Member Portal
Representing CANADA'S
IT LEADERS in Higher Education

CUCCIO undertakes initiatives with a purpose for members and with national and international stakeholders.

Initiatives

Simon Fraser University
frame pjf

For Members

Cybersecurity Benchmarking Project


The CUCCIO Cybersecurity Benchmarking Project is designed to identify and promote the use of effective security practices in the higher-education sector. The Project is open to all Canadian colleges and universities. The benchmarking process includes gathering information from a cybersecurity rating service, from online surveys, and from online discussions. Participating institutions receive one year of forensics data, performance scores for things like out-of-date server software and botnet infection levels, and their overall rating. Survey data is collected regarding the use of multi-factor authentication, simulated phishing campaigns for user education, vulnerability management practices, automated or manual responses to systems compromises and other areas of interest. Survey results are compared to ratings and scores. 

Botnet infections example

The chart below shows the Botnet infection score for 40 universities. In this chart, the universities are arranged from left-to-right from the smallest primarily undergraduate institutions to large research-intensive universities. Botnet scores generally decline with the size of the institution due to the increasing number of infected student-owned devices on wireless and residence networks. 

Botnet infection scores for 40 universities - higher is better

There was a correlation between higher scores (fewer detected infections) and the combined use of next-generation firewalls along with DNS firewalls to block command and control traffic from infected devices. This led some institutions to both put in place DNS firewalls and to make more effective use of their existing firewalls. 


A final report, with recommendations, is provided to all participants. 


The project began in 2018 with 40 universities. In 2019 the project grew to 58 colleges and universities. To date the project has focused on two broad areas of interest: best practices for protecting people and for protecting systems. 


For more information on this project, please contact Brian Lesser at This email address is being protected from spambots. You need JavaScript enabled to view it.