The University of Nevada-Las Vegas (UNLV) is a thriving urban research institution located in one of the of the country’s fastest-growing and most enterprising cities. UNLV is classified as “very high research activity” or R1 – the gold standard for university research metrics. With an enrollment of more than 30,000 students and 3,500 faculty and staff, UNLV offers a broad range of programs and is committed to recruiting and retaining top students and faculty, educating the region’s diversifying population and workforce, driving economic activity through increased research and community partnerships, and creating an academic health center for Southern Nevada.
Accepting credit cards for payment of products and services requires connecting to a complex system of issuing banks, card brand networks and credit card processors. Every merchant that accepts credit card payments must be in compliance with the Payment Card Industry Data Security Standards (PCI DSS). PCI DSS includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. A critical factor distinguishes colleges and universities from other sectors of the economy makes compliance with the DSS particularly difficult and compounds achievement: campuses are like a cities. With their own residence and dining locales, athletics facilities, utilities and law enforcement and multiple information networks to manage it is a difficult challenge at best.
Challenge
In the beginning, UNLV’s rapid growth had evolved a network wherein credit card transactions were not segmented from any other network traffic, potentially creating an easy target for breaches and card fraud. “We were novices when we first met with CampusGuard,” stated Chris Viton, UNLV’s Controller. Already familiar with CampusGuard executives who had previously assisted with providing a PCI compliant ecommerce platform for UNLV merchants, Viton requested advice for ensuring that the entire university infrastructure would be compliant.
Information security is a particularly difficult task for colleges and universities because there are unique aspects of higher education that sometimes compound compliance achievement. Campuses are very much like a “city” with their own dining, utility, athletic, foundation, healthcare, and law enforcement that have data-rich information systems that are a natural target for sophisticated intruders.
The Approach
CampusGuard, a Qualified Security Assessment (QSA) firm, specializes in providing assessments, ongoing support and remediation services to bring university clients into compliance and continuously maintain that compliance. We apply our unique skills effectively to the university environment because we know that it is markedly different from more traditional merchants.
“I knew CampusGuard was aligned with higher education and had already demonstrated familiarity with our merchant environment and had also worked closely with UNLV’s network security personnel,” Viton explained. “Further, I knew that we were going to be called upon to demonstrate compliance with the PCI DSS and we needed a quick start.”
Result
Critical for the success and sustainability of a PCI compliance program is close collaboration with the Office of Information Technology (OIT). “One of the benefits of partnering with CampusGuard has been their ability to have engaging conversations with OIT, speaking their language in the context of a university setting.” There are so many requirements to coordinate, and OIT rightly views them in the context of part of the overall strategy of security and privacy. Having CampusGuard at the table really establishes that relationship and helps us have a strong relationship with OIT,” stated Nikolich.
“…the CampusGuard team helped to prioritize activities… and brought efficiency.”
– Alexandra Nikolich, Executive Director for Financial Systems and Special
“Like every institution you’re trying to balance limited resources”, explains Viton. “Folks take it seriously but at the same time are just trying to manage all their responsibilities with limited time and money. The challenge is trying to help people prioritize and make information security and compliance important. This is something CampusGuard helps with by reaching people that we wouldn’t’ be able to reach if it was just ourselves.”
Going Forward
UNLV takes full advantage of the annual support provided by CampusGuard. Since the initial assessment and every year since, CampusGuard has been working with UNLV to make sure they have processes in place for establishing new merchants and any changes in processing. Additionally, the CampusGuard Customer Advocate Team has been on numerous calls with merchants to provide advice on the transition to new service providers and the application the merchant is trying to use. “At first, UNLV didn’t think they had a very smooth way to make that happen,” observed Nikolich. “They wanted to make sure they were doing their due diligence!”
Like every other segment of the economy, UNLV’s business operations have been affected by the COVID-19 pandemic. CampusGuard however has been able to work remotely with the university to ensure compliance. “This has even extended to include an assessment for GLBA,” exclaimed Nikolich.
“Having the continuity and relationship with a trusted partner is important,” said Viton. “CampusGuard has become familiar with our entire merchant and supporting information technology infrastructure enabling us to proceed with confidence. They are organized to provide these services for universities and that is an advantage for all of us.”
“I think the relationship we have established is valuable. Our CampusGuard QSA has been great at sharing knowledge and being available. I had three meetings with her in the past week. Being able to get the one-on one attention and time from our CampusGuard Advocate Team has been really great”, adds Nikolich.
“Having the continuity and relationship with a trusted partner is important. CampusGuard has become familiar with our entire merchant and supporting information technology infrastructure enabling us to proceed with confidence. They are organized to provide these services for universities and that is an advantage for all of us.”
– Chris Viton, Controller
For more information, please visit CampusGuard.com or contact us.
"One of the benefits of partnering with CampusGuard has been their ability to have engaging conversations with OIT, speaking their language in the context of a university setting...Having CampusGuard at the table really establishes that relationship and helps us have a strong relationship with OIT."
