Digital systems at ICU | Imperial College Union

An update on how we're improving our digital systems at ICU (and our response to the PHP vulnerability).

Improving the student digital experience.

In the last academic year, students asked for improvements across ICU systems.

Here's what we've done so far:

We commissioned a student to produce a report on the user experience of our main website, and in September and October, we implemented improvements across the menu and website structure;
We addressed some of challenges alumni were having purchasing and using their life memberships on the online shop;
We have been working with our shop provider SUMS to launch an improved shop for Term 1 and are about to start testing with a group of students. This is part of a roadmap we have developed for our use of SUMS;
We have completed our tender for a new tills (electronic point of sale) platform and are working with the university around how we can install the system;
We have commissioned an external consultant to review how we use systems and work with us to develop them further, in line with our strategy to improve the overall student digital experience.

Our response to the website cyber-security flaw

You may have seen in the news yesterday that serious security vulnerabilities were announced in a programming language called PHP, used widely across the internet, including platforms built by and used by ICU.

As soon as the vulnerability was made public, we assessed the impact, particularly on systems used regularly by students such as eActivities, eVoting and the online shop. We monitored the situation closely and our initial review found no evidence of attempts to exploit these vulnerabilities.

As a precaution we disabled several functionality areas before patches were available. This allowed us to keep platforms available but with reduced capability for a temporary period, an approach mirrored by our online shop provider SUMS to protect their systems.

Full functionality was restored by the end of the day, after vulnerable systems were patched with the latest security updates. We will continue to review and monitor all systems, including exploring any further action needed to protect our systems and student data.