Higher Education: Lessons In Cybersecurity

Universities offer rich pickings for cyber criminals; they have access to research and intellectual property, as well as close ties to partner organisations (both commercial and non-commercial), that can provide a vital link to otherwise highly protected intellectual property.

This risk factor is compounded with the complex nature of information sharing in the higher education sector.  

The user population at universities is large and varied, including students, distance learners, lecturers, and partner institutions, with a proportion of these people having multiple roles (teacher and student for example).  In addition, there is a high annual turnover of user accounts due to students enrolling, leaving, taking on new academic roles, etc -making managing system access a challenging task.

The net result of this elaborate network is a large potential attack surface.  Combine that with the potential rewards for successful hackers, and it’s not hard to see why universities rank highly on the cyberattack hit list.

Daily Cyberattacks, With Research A Key Prize

This theory is backed up by research undertaken by Turnkey, 88% of people surveyed believed their higher education organisation was subject to a cyberattack at least once a day, while 91% said they were targeted as much as or more than the commercial sector.  

44% of respondents believed research was the biggest target for cyber criminals, compared to 32% saying it was financial information.

Reputation, Funds & Compliance Are At Risk

Reputational damage is seen to be the number one impact of a data breach (followed by loss of data, financial loss and non-compliance).  This is a big consideration for universities as it can impact student numbers and funding in the future. Interestingly however, 44% of respondents felt their organisation would feel a limited financial impact after a breach. This seems low, particularly in view of it going hand-in-hand with reputational damage. 

Equally, when it comes to longer-term impacts, the gravity of data loss and non-compliance should not be overlooked; academia is subject to the same data protection regulation as the commercial world – and that can mean significant fines.

Cyber Protection Is Low

Worryingly, however, despite the risks, threats and potential implications identified, 47% of people surveyed felt their organisation had only average or limited cyber resilience. 53% said they had average or weaker than average protection against impersonation attacks (when an attempt is made to gain unauthorised access to data, applications or systems by pretending to be an authorised user); this is significant in view of the type of information universities publish compared to a lot of corporates – it’s easy for bad actors to find the names of real people at the organisation and use them to gain unauthorised (but seemingly legitimate) access for example.

In terms of the risks, 53% of respondents said ransomware was the biggest cyber risk to their organisation, 24% stated phishing and 12% named spear phishing.

Remote Working Compounds The Threat

The pandemic and subsequent lockdowns proved it was possible to work and study remotely, and the current hybrid operations model that has evolved is potentially bad news for cybersecurity safety. 44% of people surveyed felt there had been a rise in access-related incidents since distance learning was introduced. (35% felt there wasn’t, 21% weren’t sure.)

Cyber Resilience Is Critical

These findings, echoed by various headlines and reports on cyberattacks at educational institutions, highlight the need for a risk-based approach to cybersecurity. If they aren’t already, universities should be adopting a systematic process that identifies, assesses, and prioritises the risks they face on an organisational basis – with this also addressing risks introduced by interfaces with partner enterprises. From there the appropriate mitigation strategies can be put in place, with these including the fast detection of an intrusion, and the ability to shut it down as quickly as possible to limit the scope of the attack. 

Other initiatives include Identity and Access Management (IAM); limiting the access that people have to the information and applications they need to do their job minimises the damage that a bad actor infiltrating the system can do. Given the often-transient nature of the sector, the Joiners and Leavers process is also a core element, allowing as it does permissions to be managed as people join, leave, and move round the organisation.

Multi Factor Authentication (MFA) is another tool that is increasingly being used to prevent impersonation, while focusing on basics such as ensuring a proactive patch strategy is in place and operational should be a given.

Regular reporting to management teams ensures visibility and means they know and understand the risks (as well as the work that is done daily to prevent and mitigate attacks); this is also a lever when applying for budgets to fund cyber resilience initiatives. 

There is no silver bullet, but with higher education organisations firmly in the sights of unscrupulous operators, cyber resilience needs to be a core element of the IT security curriculum. 

Chris Boyle is Practice Director – Identity & Access Management at Turnkey Consulting

You Might Also Read:

Who Was Responsible For Hacking Both IBM & Stanford University?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Effective Enterprise Vulnerability Management & Compliance
Breach Will Cost Capita At Least £20m »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

KPN Security

KPN Security

KPN Security is the largest and most complete provider of IT security services in the Netherlands.

Secure-NOK

Secure-NOK

Secure-NOK provides products and solutions that detect and remove security attacks and harmful events in industrial networks and control systems.

Tempered Networks

Tempered Networks

Tempered Networks delivers the first purpose-built platform for IIoT cybersecurity that allows customers to connect and secure devices in minutes without the need for specialized skills.

DataArt

DataArt

DataArt is a global technology consultancy that designs, develops and supports unique software solutions. Areas of activity include software security testing.

Styra

Styra

Styra allows companies to secure cloud environments and applications, including those built on the popular Kubernetes open-source cloud platform.

Netsecurity AS

Netsecurity AS

Netsecurity is a Norwegian owned company focused and specialised within IT security and cybersecurity-as-a service.

Diateam

Diateam

Diateam is an R&D company specializing in computer security. Diateam develops highly innovative cyber range platforms and Industry-leading systems for cybersecurity training and testing labs.

SecondWrite

SecondWrite

SecondWrite’s next-generation malware detection engine delivers a combination of automatic deep code inspection and accurate scoring of zero-day malware.

doIT Solutions

doIT Solutions

doIT solutions specialize in IT security and infrastructure, security automation, data center, and cybersecurity.

Lockheed Martin

Lockheed Martin

Lockheed Martin deliver full-spectrum cyber capabilities and cyber resilient systems to defense, intelligence community and global security customers.

Digital Element

Digital Element

Digital Element is a global IP geolocation and intelligence leader with unrivaled expertise in leveraging IP address insights to deliver new value to companies.

Surfshark

Surfshark

Surfshark is a cybersecurity company focused on developing humanized privacy & security protection solutions to secure people's digital lives.

BlueCat Networks

BlueCat Networks

BlueCat is the Adaptive DNS company. Our mission is to help the world’s largest organizations thrive on network complexity, from the edge to the core.

6WIND

6WIND

6WIND deliver virtualized, cloud-native, distributed high performance & secure networking software solutions to support new applications such as 5G, IoT, SD-WAN.

EK3 Technologies

EK3 Technologies

EK3 Technologies mission is to provide comprehensive cybersecurity and IT solutions that allow our clients to focus on sustaining their business.

Cyber Security Centre for the Isle of Man (CSC)

Cyber Security Centre for the Isle of Man (CSC)

The Cyber Security Centre for the Isle of Man is responsible for the delivery of the Isle of Man National Cyber Security Strategy.