UIT recommends U web hosting services over third-party providers

Although more than 750 University of Utah websites are registered with Office of the University Webmaster, UIT web and information security team leaders estimate hundreds of unregistered sites exist. Many of those, they suspect, use third-party providers to host their websites or domain names.

Barb Iannucci, director for Web Support & Usability in UIT University Support Services (USS), said some website owners prefer using a service with a content management system (CMS) that’s flexible and familiar, or widely used, to bolster their resumes.

“It’s appealing to use CMS options they’ve worked with in a prior job. People don’t want to learn new things all the time,” she said. “And they want the flexibility to use a range of fonts and colors, which is understandable.”

Dustin Udy, associate director for Security Assurance in the U’s Information Security Office (ISO), understands the allure of third-party providers.

The perception is “external companies may scale faster. They may offer more features. They may cost less,” he said, adding that website owners also might use outside providers because they are unaware of university services, or university services may not offer hosting options that meet their needs or enough software development and/or support. That, however, doesn’t mean they are better or more secure.

While using an external provider for websites without sensitive data isn’t against university policy, Iannucci and Udy caution against it. Websites hosted by third parties often do not meet the university’s accessibility, branding, and IT security standards, potentially affecting the U’s reputation and safety. Udy and UIT Software Platform Services Director Kim Tanner recommend reviewing the services that the university offers and consulting U providers before using an external host.

The university’s internal website hosting services offer many of the same features as external providers, as well as institutional and IT security protections, alignment with university branding and web templates, compliance with accessibility standards, content and data ownership and portability, and a community of support.

Iannucci, who oversees UIT’s Modern Campus CMS service, said the university’s branding, accessibility, and IT security standards “contribute to a holistic approach, emphasizing not only the technical advantages but also the critical elements that contribute to a positive user experience and institutional cohesion.”

Michael Haggarton, associate director for Digital Experience for University of Utah Health Interactive Marketing & Web, agreed. His team oversees the web infrastructure for 30,000 U of U Health webpages, including academic medicine units like the College of Nursing, which are organized by departmental or service line hierarchies to ensure a consistent user experience for patients, faculty, and students.

“We afford a considerable degree of independence to content creators overseeing academic medicine webpages, coupled with comprehensive training and support to enable proficient management of their respective pages,” he said, noting that health care uses the Drupal CMS, which is hosted by Acquia. “Conversely, our health care website adheres to stricter controls, primarily to ensure patients encounter a uniform experience when accessing care services.”

Iannucci said there are other reasons to keep websites on campus, from payment card industry (PCI) compliance to integrations with other U-supported platforms and services. One issue she and Udy frequently see comes down to ownership.

Third-party hosts, they said, may not work with or support those who are not the registered website or domain owner. This usually becomes a problem when someone is out of the office or leaves the university and another person needs to make changes, but it also can prevent ISO staff from doing their jobs when IT security issues arise.

“We have no control over websites hosted by third-party services,” Udy said. “We cannot address IT security vulnerabilities or take down compromised websites because the ISO is not the customer. We have to track down the website owner or get the Office of General Counsel involved when, if it was hosted on U systems, we could simply ask the owner to turn off the website or escalate up their chain of command to have the site removed.”

Other downsides include limited or no control over patching and maintenance, longer waits for upgrades, lack of accountability, limited or no IT security vulnerability alerts, lack of control over your data, IT security risks and performance issues with shared hosting, and lack of compliance with university policy.

“In general, websites using external host providers are harder to secure,” he said.

Regardless of provider, Iannucci and Udy said website owners must comply with university policy, complete legal and purchasing processes, and add their sites to the web registry.

“You create a lot of additional risk for the university when you don’t follow policy or provide contact information so we can address issues, especially when using an external provider,” Udy said. “We should all be concerned about University of Utah websites, because they represent our brand, our name, and our organization.”

 

Node 4 Search