Every day, attackers scan university websites for easy openings. Breaches rarely come from one big mistake… they come from small ones piling up: a missed update, a forgotten admin account, a risky plugin. That’s why security isn’t a single product; it’s a set of layers that work together so if one slips, the others hold.
Recently, I sat down with ERI’s Head of Development, Edwin Cromley. Edwin leads complex website and app builds and sets the guardrails that keep sites fast, accessible, and secure. We talked about what’s at risk and the practical steps leaders can take to protect students, donors, and research.
Q&A With Edwin Cromley
1. What are some security measures that are paramount for keeping your site and data secure?
I see security as more than just a technical requirement, it’s a shared responsibility. Keeping your site and data safe means building multiple layers of protection that work together. No single solution is enough on its own. Real security comes from using strong tools, following best practices, and staying proactive.
Here are some key measures I consider essential for maintaining a secure and reliable system.
Encryption
Protecting sensitive data starts with encryption, both at rest and in transit. HTTPS is now standard, and enabling HSTS (HTTP Strict Transport Security) adds another layer by preventing attackers from bypassing HTTPS. If most of your data is public, full encryption at rest may not be necessary, but any sensitive data should always be encrypted. Use libraries and standards recommended by trusted organizations like NIST, and regularly update older encryption algorithms. Whether you manage encryption internally or through your hosting provider, keeping it current is essential for preventing breaches.
Authentication and Authorization
Strong login and access controls are fundamental to any secure system. For larger organizations, setting up Single Sign-On (SSO) with Multi-Factor Authentication (MFA) makes managing access easier and safer. MFA adds an extra step, like a verification code, that helps prevent unauthorized access. It’s also important to use brute-force protection, limit login attempts, and apply rate limiting to reduce attack risks. Always follow the principle of least privilege by giving users access only to what they need.
Web Application Security
Following OWASP (Open Web Application Security Project) best practices is key to keeping your code safe. Automated scanning tools can identify many vulnerabilities, but regular security audits and penetration testing are still essential.
Focus on protecting against:
- XSS (Cross-Site Scripting) by sanitizing and escaping all input and output data
- CSRF and SSRF attacks by validating requests carefully
- Injection attacks by using secure libraries and prepared statements
- Insecure deserialization by avoiding untrusted data
Security should be treated as an ongoing process, not a one-time task.
Dependency Management
Most modern applications rely on third-party software and open-source libraries. These dependencies can introduce risks if not properly maintained. Always use trusted, well-supported tools and keep them up to date. Supply chain attacks, where attackers compromise open-source projects to insert malicious code, are becoming more common. Reducing unnecessary dependencies and auditing your stack regularly are good ways to protect against these threats.
Content Security Policy and Headers
Set up a Content Security Policy (CSP) and include security headers on every response. CSP helps prevent unauthorized scripts from running by limiting which domains can execute code.
If your site uses Google Tag Manager (GTM), coordinate with your marketing team to ensure analytics tools are configured securely. You can check your security headers using securityheaders.com.
Web Application Firewall (WAF)
A Web Application Firewall adds another layer of defense by blocking known malicious IPs, botnets, and other attack patterns. It acts as a protective barrier that helps guard against both common and emerging threats.
Monitoring and Detection
You can’t fix what you can’t see. Continuous monitoring helps detect unusual activity before it becomes a problem. Use tools for malware scanning, access logging, and anomaly detection to spot and respond to issues early.
Backups and Redundancy
Even with strong defenses, incidents can still happen. Always keep encrypted backups stored off-site and test your restoration process regularly. Practicing recovery ensures that your systems can be restored quickly and reliably when needed.
Security Awareness
Technology alone can’t prevent every threat. Building a culture of security awareness across your team is one of the best defenses you can have. Train employees to recognize phishing attempts, use strong passwords, and handle data responsibly. Informed people make a huge difference in preventing breaches.
2. Our site handles donations, applications, and parent portals. How do we keep those pages safe and fast without adding friction for users?
For processing any kind of data transfer always ensure encryption is at play. The web server(s) should have TLS enabled and always set via HSTS with up to date, and valid certificates. Payments should also rely on third party PCI compliant payments platforms like Stripe, to reduce your risk while supporting frictionless transactions. Any sensitive data in applications should also be encrypted at rest to ensure that in the event of a breach no data is divulged. Encryption keys must be protected with the utmost diligence.
3. We rely on lots of third-party tools (analytics, chat, calendars). How do you decide what’s allowed and keep everything else from sneaking onto our pages?
When using third party tooling it is important to always use trusted industry proven vendors to minimize supply chain based attacks. To prevent unwanted scripts from being used on the website you will potentially want to use a Content Security Policy on the server, and also audit and patch the website for any Cross Site Scripting vulnerabilities to ensure that the content and experience you are delivering is completely safe to all users.
4. AI is now embedded in search engines, chatbots, and content creation tools. What data privacy and security risks should universities be aware of when adopting these technologies, and what safeguards should be in place before implementation?
I believe the rise of AI brings exciting opportunities, but it also introduces new privacy and security risks that can’t be ignored. Before implementing any AI tool, it’s important to carefully assess how it handles data. We’ve already seen cases where improper use of AI has led to serious issues such as leaked databases, accidental data exposure, and even remote code execution.
Right now, I recommend using AI tools in a read-only capacity whenever possible. Even that approach comes with some security considerations. One area to be especially cautious about is MCP (Model Context Protocol), introduced by Anthropic. MCP is designed to let AI models interact directly with applications and data, but this can also create new entry points for security risks. Many newer AI tools are starting to use MCP or similar systems, so they should be evaluated very carefully before adoption.
It’s also important to remember that an AI model does not understand or follow your organization’s data governance policies. Any data you include in an AI model’s context window can potentially be reused in its responses. This means sensitive or confidential information should never be shared with or used to train models that you don’t control directly.
The safest way for universities to integrate AI today is by using it only with public or non-sensitive data, and applying it to tasks like search, chatbots, or content summarization. This approach lets you benefit from AI’s capabilities without risking the exposure of private information.
AI systems also face risks such as prompt injection attacks and training data poisoning, where bad actors try to manipulate how the model behaves. Because of that, it’s not yet advisable to rely on AI for critical systems or high-stakes decision-making.
The field is evolving quickly, and many of these security challenges will improve with time. Until then, it’s best to treat AI like any other powerful technology: use it with care, follow established security best practices, and maintain strict access controls, encryption, monitoring, and regular audits. With thoughtful planning, AI can be a valuable tool without compromising privacy or safety.
5. If something goes wrong, what does a “ready-for-anything” plan look like, who does what in the first 24 hours, and how quickly can we get back online?
First, in the case of a breach, the source of the breach and when it occurred should be identified as quickly as possible. Limiting access to compromised applications is also a potential step while identifying the items above. A backup from before the breach that is known to be safe can be loaded and the source of the breach can be immediately patched after the backup is restored. Every breach is unique in its own right and having a general plan in place is always a step in the right direction. It is important to have monitoring tools in place before a breach so that an attack does not go unnoticed.
As you can see, to be ready to handle a breach properly there are planning steps that need to happen before an event like this occurs, so having proper security protocols in place beforehand will position your institution to be able to handle such an event.
Ready to audit your current security posture? Let’s talk. At ERI, we believe every institution deserves peace of mind.
