![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2020\/09\/Cyber-Security.jpg\")
<\/p>\n<\/p>\n
Universities worldwide are a growing target for hackers.\u00a0A July 2020 report<\/a>\u00a0by cybersecurity company Redscan found more than 50% of UK universities recorded a data breach in the previous 12 months.<\/p>\n More recently, a data breach has\u00a0affected 444,000 users of ProctorU<\/a>. Universities, including several Australian ones, use this online tool to supervise students sitting exams from home. Personal records from ProctorU were made available on hacker forums.<\/p>\n The online-first approach universities are adopting during the COVID-19 pandemic further increases their digital footprint. This was done at very short notice. This meant risk analysis was different from the traditional processes, leading to additional cybersecurity risks.<\/p>\n Why are universities such attractive targets? It basically boils down to higher education\u2019s \u201cbread and butter\u201d: they hold precious data, information and knowledge.\u00a0Typical examples<\/a>\u00a0include emails, personal information, technical resources, sensitive research data and intellectual property.<\/p>\n In addition, universities have attractive infrastructure \u2013 such as high-bandwidth connections via high-capacity wiring \u2013 and access to expensive resources. Their structures and processes are also inherently complex.<\/p>\n All of these factors make them vulnerable.<\/p>\n In a recently published research paper<\/a>, we sought to disentangle this complexity. We interviewed 11 cybersecurity and IT leaders in universities and research centres across Australia. We asked them about the main cyber challenges their institutions faced daily.<\/p>\n University IT systems host a variety of users, including academics, professional staff, students and visitors. They have different levels of knowledge and understanding of cybersecurity and could create vulnerabilities, albeit unwillingly.<\/p>\n At the same time, they have work to do and they sometimes feel security controls hamper their productivity. One interviewee said:<\/p>\n We regularly get pushed back by researchers saying: \u2018Your controls are too tight; we can\u2019t run software or do the experimentation we want to do.\u2019<\/em><\/p><\/blockquote>\n Universities are hyper-connected organisations, whose edges are hard to establish: the boundary is no longer simply \u201cthe campus\u201d.<\/p>\n Most universities also have to deal with old technology and networks. Once connected to the internet, these legacy systems may offer so-called \u201cbackdoors\u201d that hackers can exploit. The\u00a0hacking of the Australian National University and resulting data breach<\/a>\u00a0was an example of this.<\/p>\n Universities increasingly operate as businesses. They connect with industry partners and third-sector organisations to make an impact on the \u201creal world\u201d. They outsource some of their services and develop entrepreneurial branches in the form of start-ups and spin-offs.<\/p>\n These activities create further complexity, as universities\u2019 value chains are extended to involve other universities, private and public organisations and non-government organisations.\u00a0A breach in one component of these value chains<\/a>\u00a0could have devastating effects on the other components.<\/p>\n Last but not least, universities have a natural inclination towards innovation. To innovate, information-sharing is essential. This, together with academic freedom,\u00a0may at times clash with a culture of security<\/a>. As one interviewee said:<\/p>\n The boards of directors are looking at growth, and there is no growth without risk.<\/em><\/p><\/blockquote>\n Intellectual capital<\/a>\u00a0is the mix of human capital (the knowledge of individuals), structural capital (systems, processes and technology to organise knowledge) and relational capital (the value that comes from connections with the external world). Protecting data and information held in universities ultimately means protecting their intellectual capital.<\/p>\n This cannot be achieved without bearing two levels of embeddedness in mind:\u00a0vertical<\/em>\u00a0(the different end-user categories) and\u00a0horizontal<\/em>\u00a0(the different organisations that engage with universities).<\/p>\n Intellectual capital protection in universities and levels of embeddedness. Author provided<\/p><\/div>\n Once more, this teaches us that, in cybersecurity, a one-size-fits-all approach\u00a0is rarely the best solution<\/a>. Even more so for universities.<\/p>\n Governments are acutely aware of the issues. The recently launched\u00a0Australian Cyber Security Strategy<\/a>\u00a0dedicates A$1.6 million over ten years to enhancing the cybersecurity of universities.<\/p>\n Will this be enough? More money for higher education could come from critical infrastructure protection, joint cyber security centres and perhaps defence, through programs such as the Defence Industry Security Program (DISP<\/a>).<\/p>\n Australia's Cyber Security Strategy 10-year investments are $1670.2 mil divided in (%): Cyber enhanced sit awar & resp 81, Strengthening counter cybercrime 10, Skills growth 5, Support to SMEs and vuln Aussies 4, Cybersec of unis 0.1 See graph for details @AuCyberStrategy<\/a> pic.twitter.com\/4jTNMSd6XL<\/a><\/p>\n — Ivano Bongiovanni (@ivanobongio) August 9, 2020<\/a><\/p><\/blockquote>\n Why do unis attract attacks?<\/strong><\/h4>\n
Challenges everywhere<\/strong><\/h4>\n
It\u2019s all about protecting intellectual capital<\/strong><\/h4>\n
![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2020\/09\/IntellectualCapital-copy.jpg\")
\n