Media hacks and data breaches are everywhere. Nick Falcone of Penn’s Office of Information Security works to keep the University’s information assets safe, from employing phishing-simulation tools to monitoring attack trends across all schools and centers.
Nick Falcone, executive director of Information Security.
As our world has become ever more technologically advanced, institutions such as Penn have been investing increasing resources into cybersecurity measures. With reports of media hacks and data breaches affecting organizations of all sizes, both public and private, corporate and nonprofit, no one can afford to be complacent about this growing phenomenon. The presence of cybercrime in nearly every facet of our society shows why cybersecurity is crucially important.
At Penn, the Office of Information Security, part of the University’s Information Systems & Computing division, coordinates security services and projects across campus, with the goal of safeguarding Penn’s diverse and valuable information assets against unauthorized use, disclosure, modification, damage, or loss.
Penn Today sat down with Nick Falcone, executive director of Information Security and University Information Security Officer, to talk about some of the trends in the area of cybersecurity, the challenges a large research institution such as Penn faces, and some tips to help everyone keep their vital information more secure.
Can you tell us about your role here at Penn?
I am the University Chief Information Security Officer, which means I am accountable for the security of all of Penn’s information. What this means in practice is that I work to coordinate the information security efforts of Penn’s schools and centers, inclusive of cybersecurity, with the goal of providing the best support to Penn’s mission. My team, the Office of Information Security, helps with this goal by developing policies, standards, and guidance and by providing information security services like consulting, incident response, and technical tools.
What are some specific things your office does to keep Penn safe?
Members of the Penn community might recall the two-step verification protections that were implemented for PennKey logins last year. The changes to put two-step verification in place took the combined effort of hundreds of people across Penn, but have been well worth it. Successful attacks against two-step verification protected accounts have dropped to essentially zero.
More recently, we have implemented a phishing simulation tool that individual schools and centers can use to help their community learn how to recognize malicious and deceptive phishing emails.
Additionally, because the Office of Information Security supports all of Penn’s schools and centers, we are in a position to help monitor for new cyberattack trends across all of Penn. To do this we aggregate information about attempted attacks from schools and centers and combine it with information from technical sources like Penn’s firewalls and intrusion detection systems. This allows us to identify and stop some attacks before they are successful.
You mentioned monitoring trends and new developments in cyberattacks. What are the current trends you are observing?
As I mentioned above, two-step verification protection for PennKey logins was very successful at stopping cyberattacks attempting to take over PennKey accounts. Unfortunately, we have seen those attacks shift to focusing on Penn email accounts where two-step verification protections often are not yet in place. Two-Step verification is becoming an industry standard control and one of the most important measures an entity can take to protect its information assists.
In the past, where a cyberattacker managed to gain control of a Penn computer, they often utilized virus type software to carry out the attack. In order to respond to this type of attack, antivirus software was put in place that looks for known malicious virus programs. Recently, we have observed cyberattacks that attempt to circumvent antivirus software by using existing, normally benign computer management software during the attack.
What is being done to protect against these new cyberattack trends?
We believe the implementation of two-step verification is of vital importance to protect against these new attacks. In order to protect against attacks on Penn email accounts, we are strongly recommending the adoption of two-step verification and are working with schools and centers around Penn to make the process of this adoption easier.
For cyberattacks that do not utilize known bad virus programs, we are piloting a new antivirus type tool called CrowdStrike that can also detect against these newer style attacks. So far, we are seeing very promising results.
What can individual Penn community members do to stay safe and to help protect Penn?
I mentioned before how effective two-step verification is at protecting Penn email accounts and PennKeys. Everyone should take advantage of two-step verification for their personal accounts as well. Banks, social media, and most email providers offer this option and I would suspect that most member of the Penn community already regularly use two-step verification in their daily lives.
When dealing with Penn data, the biggest thing everyone can do is to work with their local service provider [LSP] to be sure that any sensitive information is being stored on Penn managed computers. Computers supported by the LSP will have important security features like encryption, data backup, antivirus, and patching which are very important measures for keeping Penn data safe.
The Polyhedral Structures Laboratory is housed at the Pennovation Center and brings together designers, engineers, and computer scientists to reimagine the built world. Using graphic statics, a method where forces are mapped as lines, they design forms that balance compression and tension. These result in structures that use far fewer materials while remaining strong and efficient.
From ancient tombs and tiny robots to personalized gene editing and AI weather models, Penn’s 2025 research portfolio showed how curiosity—paired with collaboration—moves knowledge into impact and stretches across disciplines and continents.
Centering joy in AI development and implementation
PIK Professor Desmond Upton Patton—of Annenberg and SP2—and collaborators introduce a joy-informed framework designed to initiate conversations among engineers, designers, and researchers.
Reflecting on Jane Austen, 250 years after her birth
English professors Michael Gamer and Barri Joyce Gold have been teaching courses specifically dedicated to Jane Austen for years. They spoke with Penn Today about their approach to teaching her novels, how they challenge common readings and myths, and what makes Austen’s work so enduring—and adaptable to the screen—more than two centuries later.
Electronic medical records help save lives of HIV patients
Wharton’s Leandro “Leo” Pongeluppe and colleagues found that HIV clinics in Malawi that switched from paper to electronic medical records saw an estimated 28% reduction in deaths in five years.
