How leading university was able to monitor unauthorised changes to critical configurations