What can be done right now (6)
Are the users sufficiently authenticated (at login time, when sending mail, etc.). Could the introduction of smartcards improve the overall security?
Are subnets sufficiently secured where sensitive data is processed? Some researchers work with data that would be of great value to interested parties outside the university, sometimes without being conscious of the risks involved