A Cyber Hygiene Badge for Student Organizations

If I Had One Small Budget to Test This Idea

Student clubs collect names, emails, event registrations, passwords, and sometimes payment information, but many operate with almost no cybersecurity practices.

Leadership changes every year, shared passwords circulate informally, and old officers may retain access to social media or cloud drives.

I would use that budget to test one thing: universities should offer a voluntary cyber hygiene badge to organizations that complete a short annual security checklist.

The First Version

• Enable multi-factor authentication on major accounts.
• Create at least two current administrators and remove former officers.
• Store passwords in an approved password manager rather than chat messages or spreadsheets.

I think the strongest argument for trying it is simple: the badge turns basic security into an ordinary part of club leadership transition.

The weakness is also clear. A badge could create false confidence if it is presented as proof that an organization is secure.

That is why I would not call the pilot successful simply because people liked the idea. Track account recovery incidents, unauthorized access reports, completion rates, and annual renewal.

The strongest version of this proposal would involve the people affected by the issue in reviewing the pilot and recommending changes.

Equity should be evaluated by examining who uses the program and who remains unable to access it.

A written operating guide would make the program easier to continue when staff or student leaders change.

Expansion should occur only after responsibilities for maintenance, supervision, and funding are clearly assigned.

Because the proposal is limited, it can be tested without redesigning the entire system around it.

The first year should focus on learning how people actually use the program rather than maximizing enrollment.

Any public communication should explain both eligibility and limitations in plain language.

Participants should have a simple way to report problems during the pilot instead of waiting for an end-of-year survey.

---

T. Nguyen