Cyber Security In Higher Education

In response to the Coronavirus onslaught, higher education is rapidly migrating to remote and online learning and academic and IT leaders in the sector have faced an onslaught of challenges. Perhaps the greatest of these is the need for heightened cyber security, at the same time as budgets and resources are shrinking.
 
According to Bitdefender, the number of detected ransomware attacks, which paralyse victims’ systems or threaten to release confidential information until they pay a ransom, has increased by over 700% compared to the same period in 2019 and a significant trend which has emerged during the COVID-19 pandemic is an explosion in ransomware attacks on universities
 
Because higher education institutions have a low tolerance for downtime, store vast amounts of student and staff personal information, and keep valuable research data on file, they’re particularly vulnerable to this kind of cyber crime.  As thousands of students and staff now connect to educational networks remotely, COVID-19 has made breaching higher education networks even easier for threat actors. 
 
There have been around a thousand attacks a year targeting higher education institutions across the UK, often in the form of phishing and ransomware attacks that can leave staff and students open to account hacking, credential theft and credit card fraud and now the British  National Cyber Security Centre has issued a warning about the rising number of cyber-attacks against colleges and universities. It can take months or even years to recover after an attack, it is vital that higher education institutions identify where their cybersecurity risks lie and implement the right strategies to help maintain cybersecurity safeguards and protect data.
 
Strategies to Minimise Risk
 
To minimise risk and safeguard data, institutions must begin to adopt transparent strategies and policies. This includes backing up data and keeping it offline at certain points on a regular basis and monitoring network traffic and managing access controls. Additionally, with many thousands of staff and students to protect, active two-factor authentication should be considered to give every network user an extra element of security.
 
Higher education institutions must also plan for solutions in the event of a security breach and consider the possibility of shutting down an entire network or system for a period if needed. This potential plan will enable actions to respond to an attack and identify the infection point and reset and analyse the infrastructure allowing the institution to get back up and running safely. It will also allow the time to change passwords, update credentials and restore data as necessary as well as notify authorities of the breach as necessary to comply with data protection and security regulations.
 
Processing Data Securely
 
As universities and colleges process significant volumes of personal data, the sector must address how to do this securely and in a way that complies with the General Data Protection Regulation (GDPR). The most effective way is to establish governance for the protection of personal data, which starts with appointing a Data Protection Officer who will be responsible for ensuring that the institution maintains compliance and enforces and communicates a clear GDPR strategy across the community of the institution. 
 
As institutions are data controllers of student data, they must work with their technology partners to implement the right data platforms securely and safely to store and transmit both student data and other resources. The most effective solutions will be those with security based on authentication, authorisation, auditing and encryption. The authentication capabilities will allow the institution to verify the identity of all users, while authorisation ensures that users can access the resources that they need, and no others.
 
Such a solution should also be paired with tried and tested cyber security strategies through defining and putting into effect how an institution identifies, protects, detects, responds and recovers from cybersecurity events and incidents.
 
Key Issues For British Universities & Colleges
 
The key cyber threats to UK universities are most likely to be:
 
• Criminals seeking financial gain
• Nation states looking to steal personal data and intellectual property, for strategic advantage
 
Cyber crime will probably present the most evident and disruptive difficulties for universities. However, State-sponsored espionage is likely cause greater long-term damage. Likely effects of state espionage include:
 
• Damage to the value of research, notably in STEM subjects
• A fall in investment by public or private sector in affected universities
• Damage to the UK’s knowledge advantage  
 
In both culture and technology, universities are one of the most open and outward facing sectors. This enables and eases collaboration between academics across borders, unfortunately, this also eases the task of an attacker.
 
Cyber crime too will almost certainly continue to impact universities, either as a direct target or as collateral, regardless of the reputation and success of those universities targeted. If foreign direct investment were to come under greater scrutiny or restriction, it is a realistic possibility that the cyber threat to universities would increase, as nation states sought alternative ways to gain access to sensitive research and intellectual property.
 
While the methods employed by cyber criminals are constantly evolving, spear-phishing and ransomware are highly likely to remain the main attack vectors. Ransomware is likely to be the greatest single cause of disruption to staff, students and the universities themselves.
 
NCSC:      Infosecurity Magazine:        EdTech Magazine:       Morphisec:       Image: Unsplash
 
You Might Also Read: 
 
British Universities Shut Down By Cyber Attacks:
 
« How To Create Effective Cyber Security Training For Employees
Instagram, TikTok & Twitter Shutdown Stolen Accounts »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation is Europe's leading centre for research & education in cybersecurity, cybercrime and digital forensics.

RSA Security

RSA Security

RSA provide cybersecurity products for Threat Detection and Response, Identity and Access Management, Governance, Risk and Compliance, and Fraud Prevention.

Spanish National Cybersecurity Institute (INCIBE)

Spanish National Cybersecurity Institute (INCIBE)

INCIBE undertakes research, service delivery and coordination for building cybersecurity at the national and international levels.

Cyanre

Cyanre

Cyanre delivers state of the art cyber forensic services through software technologies and procedures that exceed conformities of major law enforcement agencies across the globe.

Alsid

Alsid

Alsid helps corporates to anticipate attacks by detecting breaches before hackers can exploit them.

CRI4DATA

CRI4DATA

CRI4DATA's mission is to help organizations build their resilience to cyber risk.

German Accelerator

German Accelerator

German Accelerator supports high-potential German startups in successfully entering the U.S. and Southeast Asian markets.

Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB)

Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB)

CMMC Accreditation Body implements the Cybersecurity Maturity Model Certification for the U.S. Department of Defense.

Syber Technology

Syber Technology

Syber Technology is an IT project implementer empowering IT systems of Small to Medium Enterprises in the Middle East.

FireCompass

FireCompass

FireCompass SAAS platform helps CISOs & Security Teams in continuous risk assessment by mapping your attack surface and knowing the “unknown unknowns”.

Institute for Security and Technology (IST)

Institute for Security and Technology (IST)

The Institute for Security and Technology's goal is to provide the tools and insights needed for companies and governments to outpace emerging global security threats.

CoreStack

CoreStack

CoreStack helps enterprises overcome cloud challenges such as ever growing security risks, stringent regulatory compliance needs and operational complexities.

SMARTEST

SMARTEST

SMARTEST is a world-class IT solutions provider active in the most challenging and demanding industries such as the oil and gas industries.

Probity

Probity

Probity Inc. is a certified software development and systems engineering company, providing support to federal government and national defense related clients.

Custodia Continuity

Custodia Continuity

Custodia Continuity manage your Security, Backup, Continuity and Compliance. You get on with your business.

Association of Azerbaijani Cyber Security Organizations (AKTA)

Association of Azerbaijani Cyber Security Organizations (AKTA)

The Association of Azerbaijani Cyber Security Organizations (AKTA) is a non-commercial organization aimed at strengthening the country's cybersecurity system.