How do you immobilise threats when your campus network spills beyond the perimeter? That’s the reality universities are discussing at UCISA DISC26.
“I remember we used to protect the perimeter in a castle and mote model and that used to work really well. The perimeter isn’t dead. But we now have multiple perimeters,” says Jaye Tillson, CTO of Security at HPE.
He’s speaking at UCISA DISC 2026, a higher education event in its first year of combining its network and security cohorts. The event used to be security specific, but so many universities have seen their campus environments spill beyond their traditional perimeters that network teams have become integral to the discussion.
One of them is David Griffith, Head of Infrastructure at Durham University. He’s seen users spread to home, offices, labs, and even mainland China as part of an international partnership.
“It’s a new challenge,” he explains to Jaye and his IT peers at UCISA.
Together, they discuss how infrastructure management is changing for network teams and what this looks like in reality.
Can you keep up with patching?
A widening environment has increased patching duties for network engineers who are trying to reduce attack surfaces. But this comes with a time cost that many universities are struggling to afford.
“A lot of organisations are considering: can keep up with the patching or do we need to segment our network?” says Jaye.
Network segmentation essentially means dividing a network into zones or workloads and controlling what can communicate between them. Macro-segmentation creates broad boundaries. Micro-segmentation applies finer controls.
This limits threat spread, supports least privilege access and compliance, and lets teams isolate affected systems, while keeping critical services available. It’s an approach a lot of teams, inside and outside of higher education, are moving towards.
For David at Durham University, the choice was clear. “We’ve gone heavily for segmentation and have done for quite a few years now.”
How are you dealing with vulnerable equipment?
The network team at Durham were able to macro-segment the network between staff, students, and Edu roam guest users, which massively helps defences.
However, David cautions that you also have to be realistic about where your vulnerabilities are and where it’s necessary to take risks.
This is a conundrum you may have faced when assessing how to support legacy equipment in labs – it’s expensive, and important to research efforts, but vulnerable to attack.
“The answer may be to firewall away and keep it running,” says David. “But can we do that without exposing the university to risks that we can’t tolerate?”
Coming up against these challenges can be a good prompt to gauge your network’s tolerance threshold for risk and will be useful for any future infrastructure decision-making.
Is your observability platform your everything? It shouldn’t be
“It’s critical to know who’s on the network, how they’re on the network, and what they’re doing,” says Jaye.
This is where observability platforms have really come to the fore. And it’s no surprise that most digital teams will have some form of dashboard giving them visibility into the activities happening on their ever-expanding environment.
However, that’s only ever half the story, warns David. “A lot of it is down to business partner relationships, it’s not just what we’re seeing, it’s also what people are asking for.
“We’ve got tools for information feeds, but it’s also about those conversations.”
The reality is there are plenty of legacy switches that don’t collect data. And while your dashboard could indicate one thing, the experience of your users could be completely different. It’s ultimately about balancing the two.
How are you hardening identity?
The requirement for remote access across higher education has really called into question how digital teams are allowing devices to connect to the network.
At UCISA, app-based MFA is clearly a popular option among attendees. “We see MFA as a hard requirement now, including for our team,” says David. “Some of that is easy; cloud-applications with appropriate policies. Some aspects of that are harder.”
However, while MFA is now a near-standard across higher education, institutes still need to balance the added protection it provides with the friction it can create for users, since complaints about the extra steps involved in sign-in can undermine adoption.
“We always get complaints from students about MFA, asking why their data is this important. What they don’t realise is that they could be a foothold into the organisation,” says David.
Now it seems the industry’s attention is moving towards how this MFA movement can be built on with other authentication measures such as biometrics and hardware keys for IT staff.
“Moving towards bio-metrics could be a game-changer,” says David. “It’s also a massive user experience improve which automatically helps with adoption.”
Plan early, build flexibly, and find strength in collaboration
Everyone is feeling the strain of adapting to the network requirements now necessary to support remote access beyond the perimeter.
Many university leaders say they’re currently experiencing tight budgets, price hikes, and hardware delays, which makes any change difficult.
That’s tough, especially when network teams now need to consider:
- Managing patch workloads
- Implementing macro- and micro-segmentation
- Protecting vulnerable but vital equipment
- Consolidating user feedback with observability data
- Implementing app-based MFA and potentially biometrics
However, most network leaders seem to be preparing for these changes by factoring infrastructure changes into annual investment cycles rather than piecemeal purchases.
They’re also designing their architecture with flexibility in mind – well aware that the list of requirements above will no doubt expand in six months’ time.
Plus, they’re also seeking support in the security team because, as UCISA emphasises, there’s strength in collaboration.
Looking for more on micro-segmented networks?
We can show you exactly what these look like.
