One of the first significant data breaches to impact a college campus hit Ohio State University in 2010, involving the records of more than 700,000 people affiliated with the school. While there has never been evidence that records were stolen, the event was a wake-up call for Ohio State and other major universities, said Dave Kieffer, an information technology leader at Ohio State at the time of the breach. The threat then was novel, but colleges have become more proactive in addressing such risks over the past decade. Cybercriminals target colleges for a few reasons, said Kieffer, a research vice president with the Tambellini Group, an IT consulting firm.
For one, the diversity of campus functions makes building a comprehensive security program challenging. Institutions also house many digital identities, making them a treasure trove for hackers. On campuses conducting research, intellectual property has also increasingly been targeted. Aging IT infrastructure, common across campus, complicates the situation by making it harder to store or transmit data securely, said Jesse Beauman, the assistant vice chancellor for enterprise infrastructure at the University of North Carolina at Charlotte.
When the pandemic forced most colleges to move the bulk of classes and activities online last spring, it raised the level of cybersecurity risk created by these kinds of vulnerabilities. Although students and staff were distributed globally, cybersecurity systems had to be maintained.
Pandemic-era security risks
Security threats could appear minor. At Mt. Hood Community College in Oregon, faculty and staff primarily use devices the college provides. Still, as most employees began to work from home, they used more personal laptops, tablets, and phones to do their jobs. This became one of Mt. Hood’s “biggest pain points” during the transition to remote operations, especially when it came to ensuring employees could access the college’s internal systems through virtual private network (VPN) connections, Blake Brown, Mt. Hood’s infrastructure manager, and Chris Neal, a cybersecurity specialist at the college, said in an email.
Two of the most significant risks to colleges’ networks are unsecured WiFi connections and weak password management, leading to stolen login credentials. Requiring VPN use took care of the need for a secure connection, but instituting safer login access was more challenging. The college launched a new multi-factor authentication solution, new to many Mt. Hood employees. Multi-factor authentication requires people to provide two or more pieces of information, such as a password and a code received through a text message (SMS), to access a system. Its novelty meant Brown and Neal also had to do a fair amount of training and communicate about the change before it launched.
Schools are also vulnerable by using unpatched and unsupported software and operating systems, such as Windows XP or Windows 7. This behavior has attracted a type of cyberattack called ransomware, in which attackers encrypt their target’s files and demand payment to restore access. According to one recent report, ransomware attacks against higher education institutions doubled between 2019 and 2020, costing them $447,000 on average. The report explains that it is the No. 1 cyber threat to universities, ahead of data breaches and data theft by nation-states.
“Most ransomware attacks start with phishing, which targets users on any device and within any messaging application (email, SMS, and social media) that allows cybercriminals to send malicious links to unsuspecting users,” said Hank Schless, senior manager for security solutions at cybersecurity firm Lookout, in an email. Clicking on the link or opening the attachment in a phishing email results in a malware download or stolen login credentials.
Data breaches have also focused on colleges in recent years. The technologies used during the pandemic for remote teaching, learning, and managing daily operations have opened new doors for cybercriminals, making schools even more vulnerable to their attacks, said Kashif Hafeez, senior director at security firm WhiteHat. Remote learning and working provide more chances to share sensitive information over unsecured networks or share sensitive data with unauthorized people. Data breaches aren’t just caused by malicious outsiders and inadvertently by insiders who, for example, send a spreadsheet with student records in an unencrypted email, violating data privacy rules.
Nation-states, meanwhile, are often after research and intellectual property. But because these attacks can be on classified information, they are usually withheld from public knowledge. The full extent of the pandemic’s impact on campus cybersecurity won’t be apparent for some time, but there are signs higher education has been under attack. Last spring, Michigan State University and the University of California, San Francisco’s medical school, were ransomware attacks. In the previous year, a wide swath of institutions has dealt with hackers who infiltrated virtual classrooms with disruptive and in some cases, racist or pornographic images. More recently, the Maricopa Community Colleges in Arizona extended spring break by a week to give officials time to address a cyberattack targeting its computer networks. And the Federal Bureau of Investigation warned colleges in March of an increase in a specific ransomware attack aimed at education institutions in 12 U.S. states.
Reducing risk on campus
Cyberattacks are costly to colleges and stakeholders whose personal information is impacted. To improve security as institutions rely more on digital tools for teaching and learning, campus leadership should consider the following:
- The university is accountable when a security incident occurs, not IT or the cybersecurity team. Therefore, cybersecurity and risk management should concern leadership, starting with the president and the governing board.
- IT budgets should consider ongoing expenses for upgrades to software, hardware, and the network.
- One person will have multiple digital identities due to unconnected internal campus networks. Consider network consolidation that decreases the number of identities and implements identity and access management systems.
- Require multi-factor authentication for all network connections.
- Use data management programs that allow IT and security teams to understand better internal data — what you have, where, and how it moves. The more you know your data, the better you can protect it.
- Institute data backup systems that aren’t connected to your internal network. You can use the backup to keep operations running if there is a ransomware attack.
- Remember that most students have grown up on computers and may not be sensitive to privacy and security concerns. Security awareness training should be required for all students, faculty, and staff.
