Higher Education: Lessons In Cybersecurity

Universities offer rich pickings for cyber criminals; they have access to research and intellectual property, as well as close ties to partner organisations (both commercial and non-commercial), that can provide a vital link to otherwise highly protected intellectual property.

This risk factor is compounded with the complex nature of information sharing in the higher education sector.  

The user population at universities is large and varied, including students, distance learners, lecturers, and partner institutions, with a proportion of these people having multiple roles (teacher and student for example).  In addition, there is a high annual turnover of user accounts due to students enrolling, leaving, taking on new academic roles, etc -making managing system access a challenging task.

The net result of this elaborate network is a large potential attack surface.  Combine that with the potential rewards for successful hackers, and it’s not hard to see why universities rank highly on the cyberattack hit list.

Daily Cyberattacks, With Research A Key Prize

This theory is backed up by research undertaken by Turnkey, 88% of people surveyed believed their higher education organisation was subject to a cyberattack at least once a day, while 91% said they were targeted as much as or more than the commercial sector.  

44% of respondents believed research was the biggest target for cyber criminals, compared to 32% saying it was financial information.

Reputation, Funds & Compliance Are At Risk

Reputational damage is seen to be the number one impact of a data breach (followed by loss of data, financial loss and non-compliance).  This is a big consideration for universities as it can impact student numbers and funding in the future. Interestingly however, 44% of respondents felt their organisation would feel a limited financial impact after a breach. This seems low, particularly in view of it going hand-in-hand with reputational damage. 

Equally, when it comes to longer-term impacts, the gravity of data loss and non-compliance should not be overlooked; academia is subject to the same data protection regulation as the commercial world – and that can mean significant fines.

Cyber Protection Is Low

Worryingly, however, despite the risks, threats and potential implications identified, 47% of people surveyed felt their organisation had only average or limited cyber resilience. 53% said they had average or weaker than average protection against impersonation attacks (when an attempt is made to gain unauthorised access to data, applications or systems by pretending to be an authorised user); this is significant in view of the type of information universities publish compared to a lot of corporates – it’s easy for bad actors to find the names of real people at the organisation and use them to gain unauthorised (but seemingly legitimate) access for example.

In terms of the risks, 53% of respondents said ransomware was the biggest cyber risk to their organisation, 24% stated phishing and 12% named spear phishing.

Remote Working Compounds The Threat

The pandemic and subsequent lockdowns proved it was possible to work and study remotely, and the current hybrid operations model that has evolved is potentially bad news for cybersecurity safety. 44% of people surveyed felt there had been a rise in access-related incidents since distance learning was introduced. (35% felt there wasn’t, 21% weren’t sure.)

Cyber Resilience Is Critical

These findings, echoed by various headlines and reports on cyberattacks at educational institutions, highlight the need for a risk-based approach to cybersecurity. If they aren’t already, universities should be adopting a systematic process that identifies, assesses, and prioritises the risks they face on an organisational basis – with this also addressing risks introduced by interfaces with partner enterprises. From there the appropriate mitigation strategies can be put in place, with these including the fast detection of an intrusion, and the ability to shut it down as quickly as possible to limit the scope of the attack. 

Other initiatives include Identity and Access Management (IAM); limiting the access that people have to the information and applications they need to do their job minimises the damage that a bad actor infiltrating the system can do. Given the often-transient nature of the sector, the Joiners and Leavers process is also a core element, allowing as it does permissions to be managed as people join, leave, and move round the organisation.

Multi Factor Authentication (MFA) is another tool that is increasingly being used to prevent impersonation, while focusing on basics such as ensuring a proactive patch strategy is in place and operational should be a given.

Regular reporting to management teams ensures visibility and means they know and understand the risks (as well as the work that is done daily to prevent and mitigate attacks); this is also a lever when applying for budgets to fund cyber resilience initiatives. 

There is no silver bullet, but with higher education organisations firmly in the sights of unscrupulous operators, cyber resilience needs to be a core element of the IT security curriculum. 

Chris Boyle is Practice Director – Identity & Access Management at Turnkey Consulting

You Might Also Read:

Who Was Responsible For Hacking Both IBM & Stanford University?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Effective Enterprise Vulnerability Management & Compliance
Breach Will Cost Capita At Least £20m »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Via Resource

Via Resource

Via Resource is a leading provider of information security recruitment and consultancy services.

Varonis

Varonis

Varonis provide a security software platform to let organizations track, visualize, analyze and protect their unstructured data.

National Cyber Directorate Israel

National Cyber Directorate Israel

The Israeli National Cyber Directorate provides incident handling services for civilian entities and critical infrastructures and works to increase national resilience against cyber threats.

Advenica

Advenica

Advenica develops, manufactures and sells innovative cybersecurity solutions for encryption and secure information exchange.

National Cyber Security Centre Portugal (CNCS)

National Cyber Security Centre Portugal (CNCS)

CNCS is the operational coordinator and Portuguese national authority in cybersecurity working with State entities, and digital service providers

GuidePoint Security

GuidePoint Security

GuidePoint Security provide information security solutions that enable commercial and federal organizations to more successfully achieve their security and business goals.

Accolade Technology

Accolade Technology

Accolade provides the most technologically advanced host cpu offload, 100% packet capture FPGA-based PCIe adapters and 1U platforms available in the network monitoring and cyber security markets.

Ekran System

Ekran System

Ekran System is an advanced insider threat detection solution for companies of any size.

Myra Security

Myra Security

The fully automated Myra DDoS Protection reliably protects web applications, websites, DNS servers, and IT infrastructures.

TeskaLabs

TeskaLabs

TeskaLabs is a software vendor of cybersecurity and data privacy products.

Option3Ventures (O3V)

Option3Ventures (O3V)

Option3Ventures LLC specializes in finding and developing attractive investment opportunities at the frontiers of cybersecurity and immediately adjacent technologies.

FireCompass

FireCompass

FireCompass SAAS platform helps CISOs & Security Teams in continuous risk assessment by mapping your attack surface and knowing the “unknown unknowns”.

Stratum Security

Stratum Security

Stratum Security is an information security consulting company that focuses on providing clear and concise risk guidance to its clients through high quality assessment services.

QAlified

QAlified

QAlified offer independent testing and quality assurance services for software projects including security testing.

Althammer & Kill

Althammer & Kill

Althammer & Kill offers pragmatic solution concepts for data protection and digitization. We advise in the field of data protection, information security and compliance.

Gorilla Technology Group

Gorilla Technology Group

Gorilla specializes in video analytics, OT network security and big data to support a wide range of solutions for commercial, industrial, cities and government purposes.