How colleges and universities can fortify cybersecurity
Cybercriminal activity has increased at campuses in recent years, including a rise in ransomware and intellectual property theft. Here are ways to help protect your institution and students.
5 minute read
Key takeaways
- The education sector is a common target of cybercriminals and malicious actors.
- Colleges and universities are inherently vulnerable to attack due to numerous network access points and online users and the premium placed on the free flow of information.
- Frequent data backups, software updates and staff training are some of the steps schools can take to make themselves and their constituents less vulnerable to attack and more resilient if an incident occurs.
It’s no secret that colleges and universities are top targets for cybercriminals. They’re attractive prey: Schools store a wide swath of valuable data, including student (and parent) financial information, Social Security numbers and groundbreaking research.
Higher-education institutions have characteristics that make them uniquely vulnerable: for example, a diverse body of administrators, professors, support staff and students who connect to school networks at all hours from many locations and systems. This increases vulnerability and makes it essential to set network rules to identify and block potentially rogue or malicious actors from connecting to the network.
Cyberattacks can result in direct financial losses for institutions, but they can also lead to other types of setbacks. Loss of sensitive personal information, research and other intellectual property, for example, can lead to a fall in reputational standing.
To protect your staff, students and data, you must understand the general and specific risks your institution faces and then establish best practices to reduce those risks as much as possible.
Best practices for securing systems
Securing systems and networks requires a multipronged approach that focuses on both systems and people.
1. Educate: Train faculty, staff and students about cyber hygiene.
People are often the biggest vulnerability when it comes to securing systems and networks. Training students and staff about how to recognize email, text and phone threats — and then report them — helps build a culture of cybersecurity awareness. Cybersecurity training works best when it’s ongoing and ingrained in daily processes and procedures.
2. Authenticate: Implement strong user access controls.
This can include using single sign-on across networks as well as multifactor authentication. An ideal security setup would also use an authentication process that continuously tracks and assesses user behavior to confirm identity and permissions on an ongoing basis, not just at the point of initial access.
3. Update: Ensure all software is kept up to date.
Install prevention and detection tools to block and detect known types of attacks and malware, and keep systems current with patches distributed by software makers. Ban untrustworthy applications and restrict software downloads to only those that come from trusted sites.
4. Safeguard: Implement a strong plan to protect data.
Use strong encryption and store the keys securely or consider segmenting your most sensitive data on servers that are separate from those running day-to-day operations and that employ extra security.
5. Backup: Develop a secure and offline backup system.
How often you back up your systems determines how up to date your data will be if you must restore it. Establish a nightly backup routine and implement offline backups.
6. Prepare: Document and test an incident-response plan.
Develop and implement comprehensive measures for responding to cybersecurity events. Practice your response with drills to identify gaps in the plan and ensure that everyone understands their role in the recovery process.
7. Motivate: Build a culture of cybersecurity across your institution.
Everyone processes information differently. Your faculty and staff will absorb cybersecurity education differently than students, so cater your education to these different audiences. Consult with mid- and entry-level staff, students, department heads and board members to gauge the best ways to communicate risk to these audiences so that everyone understands the stakes and how to best protect your institution.
Understanding the risks that make higher-education institutions more vulnerable to cyberattacks is crucial. Embedding security awareness in the daily activities of students, faculty and staff can help build a culture of cybersecurity that better protects data, people and institutional reputation.
How to protect higher ed students from scams and cybercrime
Educating students about cybersecurity threats can help protect them and their academic institutions.
