Higher Education: Lessons In Cybersecurity

Universities offer rich pickings for cyber criminals; they have access to research and intellectual property, as well as close ties to partner organisations (both commercial and non-commercial), that can provide a vital link to otherwise highly protected intellectual property.

This risk factor is compounded with the complex nature of information sharing in the higher education sector.  

The user population at universities is large and varied, including students, distance learners, lecturers, and partner institutions, with a proportion of these people having multiple roles (teacher and student for example).  In addition, there is a high annual turnover of user accounts due to students enrolling, leaving, taking on new academic roles, etc -making managing system access a challenging task.

The net result of this elaborate network is a large potential attack surface.  Combine that with the potential rewards for successful hackers, and it’s not hard to see why universities rank highly on the cyberattack hit list.

Daily Cyberattacks, With Research A Key Prize

This theory is backed up by research undertaken by Turnkey, 88% of people surveyed believed their higher education organisation was subject to a cyberattack at least once a day, while 91% said they were targeted as much as or more than the commercial sector.  

44% of respondents believed research was the biggest target for cyber criminals, compared to 32% saying it was financial information.

Reputation, Funds & Compliance Are At Risk

Reputational damage is seen to be the number one impact of a data breach (followed by loss of data, financial loss and non-compliance).  This is a big consideration for universities as it can impact student numbers and funding in the future. Interestingly however, 44% of respondents felt their organisation would feel a limited financial impact after a breach. This seems low, particularly in view of it going hand-in-hand with reputational damage. 

Equally, when it comes to longer-term impacts, the gravity of data loss and non-compliance should not be overlooked; academia is subject to the same data protection regulation as the commercial world – and that can mean significant fines.

Cyber Protection Is Low

Worryingly, however, despite the risks, threats and potential implications identified, 47% of people surveyed felt their organisation had only average or limited cyber resilience. 53% said they had average or weaker than average protection against impersonation attacks (when an attempt is made to gain unauthorised access to data, applications or systems by pretending to be an authorised user); this is significant in view of the type of information universities publish compared to a lot of corporates – it’s easy for bad actors to find the names of real people at the organisation and use them to gain unauthorised (but seemingly legitimate) access for example.

In terms of the risks, 53% of respondents said ransomware was the biggest cyber risk to their organisation, 24% stated phishing and 12% named spear phishing.

Remote Working Compounds The Threat

The pandemic and subsequent lockdowns proved it was possible to work and study remotely, and the current hybrid operations model that has evolved is potentially bad news for cybersecurity safety. 44% of people surveyed felt there had been a rise in access-related incidents since distance learning was introduced. (35% felt there wasn’t, 21% weren’t sure.)

Cyber Resilience Is Critical

These findings, echoed by various headlines and reports on cyberattacks at educational institutions, highlight the need for a risk-based approach to cybersecurity. If they aren’t already, universities should be adopting a systematic process that identifies, assesses, and prioritises the risks they face on an organisational basis – with this also addressing risks introduced by interfaces with partner enterprises. From there the appropriate mitigation strategies can be put in place, with these including the fast detection of an intrusion, and the ability to shut it down as quickly as possible to limit the scope of the attack. 

Other initiatives include Identity and Access Management (IAM); limiting the access that people have to the information and applications they need to do their job minimises the damage that a bad actor infiltrating the system can do. Given the often-transient nature of the sector, the Joiners and Leavers process is also a core element, allowing as it does permissions to be managed as people join, leave, and move round the organisation.

Multi Factor Authentication (MFA) is another tool that is increasingly being used to prevent impersonation, while focusing on basics such as ensuring a proactive patch strategy is in place and operational should be a given.

Regular reporting to management teams ensures visibility and means they know and understand the risks (as well as the work that is done daily to prevent and mitigate attacks); this is also a lever when applying for budgets to fund cyber resilience initiatives. 

There is no silver bullet, but with higher education organisations firmly in the sights of unscrupulous operators, cyber resilience needs to be a core element of the IT security curriculum. 

Chris Boyle is Practice Director – Identity & Access Management at Turnkey Consulting

You Might Also Read:

Who Was Responsible For Hacking Both IBM & Stanford University?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Effective Enterprise Vulnerability Management & Compliance
Breach Will Cost Capita At Least £20m »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CDW

CDW

CDW is a leading multi-brand provider of information technology solutions to business, government, education and healthcare customers in the United States, the United Kingdom and Canada.

National Cyber Security Centre (NKSC) - Lithuania

National Cyber Security Centre (NKSC) - Lithuania

NKSC is the main Lithuanian cyber security institution, responsible for unified management of cyber incidents, monitoring and control of the implementation of cyber security requirements.

QMS International

QMS International

QMS is one of the leading ISO certification bodies in the UK and serves clients worldwide.

Secure Recruiting International (SRI)

Secure Recruiting International (SRI)

SRI is an industry leader in Information Security , Networking, Wireless and Storage recruitment.

TI Safe

TI Safe

TI Safe provide cybersecurity solutions for industrial networks of main critical infrastructures in Latin America.

Real Random

Real Random

Real Random is on a mission to enhance existing and new crypto-systems with its revolutionary solution to generating numbers that are Truly Random.

Tehtris

Tehtris

TEHTRIS XDR Platform was developed to control and improve the IT security of private and public companies against advanced cyber threats such as cyber espionage or cyber sabotage activities.

oneclick

oneclick

oneclick is a central access and distribution platform in the cloud, enabling the management of the entire technology stack for application provisioning.

CyberPion

CyberPion

Cyberpion’s groundbreaking platform enables security teams to identify and neutralize threats stemming from vulnerabilities within online assets throughout an enterprise’s ecosystem.

NSR

NSR

NSR provide trusted solutions that deliver positive business outcomes for our clients in cybersecurity and data protection challenges.

Cyber Chasse

Cyber Chasse

Cyber Chasse is an IT consulting and staffing company offering a full range of cybersecurity solutions, contract staffing services and online training courses.

Aite-Novarica Group

Aite-Novarica Group

Aite-Novarica's Cybersecurity practice provides ongoing research and advisory services to chief information security officers focused on protecting their companies’ assets.

LayerX Security

LayerX Security

LayerX's user-first browser security platform turns any browser into the most protected & manageable workspace, by providing real-time monitoring and governance over users’ activities on the web.

ASPIA InfoTech

ASPIA InfoTech

ASPIA Infotech is a leading Information and cybersecurity organization focused on innovative approaches to avert targeted attacks.

SkillsDA

SkillsDA

SkillsDA is pureplay company in cyber security involved in capacity building towards National Security.

Cognna

Cognna

Cognna's innovative platform is designed to empower you and your team, providing the tools you need to detect, prevent, and resolve threats with ease.