British University Data Breaches Are A Lesson For All

Data breaches have been back in the headlines recently after hackers found a way to break in the Progress Software MOVEit transfer tool.  The hack was predicted to give hackers personal details of over 100,000 employees of some of the world’s best known organisations, through no fault of their own.

Sadly, this episode has been another example of the risk posed by supply chain attacks, where a hacker attacks a third-party provider with the aim of causing disruption, or gaining access to the systems of another company in the supply chain to impact them directly.  

This can be by encrypting their data, as was experienced with the NHS data breach - which affected the entire country by comprising the personal data of over a million patients and caused operational systems to be taken offline. 

Higher Education’s Higher Risk

These attacks should not be viewed as only impacting large enterprises or suppliers to those organisations. Our own research of online criminal markets has found that UK universities are at high risk of major cyber security incidents being launched using breached login credentials.  Our Trillion team discovered 2.2 million breached credentials available on the dark web for the top 100 UK institutions, with 57% belonging to the 24 Russell Group Universities.  The University of Manchester found itself in the news previously over emails threatening a data breach, and is working with the ICO to investigate. It won’t be the last.

To put these figures in perspective, there were over 2.41m staff and students at UK universities in the 21/22 academic year (HESA student and staff records) studying for degrees, including 679,000 students from outside the UK. The potential reach and impact of a breach is serious, placing personal information at risk and disrupting the studies of millions that have chosen the UK as the place to invest for their future.

It's Not Just The Students At Risk

It would be easy to think that this is just a risk for the students and staff whose details have been breached.  However, the UK university sector is renowned for the quality of its research facilities, driving innovation across many sectors including healthcare and technology, as well as government funded programmes of national importance such as nuclear energy and defence.  Considering the following figure through that lens is more worrying – 54% of the breached credentials we found came from UK universities with research facilities.

UK universities and research facilities are among the most respected in the world, and protecting that reputation includes protecting the students, staff and information that is shared with them for research projects by government, the public and private sector, through effective cyber security practices.  

The challenge for the sector, is that higher education environments are amongst the most uniquely challenging to protect with overlapping requirements for secrecy and openness - so many attack paths need to be factored.

A Lesson For All, Not Just Higher Education

There are best practices that every higher education institute should employ, but they are not unique to that sector. And regardless of those processes every organisation should be proactively monitoring for stolen credentials, as these could be revealed through a third party breach somewhere else in the supply chain, or through a service that a member of staff uses in their personal life.

Every organisation should consider whether it has strong enough policies and processes in place in the following areas:

  • Use Two Factor Authentication (2FA) on user accounts - Using 2FA on internal systems is a good start. But this does not always protect you when working with external partners, such as law firms, expense portals etc, as their systems may not require it. So, you should always remain vigilant.
  • Does single sign-on (SSO) protect us? Not really. If an attacker can obtain a valid password for your SSO application then they can use it for wider access. If they can access your email account then they can probably request password resets, which they can then carry out.
  • Resetting passwords is only a temporary fix - The problem goes away until one of your new passwords is leaked again by another site you are using. So you need to maintain an ongoing process of protection.
  • Have a policy that enforces complex passwords - The NCSC website has good guidance on choosing secure passwords. But remember your passwords still need to be unique for each website. And even a complex password, if it’s stolen from a 3rd party, can still be used against you.

It is impossible to be 100% secure, and that should always be the mindset, but by putting in place the systems and processes outlined above, all organisations can go a long way to protecting their staff, students, partners and supply chains from becoming victims of a data breach that could have far reaching consequences.

Stuart Jubb is UK Group Managing Director at Crossword Cybersecurity

You Might Also Read: 

Higher Education: Lessons In Cybersecurity:

 


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Protecting Your Home Devices Against Attack
Have We Become Complacent About The ‘Insider Threat’? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Dtex Systems

Dtex Systems

Dtex combines endpoint visibility, targeted analytics, and analyst expertise to provide user threat detection.

CERT-MU

CERT-MU

CERT-MU is the Mauritian National Computer Security Incident Response Team.

Ubiq Security

Ubiq Security

Ubiq has developed a software solution that secures any type of data, on any device, anywhere, with nearly no impact to system performance or user experience.

Bavarian IT Security Cluster

Bavarian IT Security Cluster

The Bavarian IT Security Cluster works to build regional IT security competencies and increase the competitiveness and market opportunities of its member companies.

CodeSealer

CodeSealer

CodeSealer provide invisible end-to-end user interface protection with a unique web security solution to eliminate Man-in-the-Middle and Man-in-the-Browser vulnerabilties.

Herbert Smith Freehills

Herbert Smith Freehills

Herbert Smith Freehills is a leading professional services including data protection and privacy.

CyberGRX

CyberGRX

The CyberGRX Exchange and our risk assessments-as-a-service help Enterprises and Third Parties cost-effectively identify, prioritize and mitigate risk.

PROOF

PROOF

PROOF is a Brazilian leader in cybersecurity. Our goal is to assist our Customers in managing security efficiently and in tune with business needs.

Alias Robotics

Alias Robotics

Alias Robotics is a robot cyber security company. We deliver cyber security solutions for robots and robot components.

GitProtect.io

GitProtect.io

​GitProtect is a fully manageable, professional GitHub and Bitbucket backup and recovery software that protects repositories and metadata from any event of failure.

Ward Solutions

Ward Solutions

Ward Solutions are an information security consultancy and managed services company. We help organisations protect their brand, people, assets, intellectual property and profits.

Defentry

Defentry

Defentry have created an Ecosystem that lets our users easily monitor, train and resolve their digital security issues.

SoftwareONE

SoftwareONE

SoftwareONE is a leading global provider of end-to-end software and cloud technology solutions.

ConvergePoint

ConvergePoint

ConvergePoint is the leading compliance software provider on the Microsoft Office 365 SharePoint platform.

Washington Technology Solutions (WaTech)

Washington Technology Solutions (WaTech)

WaTech operates the state’s core technology infrastructure – the central network and data center, provides strategic direction for cybersecurity and protects state networks from growing cyber threats.

Emircom

Emircom

Emircom is one of the Middle East's leading independent providers of IT infrastructure services, helping clients to drive growth and deliver measurable outcomes.