Higher Education as Hacking Targets

In February of this year, Berlin University experienced a cyber intrusion that compromised its email system. Subsequently, a group identified as Anonymous Sudan executed a Denial of Service (DoS) attack against the Universities of Cambridge and Manchester, citing the UK's support for Israel as their motivation. This group, known for its disruptive activities, including widespread outages on the platform formerly known as Twitter, has gained notoriety. In a related incident, Stanford University reported a probable ransomware attack orchestrated by the Akira Ransomware Group, targeting its Department of Public Safety. This group, monitored by CrowdStrike since March 2023, engages in double extortion tactics and operates a ransomware-as-a-service (RaaS) model, predominantly targeting entities in the United States and Canada. Also, a 2021 report by Forbes News revealed that cybercriminals infiltrated the biochemical systems at Oxford University's laboratory engaged in COVID-19 research, with financial gain identified as the primary motive behind the attack.

In this digital era, universities are prime targets due to their role as centers of research, innovation, and repositories of valuable intellectual property and sensitive personal data. Existing research often focuses on the technical facets of cybersecurity in enterprise environments. However, the unique characteristics of higher education institutions demand a specialized examination.

A report by Information Security Magazine in 2023 indicated that nearly 900 US schools were compromised via the MOVEit transfer system, underscoring the vulnerability of higher education institutions. These institutions are characterized by open, decentralized information technology environments, rendering them susceptible to cyberattacks. Key vulnerabilities include outdated infrastructure, where universities continue to rely on legacy systems that are not regularly updated, exposing them to novel cyber threats. The diverse user base of students, faculty, and staff, each with varying levels of cybersecurity awareness and access rights, presents a significant challenge in maintaining a secure environment. Furthermore, the need for unified cybersecurity policies across different departments exacerbates the vulnerability to cyber threats.

In conclusion, the increasing frequency and complexity of cyberattacks on higher education institutions necessitate reevaluating current cybersecurity strategies. It is imperative to develop and implement comprehensive, robust cybersecurity measures that address the unique challenges faced by these institutions. The approach will entail upgrading outdated infrastructure, enhancing cybersecurity awareness among the diverse user base, and establishing cohesive, enforceable cybersecurity policies across all departments. By adopting such measures, higher education institutions can better protect their invaluable assets against the ever-evolving landscape of cyber threats. Ervin F. Belinda Ogunlana, CISA, PMP. Damien Smith

Sunday Oludare Ogunlana, Ph.D.