Having worked at a university at one point I can understand how shitty security is at virtually all universities. But Stanford claims to turn out brilliant technologists (in addition to these overpaid MBAs) yet apparently doesn't hire any.
Shitty compared to whom? Who are the examplars of information security universities aren't matching? Academia security doesn't look so bad compared to governmental or corporate security.
Security involves trade-offs and some of universities' lower security is a conscious choice to not impair academic freedom or collaboration.
> apparently doesn't hire any.
If their graduates are as good as claimed, the University can't afford them. And many wouldn't want to work there because most of the University's problems are not interesting.
My opinion, based on my observation at a half dozen campuses is that academic computing is ok, but the central services type stuff (payroll, admissions, accounting, HR) is often underfunded and struggling to meet mushrooming compliance requirements.
Compared to a similar sized organization in another sector, they aren’t as good as a bank, .gov revenue department or insurance company. But they are better than a municipal government, k-12, or retail.
Our security team is relatively new. When I first started back in 2013 we didn't really have one. So if you had a few programmers that didn't understand security, many things got through. We do a much better job now, but I can see how other universities can really struggle.