Cybercrime is a growing problem globally and the higher education sector is not immune to this threat, argues Colin Truran, Principal Technology Strategist, Quest Software.
As today’s modern campus relies on online services to power its learning and teaching environment, a greater number of devices belonging to students or staff connected to the network are exposing universities to cyberthreats.
In turn, valuable data such as breaking research, students’ personal information and employee information, which is collected and kept on file by universities is in danger of being used for nefarious means by hackers. In addition to data being misused, universities are at risk of suffering reputational damage if they are unable to keep their network safe.
The biggest cybersecurity threat
As universities own a wide pool of valuable data, their networks are being targeted by a range of different tactics such as phishing attacks or ransomware, as well as a range of hackers – from nation states, to traditional, independent hacking groups. However, recent findings by Jisc, UK’s not-for-profit organisation offering digital services and solutions to UK higher, further education and skills sectors, found that the biggest threat to universities cybersecurity are the students and staff.
Based on data which Jisc has been collecting for years, the organisation concluded that it is highly likely staff and students are to blame for attacks for one reason – timing. According to Jisc, attacks on universities dramatically decrease during holidays such as Christmas; Easter, half-terms or summer holidays.
This pattern could signal that attackers are in fact students or staff, or someone very familiar with the academic cycle. Additionally, Jisc found that attacks usually start between 8am and 9am, quieten around lunchtime but ramp up around 1pm and 2pm.
Look within the network
Students and staff are the core of each educational establishment and as such it is difficult to imagine the biggest cybersecurity threat coming from within. However, often times, the university’s large and inadequately secured network enables malicious activity by being an easy target.
Whilst universities are expected to offer all students the ability to connect their devices to the network and access the university’s digital services, this presents a challenge when it comes to preventing malicious activity and uncontrolled sensitive data sprawl due to poorly designed networks. These complex and large networks not only open universities to cyberthreats but also prevent the educational establishment from offering a stable, secure connection to its digital services for the many devices of students and staff.
An additional issue here is that creativity is not limited to just the students. For example, the university’s technology management teams, with their wide remit and increasingly low funds, often search and find ways to solve network problems with creative scripting and workarounds. This creativity leads to network environments which are highly complex, creating a much larger attack surface area as a result.
How can universities protect their networks and data?
In today’s world of rapid growth in personal devices, it is vital that universities implement radical changes to the design of networks. Universities must invest in their digital environment and ensure that they modernise data management practices, remove complexity and isolate sensitive services from student activity.
They also must enable the online environment to understand threats quickly and react accordingly. For example, AI threat detection and automated threat response can detect malicious activity and restructuring the environment can isolate sensitive services from student activity.
By restructuring and investing in their digital environment, universities will be able to offer internal and external nefarious attackers fewer opportunities to attack, as well as less time to do so.
Cybersecurity as a priority
The internal and external threat to universities’ cybersecurity is real and it is crucial that universities understand it as such. When it comes to data and network security, complacency is the real danger.
Universities should invest in their own cyberspace security and reduce the need for in-house security teams to become creative when it comes to network problem solving.
By investing in cybersecurity and redesigning their networks, universities can be safer from internal and external threats, keeping valuable data out of hands of hackers and networks up and running.
