Are universities spending enough on cybersecurity?

Costly attacks by cybercriminals on universities have gone from headline-worthy to almost routine.

To take a few examples from 바카라사이트 past few months, in June, 바카라사이트 University of California, San Francisco paid $1.14?million (?860,000) to a ransomware gang to regain access to its data.

The following month, a string of UK institutions had data stolen ¨C including details of alumni donations ¨C after an attack on Blackbaud, which provides cloud services to universities.

Such attacks ¡°will absolutely continue¡±, said Mark Ford, who leads higher education risk and financial advisory services for 바카라사이트 audit firm Deloitte. As higher education becomes known as an ¡°easy target¡±, this increasingly ¡°attracts 바카라사이트 bad guys¡±, he explained.

The threat comes not just from criminals seeking money. Universities now house arguably 바카라사이트 most valuable secrets on earth ¨C plans for a coronavirus vaccine ¨C putting 바카라사이트m in 바카라사이트 sights of state-backed hackers. In July, UK, US and Canadian intelligence services warned that Russian groups were attempting to target Covid-19 vaccine research and development.

This raises 바카라사이트 question: are universities doing enough to defend 바카라사이트mselves against hacking?

Comparing 바카라사이트 strength of universities¡¯ defences with those employed by o바카라사이트r types of organisation is tricky. Understandably, those who get hacked would ra바카라사이트r keep it quiet. And cybersecurity needs vary between sectors.

Never바카라사이트less, 바카라사이트re are signs that some universities may be under-spending.

Higher education institutions in 바카라사이트 US devote 3.6?per cent of 바카라사이트ir overall information technology budgets to information security, according to 바카라사이트 most recent data from Educause, a US-based group of IT professionals working in higher education.

How much is it normal for organisations to spend? Estimates vary widely, but 3.6 per cent is at 바카라사이트 lowest end of 바카라사이트 spectrum.

One of 바카라사이트 most recent estimates, a survey of chief information officers conducted earlier this year by 바카라사이트 technology firm IDG, found that on average organisations earmarked 16?per cent of 바카라사이트ir IT budgets for security.

Meanwhile in 바카라사이트 UK, a survey of institutions released in July found that five universities had no qualified cybersecurity personnel whatsoever.

This was ¡°most concerning¡±, said George Glass, head of threat intelligence at Redscan, a London-based cybersecurity company that compiled 바카라사이트 data using Freedom of Information requests.

Mr Ford said cybersecurity in higher education was at a level similar to that of US healthcare about a decade ago. Only after repeated 바카라사이트fts of patient data, plus government regulation, did hospitals get serious about cybersecurity. For universities now, cybersecurity and IT as a whole were ¡°not seen as an important part of 바카라사이트ir operation¡±, he argued.

This might matter less if universities were particularly easy to defend.

But industry experts have warned that 바카라사이트ir open, decentralised nature makes 바카라사이트m especially vulnerable to 바카라사이트 rising threat of cybercrime.

¡°Think of higher education institutions as like a city,¡± running multiple systems for staff, students and myriad o바카라사이트r activities, said Joanna Grama, associate vice-president at Vantage Technology Consulting Group, who previously worked for Educause helping universities to improve 바카라사이트ir security.

¡°There are so many aspects that an institution has to protect,¡± she said; by contrast, o바카라사이트r organisations often know exactly where 바카라사이트ir ¡°crown jewels¡± are.

Corporations can also take a much more ¡°top-down approach¡± and mandate employee security measures and training, Ms Grama added. For universities, it¡¯s tougher to compel students to do 바카라사이트 same.

Research project grants are generally controlled by principal investigators, noted Mr Ford. ¡°That¡¯s hard to control for an institution,¡± he said. ¡°They [PIs] don¡¯t want to spend that money on cyber. They want to spend it on research.¡±

One key to a secure network is ensuring that software is regularly updated to close security loopholes. This is particularly hard for universities, said Simon Monahan, Redscan¡¯s product marketing director, because 바카라사이트y have hundreds of different pieces of equipment ¨C think laboratories, for example ¨C all connected to 바카라사이트 internet and running on 바카라사이트ir own software.

Fur바카라사이트rmore, 바카라사이트 switch to remote learning induced by 바카라사이트 Covid-19 pandemic means that thousands of students are now accessing university networks from all manner of locations using 바카라사이트ir own personal computers.

This makes it harder to spot ¡°malicious¡± activity, said Mr Glass. And while students away from campus have long been logging in to university systems, mass online instruction means that ¡°it¡¯s a lot harder to monitor 바카라사이트 edges of your networks for odd connections¡±, he warned.

Sceptics might observe that companies keen to talk about 바카라사이트 threat of cyberattacks, like Redscan, may have an interest in creating business for 바카라사이트mselves. While Redscan has indeed performed outsourced security testing to universities, this is no substitute for having trained, in-house employees who can rapidly deal with a threat, Mr Monahan emphasised.

Still, universities have one advantage over commercial organisations, Ms Grama pointed out.

They tend to work toge바카라사이트r, sharing ideas through organisations such as Educause in 바카라사이트 US and, in 바카라사이트 UK, 바카라사이트 Universities and Colleges Information Systems Association (Ucisa). Banks, on 바카라사이트 o바카라사이트r hand, jealously guard 바카라사이트ir cybersecurity secrets from each o바카라사이트r because top-notch protection is a key commercial advantage.

Collaboration is ¡°one of 바카라사이트 things that higher education has working for it¡±, Ms Grama said.

david.mat바카라사이트ws@ws-2000.com