Transforming higher-ed collaboration

For Duquesne University, a student’s social security number in the wrong hands could do a lot of collateral damage. Thanks to the auto-classification capability of Box Shield, the school’s IT team recently caught a bad actor trying to access a social security number within a restricted document.

Tom Dugas, Assistant Vice President and Chief Information Security Officer at this private educational institution, leverages Box classification, governance, and security features to keep the university’s nearly 42 terabytes of content safe. With the Content Cloud, the IT team enables seamless collaboration while always meeting compliance requirements and privacy standards.

“I have three primary responsibilities,” says Dugas. “The first one is to build and develop a comprehensive cybersecurity program for the university. The second one is to manage our identity and access management program. And the third one is a data governance program.”

For all three, he leans into Box —a technology platform he was already familiar with from his last role at Carnegie Mellon. When he came to Duquesne University six years ago, he made sure to bring Box with him to protect the information of the student body comprising 8,000+ people, along with the intellectual property (IP) of faculty and staff.

The Content Cloud supports sharing in an interdisciplinary community

One of the top Catholic universities in the US, Duquesne is a Spirit and Catholic Institution, which means that service to community is a very important value. But Dugas says, “We weren’t doing a very good job of building community, because the legacy approach to sharing information was antiquated. We simply didn’t have the tools and the techniques we needed to manage and understand who we were sharing with.”

As a small institution conducting big research across various doctoral programs, the academics at Duquesne needed more sophisticated sharing and collaboration capabilities. But students, teachers, staff, and outside partners couldn’t easily manage, protect, and share data. “Everything was held really tightly,” says Dugas, “and IT didn’t allocate any of that control. There was a very risk-averse culture.”

Dugan set out to change that culture, giving people the ability to collaborate across divisional boundaries. Box gave his team the ability to quickly and easily extend its technical capabilities and work collaboratively with other institutions. “Now,” he confirms, “we can work on large data files or research studies securely, without having to worry about our data.”

Meeting the complex compliance needs of higher education

Higher education is a remarkably regulated space. Content can include the personal, financial, and even health data of students, as well as valuable IP. That means higher education organizations have to abide by a lot of different regulations when it comes to how they handle content:

• HIPAA
• FERPA
• GDPR
• The California Consumer Protection Act
• The Chinese People’s Protection Act
• Various state laws

And this is just a partial list.

Using Box Shield in conjunction with Box Governance ensures that every department within Duquesne University —and every individual who touches content —stays in the right compliance lane. For instance, researchers can hold HIPAA-related data on Box for studies, as can public-facing medical practices on campus. The athletics department can use Box while staying within NCAA regulations. Satellite campuses in Ireland and Italy stay true to GDPR regulations.

In addition, there are some internal governance rules set up within the university that aren’t necessarily regulated by a state or federal agency, but are mandated by the institution itself. For instance, grievance committees handle cases of complaints between students, faculty members, and staff members. These committees abide by their own privacy and governance requirements, so the IT team built out an environment for them in the Content Cloud to work securely and safely share content related to case studies.

Auto-classification ensures content doesn’t get into the wrong hands

With the old system, any time a staff member wanted to change access parameters around content, the process involved IT. There was a complex ticketing system, a wait for the change to take place, and a lack of maintenance support for that system.

With Shield, the team was able to set up classifications to automatically self-identify content based on how it should be protected —available to the entire university versus internal-only, for example. Both IT administrators and community members can set manual classifications as well. Controlling access identity helps Dugas’ team build guardrails around entitlements and create roles that give the right groups of people appropriate access to content.

From days to seconds for file recovery

In the past, to recover an old version of a file would have required a helpdesk ticket and a wait time of up to ten days. The process looked like this:

• The person who lost the file would pick up the phone and call the help desk
• The help desk would then submit a ticket into the  storage team
• The storage team would travel, in person, to a data-storage facility —sometimes offsite
• They would bring back a tape, load it, restore it, and give the file back to the person who lost it

Now, recovering a lost file or an old version is an automatic function of Box that takes under twenty seconds. While it’s hard to measure just how much time and productivity used to be lost to what is now a simple, easy function, Dugas is confident about the value of this functionality to everyone across the university: “It’s a tremendous advantage in terms of control capability, from an end user perspective. Now, you can delete to your heart’s content. Even if someone accidentally deletes the whole file server, we can get it back in minutes.”

Straight-up ease of use for10K people

Security has been a critical factor in choosing Box, but it doesn’t matter how secure a content platform is if people don’t use it. When Duquesne University first launched Box, faculty were the early adopters. When the pandemic hit, staff embraced the Content Cloud as well. In a hybrid work environment, the ability to use Box anywhere, from a phone or a computer became a major benefit. Now, every freshman who experiences orientation and every new faculty or staff member has the opportunity to use Box. Today, almost 10,000 people use the university’s Box account.

“With the old system,” says Dugas, “ they complained about the search functionality, had issues with version control, couldn’t figure out who other contributors were, and had trouble navigating the basic interface."

With Box, all of these usability issues and workflow impediments have been cured. As just one example, the finance team that handles the “nuts and bolts” of the institution as a business has been especially enthusiastic about the Content Cloud. They had been using Microsoft Office on traditional file servers for decades before they moved content to Box. Now, they have more control over content access and auditing than ever before, and don't have to constantly call IT for help. The finance team can assign permissions based on needs, and doesn’t have to connect to a clunky VPN to access finance-related content when working remotely.

Instead of sending large files as attachments, they now use Box shared links. Team members can co-author and collaborate on Microsoft Office files from their desktop or the web app with all changes automatically saved back to Box. As a result, they’ve found themselves both more secure and more productive in the Content Cloud.

The top benefits of Box —including profound time savings

“Box is  invested in the community of higher education,” says Dugas. “They have taken a lot of our suggestions and opportunities seriously and built it into the product.”

To date, his top three favorite benefits of Box are:

• It’s extremely easy to use, with a clean interface and streamlined navigation
• The level of transparency that Box provides around file use far exceeds what he expected in a traditional file service environment
• Box allows a sense of control over folders so that content can be shared broadly or on a granular, case-by-case level

Dugas looks forward to more Box functionality soon, with Box Sign used in conjunction with Relay. “It’s going to be a game-changer for higher-ed institutions like ours,” he wagers. “I think it’s right on the cusp of making a major impact and changing the way a lot of universities deliver their business services to their communities.”

While faculty and staff have been enthusiastic Box users, so have students, and that’s an especially important point Dugas makes: “Hopefully, if they like it, they take it with them into the corporate world and go on to do bigger and bigger things.”