Emerging Cybersecurity Best Practices in Higher Education

Cybersecurity is a critical issue for universities and other institutions of higher education. These institutions already are high-value targets for cyberattacks. Now, as colleges and universities embrace remote learning environments and as they continue to adopt new connected technologies, new cybersecurity threats are emerging they must learn to address directly.

 

Unfortunately, many of these institutions are not fully prepared to deal with these new threats. For example, 92% of higher education institutions in the UK identified breaches or attacks in the past 12 months, Times Higher Education reports. “It’s not a matter of if your institution will be hit by a cyberattack but when,” The author continues.

 

In this article, we consider the top cybersecurity challenges facing higher education institutions and what steps these institutions can take to protect themselves. We identify the most common cybersecurity threats and determine what technologies and capabilities institutions should consider adopting to address these threats.

 

Why is Cybersecurity So Important in Higher Education?

Throughout the COVID-19 pandemic, institutions of higher education were forced to rapidly expand their digital infrastructure in support of distance learning environments they may not have prepared for or considered previously. For many institutions, their rapid expansion has “created new entry points for cybercriminals to leverage malware and other malicious tactics to extract data, force ransom payments, and wreak havoc,” as Higher Ed Dive describes.

 

Inherent Vulnerabilities

But even without new developments associated with distance learning, “cybersecurity at colleges is extremely challenging,” as Security Intelligence describes. For years, these institutions have had unique vulnerabilities that differentiate them from other frequent targets in both the public and private sectors. For example:

 

• Universities are often large and decentralized, with multiple departments and subgroups that may not all have the same cybersecurity  standards or protocols. Weaker cybersecurity practices in one area can create vulnerabilities that malicious actors can exploit.

• Universities typically have many third-party vendors and partners, which can further complicate cybersecurity efforts and make it more difficult for institutions to keep track of their cybersecurity practices.

• Many higher education institutions rely on shared IT systems and databases, which can increase their exposure to cybersecurity risks.

 

Cybersecurity Shortcomings

Even IT and organizational leaders at these institutions who wish to take their cybersecurity seriously may struggle to do so. Many higher education institutions are understaffed and under-budgeted for cybersecurity. This makes achieving leading cybersecurity capabilities difficult, as does the high and competitive demand for cybersecurity skills in the open market.

 

This lack of cybersecurity resources can create gaps in their cybersecurity protections, making it hard to keep up with the evolving threats that need to be addressed. “Ransomware attacks in higher education are on the rise,” says Security Intelligence. “Institutions should take a look at their budgets before an attack happens and focus on digital defense.”

 

Reputation & Prestige

Institutions of higher education have unique risks due to the industry in which they operate as well, specifically regarding their reputation and prestige—critical elements to their ongoing success. “One successful data breach can trigger significant ramifications not only for an institution’s finances but also for its reputation and prestige,” as Higher Ed Dive describes. While these factors impact all public and private sector organizations, damage to a college or university’s brand can be particularly devastating in terms of their future appeal among prospective students and parents. 

 

The Biggest Cybersecurity Threats Facing Institutions Today

Institutions of higher education face many of the same threats private companies and public sector organizations face regularly. However, even the same types of attacks can have a unique impact on these institutions due to their size, scope, and structure. Some of the biggest cybersecurity threats facing higher education institutions today include:

 

• Phishing and other social engineering attacks that target students, faculty, or staff. These attacks may aim to steal sensitive information or trick users into opening malware.

• Cyberattacks that exploit network vulnerabilities by taking advantage of outdated software or cybersecurity practices.

• Distributed denial-of-service (DDoS) attacks that overload networks and prevent users from accessing systems or data.

• Ransomware attacks, in which hackers take control of an organization’s files and threaten to delete them unless a ransom is paid. These are particularly risky given the decentralized nature of many institutions’ digital infrastructure, hence the potential vulnerability of niche but sensitive and valuable data.

 

While these are just some of the most common cybersecurity threats facing higher education institutions today, they highlight the broader need for robust cybersecurity practices and technologies.

 

A Closer Look at Ransomware Attacks in Higher Education

In 2022, a “Ransomware Gang” called BlackCat attacked North Carolina A&T University during its Spring Break period, “continuing a longstanding trend of ransomware groups attacking [higher ed] victims when they know security teams will be at their smallest,” The Record reports. In addition to stealing the personal information of students, faculty, and staff—including social security numbers—the attack “disrupted the school’s wireless connections, Blackboard instruction, single sign-on websites, VPN, Jabber, Qualtrics, Banner Document Management and Chrome River,” according to The Record.

 

Here, the unique elements of both the university’s operational tendencies (i.e., Spring Break) and the unique vulnerabilities created by the university’s size, scope, and structure (i.e., reliance on a wide variety of technologies) were exploited by cybercriminals to launch a successful ransomware attack.

 

And according to the University’s staff, although the breach was atypical, the attempt itself was not. “[This] is a part of an overall dynamic where literally hundreds of thousands of hack attempts are made daily on institutions like ours,” said Todd Simmons, the Vice-Chancellor of University Relations, as The Record reports. “We avoid 99.9% of those hacks, but it only takes one to compromise your system.”

 

Cybersecurity Capabilities Available to Higher Ed Institutions

Institutions of higher education can take steps today that will reduce the frequency and potential impact of breaches well into the future. There are several cybersecurity best practices that colleges and universities can adopt to protect themselves from these threats, and innovative technologies that can help them overcome shortcomings with their internal security teams.

 

First, let’s consider some of the capabilities colleges, universities, and similar institutions should consider:

 

Zero-Trust Security

This cybersecurity framework shifts the focus from protecting individual devices and digital assets to restricting access to data and systems on a per-user basis. By limiting network access based on context (e.g., location, device, behavioral patterns), colleges can reduce the risk of cyberattacks while still enabling users to access what they need.

 

Multi-Factor Authentication (MFA)

MFA is a critical cybersecurity control that can help institutions prevent unauthorized access to sensitive data. By requiring users to authenticate using multiple factors (e.g., a password and/or biometric information such as a fingerprint scan or facial recognition), colleges and universities can better protect user accounts and sensitive data from unauthorized access.

 

Backup & Disaster Recovery (DR)

As cybersecurity threats become more advanced and ransomware attacks continue to grow in frequency, institutions must prioritize cybersecurity best practices related to backup and disaster recovery. These capabilities enable colleges and universities to quickly restore systems and data after a cyberattack or other breach.

 

Managed Services & Cybersecurity as a Service (CSaaS)

As cybersecurity threats and tactics continue to evolve, higher education institutions may require the support of cybersecurity professionals who can help them maintain their cybersecurity posture. Managed cybersecurity services provide colleges with access to real-time monitoring, protection, and threat intelligence that they may not otherwise have available.

 

Cybersecurity Best Practices Higher Ed Institutions Should Consider

 

Next, let’s consider some cybersecurity best practices that colleges, universities, and other higher education institutions should consider adopting. These include:

 

1.Establish cybersecurity policies and guidelines to manage cybersecurity risk across the organization. These can include cybersecurity incident response plans, cybersecurity policies on the use of technologies and data sharing, and cybersecurity training programs for staff.

 

2. Use a cybersecurity framework, such as ISO/IEC 27001 or cybersecurity controls outlined by the National Institute of Standards and Technology (NIST), to evaluate cybersecurity risks and determine cybersecurity best practices for the organization.

 

3. Prioritize cybersecurity awareness training and cybersecurity education programs to develop an informed cybersecurity workforce. This can include cybersecurity training for staff and cybersecurity education for students, as well as cybersecurity workshops to educate the broader community.

 

4.Invest in managed cybersecurity technologies, such as network monitoring, intrusion detection systems (IDS), and cybersecurity tools for endpoint protection, to help protect your organization from cyberattacks.

 

5.Engage a cybersecurity partner to help you identify cybersecurity vulnerabilities and support your cybersecurity initiatives, such as managed cybersecurity services or cybersecurity as a service (CSaaS). With cybersecurity expertise and resources at your disposal, you can better protect your organization against cybersecurity threats and attacks.

Successful Education Begins with Putting Security First

Institutions of higher education aren’t often at the cutting edge of cybersecurity, prioritizing investments in facilities, equipment, and faculty expertise instead. Fortunately, leading cybersecurity capabilities are increasingly available to organizations without substantial investments in in-house cybersecurity expertise or difficult-to-maintain on-premise technologies. As managed providers increasingly specialize in cybersecurity for these institutions, education leaders willing to take their security can gain the upper hand in their battle with increasingly sophisticated bad actors.

 

Uvation is at the Forefront of Cybersecurity in Higher education

At Uvation, we have a deep understanding of cybersecurity challenges facing higher education institutions and are committed to helping our customers stay ahead of the cybersecurity curve. Contact us directly to learn more about how we can help your institution get its long-term cybersecurity practices on the right track.