.

Some of the things Zoom hosts can do to prevent unwanted intruders include:

• Not sharing Zoom meeting IDs with anyone but planned participants
• Turning off screen sharing for anyone other than the host
• Knowing your way around the participants control panel, which lets you do things like mute or remove participants

Read 4 Things to Keep Hackers Our of Your Zoom Call on Forbes.com >

IF YOU’RE A LEADER, CONSIDER REGULAR ‘OPEN DOOR’ MEETINGS

Hosting ‘open door’ Zoom meetings at set times during the week is a great way for leaders to let their team know their (virtual) office door is still open.  Likewise, why not arrange a regular ‘coffee break’ Zoom catchup for your team, to help you stay connected socially?

To use Zoom, login at https://macquarie.zoom.us. For help, visit the Zoom Help Centre.  

Christophe Doche is the Executive Director of the Optus Macquarie University Cyber Security Hub and architect of Macquarie’s cyber security degree programs. He recently sat down with 2SER’s Sean Britten to explain why Australia desperately needs more cyber professionals. 

How would you characterise the current need for cyber security workers?

The need for cyber security workers is huge. It’s a big problem, both in Australia and worldwide – we are losing the battle against cybercriminals at the moment.

The cost of cybercrime is estimated to be $4.5 billion in Australia last year. Worldwide, the cost was estimated to be US $450 billion in 2016 and is projected to reach US $2 trillion this year.

So the risks are there. The costs are enormous. And at the same time, we don’t have enough people – there’s a shortfall of skilled people of about 1.5 to 2 million jobs worldwide.

The image that pops into a lot of people’s minds when we talk about cyber security would be Russian hackers interfering in the last US elections, or fears that China could do the same here in Australia. Is the web becoming the new battleground for nations?

Absolutely. It is the battleground right now. It’s much more convenient to do a ransomware attack than it is to go and rob a bank with a gun.  Why would you send troops when you could send a virus?

In 2010, for example, there was a virus called Stuxnet that was used to take out nuclear capabilities in Iran. It’s very hard to know who was responsible for the attack – was the US, was it Israel? We’re still not sure. Similarly, a couple of years ago, before Russia invaded Ukraine, they first took out all the critical infrastructure with a cyberattack.

So, is digital the new battleground? Absolutely, and it’s only going to get worse.

How equipped is Australia, as a country, to deal with this new battleground?

I would say that Australia is not any different to other countries in the world – struggling with these very complex issues.

What we see is that people in Australia are not very prepared. I talk to a lot of people and I think it probably comes from the fact that we live in a relatively safe country – we are on an island, separated from the rest of the world,  and we tend to translate our physical security into digital security, which is completely not applicable. Digitally, we’re at the doorstep of Russia, of China. So we’re not at all safe in the digital world, and our behaviour needs to change.

There are some positives – for instance, the NSW Government has a new Cyber Security policy that’s a first step in the right direction. We’ve seen lots of investment coming from Federal government, with the launch in 2016 Cyber Security Strategy which was the first step to develop this industry.

So, there’s lots of work to do, but I see lots of positives as well.

Currently, most current cyber security workers have come from different areas of IT. Does this present a problem, not having a specific security background?

I think the best mix includes some strong technical capabilities, but that’s not enough. Because cyber security is not just an IT issue – it’s a business risk. So, you have to add something else – it could be law, business acumen, financial risk understanding. criminology, psychology…

Psychology is very interesting because the human factor is crucial. Studies have shown that more than 60 per cent of breaches have come from a human error – whether it is intentional or an accident ­– from the people working in the organisation. If you understand the way humans behave, you have a chance to design safer systems.

All these characteristics [of cyber security] lead to a very broad range of careers, and people from a very broad range of backgrounds can be successful in these industries.

The good thing about the Cyber Security Hub at Macquarie is that all disciplines are connected, so we can teach both the technical and soft skills in an integrated way. For example, in our Introduction to Cyber Security unit, students are taught by academics from three different disciplines – computing, business and criminology. We really want to tackle cyber security as a complex and interdisciplinary issue.

To learn warfare, people would often play war games. If we’re talking corporate and governmental warfare here, I’m wondering if there’s a comparison there…?

Absolutely. Simulation is a very powerful way to make people realise the impact of a potential breach. We’re working on an event at the end of the year where we will do exactly that – bring people from corporate to go through a full-day simulation of an attack, and then learn from that.

You’re training students to hack, in order to teach them how to defend against hackers. Is there a fear that they could cross to the ‘dark side’ and become black hats themselves?

There is absolutely this fear – it’s real. We are equipping students with scary skills.

One way to respond to that is to bring the question of ethics absolutely every time, everywhere – we reinforce the importance of ethics at every opportunity.

But actually, what I’ve seen is quite the opposite. We’ve managed to rescue a few students who might have crossed that line in the past. But everything changes once they see that they can apply those skills for the greater good, once they realise that there is a possible career in what they enjoy doing. They see the incredible demand. We have industry speakers coming to our lectures and presenting their work and company to our students and they say, “we have ten jobs to be filled tomorrow – we need people right now.”

Given the large gap in the cyber security workforce, how are you going about attracting students into this area?

We’re quite successful – or programs have grown very rapidly. In 2017 we had 70 students across the whole year and this year we have 140 in Session 1 alone. So, there’s a lot of interest.

The tougher question is how to attract more females. The good news is we went from 10 per cent to 20 per cent female in our programs, but it’s about the tireless work of explaining the opportunities and having role models that can show them there is a pathway. Out of our six Optus-sponsored scholarship holders, four are women, and we have PhD students and of course academics that are women. We can use these good stories to bring more women into the mix.

There will be enormous rewards for any student who is brave enough to take the leap.