University of St Andrews CIO on getting the institution fighting fit

For the next 100 days, Connect will be running through our Tech 100 for 2015. There will be interviews with key figures from across the public and private sector each week, plus Q&As every other day with those driving the digital agenda within Scotland, offering an insight into the work they are undertaking and the challenges they see in store. First up is Steve Watt, CIO at the University of St Andrews.

Steve Watt had a somewhat interesting spin on his job title when he arrived at the University of St Andrews in 2010 as Chief Information Officer. “CIO at that time could have been ‘career is over’ because the challenges of where St Andrews wanted to get to and where they were was quite significant,” he tells Connect.
 
Five years on and Watt, who retrained in the mid-90s for a career in IT after an initial degree in engineering, clearly finds himself in an altogether different situation, with the University the first in the world to be accredited with a four-star Service Desk Certification by the sector’s professional body. 
 
“It is probably fair to say it was a legacy IT department where there wasn’t a particular customer focus and [in terms of] the IT environment, there hadn’t been under-investment but perhaps investment hadn’t been made in the right place,” says Watt as he thinks back to when he first arrived from the University of Abertay. “The platforms weren’t too stable, there were no data centres and there was a largely distributed IT environment across the town. The last five years has been about rationalising that and… improving from that low base point to where we are now.”
 
Rightly or wrongly, says Watt, there were instances of systems that weren’t robust, fell over frequently, and failed to meet the business requirements of a university where IT was growing ever critical. Equipment run at departmental level had seen energy usage as well as costs start to ramp up, with around a third of the electricity consumed by the 600-year-old university used to power ICT equipment.
 
Security, meanwhile, was becoming a growing concern. “If you have got servers that have mission critical data, including our intellectual property that we’d developed, located in storage cupboards in departments, that needed to be addressed,” he says.

A data centre that could support up to 12kW in any cabinet and an average IT load of 9.6kW per cabinet opened in 2011 at a cost of £2.4m. Its location: former squash courts in the centre of town. “It’s not done too much good for people’s fitness but we’ve certainly improved our sustainability agenda,” jokes Watt. 
 
St Andrews subsequently became the first UK public sector organisation to achieve a gold award from the British Computer Society under the Certified Energy Efficient Datacentre Award scheme. “There is still one or two areas who are outliers and want to keep their own kit and touch it and stroke it but I think, in the main, people have surrendered their equipment,” he adds.
 
The project forms part of a broader aspiration the institution had to become the first carbon neutral university for energy by 2016. Last month, parliamentary Under Secretary of State for Scotland, Lord Dunlop, visited the University’s £25m biomass facility currently under construction. The intention is to pump hot water from the plant four miles underground to heat and cool laboratories as well as student residences in St Andrews.   
 
“We’re probably going to be a year behind where we wanted to be,” says Watt of their carbon neutral ambition. “That is simply been because of the complexities of wind farms and biomass plants and planning legislation and various other factors. Again, we’re working very closely with a number of bodies to try and get on with these projects, but it has been challenging. We’re getting there.”   
 
Achieving the Service Desk Institute certification, received earlier this year, was itself anything but simple. St Andrews started the process over three years ago, with four audits – taking in the likes of leadership, policy and strategy as well as customer satisfaction – seeing the IT team move from two to four stars. “Back to 2010, St Andrews’ IT department rightly or wrongly had got a bad reputation internally because people didn’t think it did a good job,” acknowledges Watt.

“In some respects it probably did do a good job, but the staff culture was very inward-focused – ‘we do IT for IT sake’ – and what we’ve done is open it up and turned it on its head by saying, actually, ultimately we exist to support the students and the academics and as long as people recognise that then that is what we are here to do. We are not here to support each other.”   
 
Ahead of students returning to campus earlier this month, Watt and his team had been working on “e-enabling” much of the underlying processes when students first arrive to register. Pool printing has been improved, allowing students to print from their own device to a central print queue and release it from between 60 and 70 locations across campus. And students have now been moved over to Microsoft 365, a cloud-based collaboration programme, rather than a previous set-up which saw students use Google and staff a mixture of on-premises and cloud-based.
 
A proof-of-concept wi-fi project on one of the main streets within the town will be concluded in the next few weeks with a decision then taken on possible expansion throughout St Andrews. “That is recognising that the way people learn now has changed in the fact that they learn on the go, they have social interactions in coffee shops, so how do we improve or extend the reach of the campus,” says Watt. “And we have green spaces out by the cathedral where students in the summer sit outside – why should they not have access to wi-fi to do what they want to do?”  
 
After all, the demands of the individuals universities are there to serve – the students – are only growing, underlines Watt. “Their expectations of what they’re going to get when they come into education are just going to continue to ramp up,” he adds.
 
“Coming into university or college you’re going to expect to use the technology you’ve seen in the classroom because schools for a number of years have been investing in the latest interactive whiteboards and smartboards, even at primary school level. You come into FE and HE and there isn’t a lot of that yet so we’re going to see a big push from a customer perspective in terms of people changing the landscape, continuing to evolve it and providing services that they (students) would expect to see, otherwise it is going to be a bit of a shock when they come in from a school and end up with people writing on a whiteboard.
 
“That’s a big challenge and we’ve done a fair bit here to try and address that but I think we’ve still a long way to go. And a lot of that is about organisational culture as well because you [can] put all the best technology in the world in place but if you can’t get the academics and people to use it, it’s a challenge.”
 
Watt chairs the Higher Education Information Directors Scotland (HEIDS), which meets every six to eight weeks to share learning from across education. Since taking up the role, he has created two permanent seats for IT directors from further education in an acknowledgement that many of the challenges facing the two sectors and the economies of scale involved are similar post-regionalisation.  
 
Getting more females into tech jobs is important, while there needs to be a greater emphasis on more vocational routes into IT, indicates Watt. Both take on an added urgency in light of the skills shortage currently facing the education sector and the public sector more widely.

“That is something that is only going to get worse, simply because post-recession we’ve started to see a lot more investment and a lot of catch-up being done in organisations that maybe said for two years we’re going to be pretty flat in terms of investment,” adds the St Andrews’ CIO.

“Now we’re seeing investment ramped up in technology spend, I think we’re seeing that here. We’re losing staff to higher-paid jobs elsewhere in Scotland or beyond and we’re still not seeing the posts that we advertise, the calibre of the people that apply for them, it varies quite variably to be honest. So I think skill shortage is a huge challenge.”
 
For their part, St Andrews’ IT team has taken on 12 apprentices over the last three years, contributing to the university being shortlisted as finalists public sector employer of the year ahead of Scotland’s Modern Apprenticeship awards this November. Three of those taken on who went on to secure jobs with St Andrews signed up for a further cyber security apprenticeship run by QA.

Cyber security, after all, is the “number one thing that keeps me awake at night”, admits Watt, with moves towards the ‘internet of things’ and increasingly embedded technology “only going to make it worse”. 

Threats to the university’s network – primarily spear phishing and malware – are seen every other day. An instance a few years ago saw a system in one of the institution’s science departments exposed to the internet compromised as a result of not being patched properly, albeit data was not exposed. 
 
“There is never going to be a 100 per cent guarantee of being secure towards a cyber threat,” explains Watt. “We can continue to lock things down, we can continue to put in place improved firewalls but ultimately the nature of higher education, it’s an open environment and the types of things that we do, we allow people to bring their own devices on campus which we don’t know the posture of.
 
“It is [about] protecting what is important to us. So perimeter security in the past, we put a firewall in place, put up a perimeter and that would be how you defend your organisation. With things like the ‘Internet of Things’, 3G, 4G modems, different links to the internet, the perimeter has actually gone, it has disappeared, so the challenge is how you look at all these end-point devices, whether it’s an Apple watch connected to your network or a server.
 
“It’s about privacy by design – I suppose that is what the Information Commissioner would reference it as – and that’s about how you protect that data, whether it’s intellectual property, whether it’s student or staff data, the focus needs to be at a more micro level than what it was in the past where it was, ‘yes let’s buy a firewall’. That’s a real challenge and the landscape is just getting more complex all the time. And again [there is a] huge skill shortage in that area.”
 
The institution is poised to recruit for a new security manager post. While more of Watt’s budget and time is now devoted to the issue of cyber security than ever before, he acknowledges “often the weakest link” is the person. “We’ve never had anything catastrophic in the time I’ve been here. The biggest fear is somebody with personal data losing their pen drive on a bus or in a taxi, we’ve seen lots of evidence of that in other places.

“Up to now we’ve never had a problem with that but again that’s human behaviour, which is not a lot we can do about other than give people the tools to secure that data and try and enforce it through policy and training and other interventions.

“But that is ultimately going to be the thing that gets us. Technology is getting better, the whole threat landscape is getting more complicated, but ultimately it’s the people clicking on that phishing email that then exposes the environment to something.”
 
Five years into his role at St Andrews, what advice then does Watt have for other IT teams scattered throughout Scotland’s higher education sector? “I think it’s key that you think about the bigger picture, don’t think about it at a micro-level, think about it at a macro level and I don’t mean just within your own institution, you’ve really got to think cross sector these days.
 
“With the government’s agenda for shared services and the opportunities that cloud technologies bring from a scale perspective then actually running your own IT doesn’t often make too much sense anymore. There will be certain things that always run on premise and, [given] the nature of education and what we do, absolutely is the right thing. But there will be other things that are commodity items, like email collaboration platforms, and they probably sit better out in the cloud.
 
“And also trying to get business processes aligned in such a way that you can start to use shared services in the sector or indeed cross sector, across the verticals, whether it’s local, central government, education, that would also make sense. Again we do that with our service desk platform that is hosted by the University of Edinburgh, shared by a number of institutions in Scotland and beyond, and that way we’re not all replicating and having the same system. The money we save goes back into education rather than running IT systems."

Tomorrow: Chris Yiu, director of digital at SCVO (Scottish Council for Voluntary Organisations), on helping more Scottish charities make the most of the internet and digital tools.