@phase
The primary problem here is the Higher Ed C-Suite.
Administration Day 1: "IT and self-administered systems cost too much! Move our email to the cloud and have MS deal with it."
Administration Day 366: "How could a scammer get a .edu email account and walk off with university money?"
I'm not IT and I'm phrasing it poorly, but I saw it start happening years ago.
Follow
"Yeah, having a Head of Infosec, 2 senior analysts, 2 juniors and no real SoC should be enough to protect and mitigate any effects on our massive physical and virtual attack surface, no worries"
@Zailrand @phase
1. "Employee PII was exposed." Shrug. Cost of doing business.
2. "We paid $18K in fraudulent invoices." Shrug. Cost of doing business.
3. "They got into the president's emails/they got into a server that stores Federally-funded research data." OMG HOW COULD THIS HAPPEN HEADS WILL ROLL.