Are Colleges and Universities Vulnerable to Cyberattacks?
Colleges and universities are increasingly being targeted by cyber-attackers, including state-sponsored advanced persistent threat groups, who view these institutions as treasure troves of valuable information. Protecting the valuable data held at these schools will take a multi-tiered approach centered on incident response and proactive security.
Schools are already under siege from hackers. Cybersecurity firm FireEye assessed the security of more than 100 education networks between May 2014 and May 2015.
The findings: all of them had been compromised. More disturbing is that 46 percent had verified APT activity within their environment, according to FireEye. And many campus networks have been compromised for months or years by multiple APT groups, the cybersecurity firm says.
Why Target Colleges and Universities?
The IT systems of colleges and universities store a wide range of data on students, faculty and staff, FireEye says. “And most of it is stored in a mishmash of different systems strewn across multiple departments,” the company explains.
The data colleges and universities are storing include:
- Customer payment data
- Personally identifiable information, such as Social Security numbers, emails and physical addresses and demographic information
- Health and medical information, as most institutions have student health centers
- Law enforcement records
- Enterprise data, including financial and operational data, personnel records and payroll
- Research data
- Third-party data
Because these campuses store such a wide range of information, they are prime targets from potential threats including corporate spies, cybercriminals, infrastructure hijackers, cyber stackers, hacktivists and even foreign governments, FireEye says.
What makes the job of cybersecurity even tougher for these schools is the fact that there are several unique challenges, such as massive BYOD (bring-your-own-device) environments, large wireless networks, multiple and conflicting security mandates, and a lack of threat intelligence, according to FireEye.
In addition, a university “thrives on collaboration and exchange of scholarship and ideas,” says Jim Waldo, a computer-science professor and the chief technology officer at Harvard University, said in a recent article from The Atlantic. “Building an infrastructure for IT that is based around those assumptions is pretty different from the kinds of things that can be done in a corporation where you can dictate to your customer base what they can and can’t do,” he told the publication.
How Schools Can Respond
The difficulty in protecting a university’s IT systems lies in the fact that these schools are, in essence, mini cities, FireEye says. “They need to protect a broad range of diverse, sensitive data—a much wider swath than most businesses or government agencies,” the company says.
To respond, institutions need to treat their IT environments as triage situations, according to FireEye. “They need to be able to determine which incidents should trigger an incident response,” the company says. “They must identify bad actors already in their networks and expel them. And to protect their reputations, operations, people, and data, they need to start taking a proactive, not reactive, approach to security.”
Specifically, according to FireEye, organizations should:
- Implement two-factor authentication for all VPN and Outlook Web App connections;
- Segment networks by classifying IT assets, data and personnel into specific groups;
- Start recording relevant traffic and log data to be able to determine, if a breach occurs, how the attackers got in; and
- Collaborate with others within higher education to share threat intelligence and lessons learned from past incidents.
About ADAPTURE
As business productivity solutions move to the cloud, demand on your network increases exponentially, all while threats to your data security grow more sophisticated. It’s more important than ever to proactively prioritize innovation; and ADAPTURE is the partner to help manage it all.
