Why Higher Education Is So Vulnerable to Cyber Attacks — And What to Do

By Zac Amos, Features Editor, ReHack

Cyberattacks are a growing problem worldwide as they can cause significant damage to any organization, big or small. Higher education institutions are especially vulnerable, exposing students and employees to various attacks that can put their personal information and welfare at risk.

Why Is Higher Education a Prime Target?

Cybercrimes are rising in all industries, but higher education institutions remain prime targets for hackers looking for a fat paycheck. The sector experienced 44% more cyberattacks in 2022 than the previous year. Why are criminals targeting schools? Here are a few reasons:

• Abundance of sensitive information: The size of higher education institutions makes them prime targets for hackers looking to cash in on stealing and selling sensitive data. Student and employee Social Security numbers, bank accounts and other private information motivate bad actors to infiltrate systems using various attack patterns.
• Valuable research data: Many universities pride themselves in having the best and most brilliant minds working on valuable research projects and groundbreaking technologies. Cybercriminals look for opportunities wherever possible. They know intellectual property can be worth millions if sold to the highest bidder.
• Lack of cyber preparedness: Many higher-ed institutions prioritize improving facilities and education standards over other factors like cybersecurity. Organizations’ complacency and feelings of false security make them prime targets for bad actors.

How Vulnerable Are Universities and Colleges to Data Breaches?

In 2023, the University of Michigan had to shut down systems and IT services after a cybersecurity incident occurred just before the start of a new academic year. The university has over 30,000 faculty and administrative staff and 51,000 students. Some common cyberthreats plaguing higher-ed institutions are SQL injections, phishing and ransomware attacks.

Cybercriminals are scaling their attacks to expose vulnerabilities in higher-ed institutions. They won’t stop there. Here are several reasons why schools are more vulnerable to cyberattacks:

• Lack of funding: Many colleges and universities fail to prepare for imminent attacks due to a lack of funding for critical cybersecurity systems. As a result, these institutions are forced to pay steep ransoms that only encourage hackers to launch more attacks in the future.
• Outdated systems: Higher-ed institutions prioritize large-scale adoption without proper preparation for associated risks as online learning becomes more prevalent. Many universities still use old and outdated systems that are more vulnerable to high-tech cyberthreats.
• Cybersecurity labor shortage: According to a 2022 study, over 700,000 unfilled cybersecurity roles exist in the U.S. alone. The lack of qualified professionals headlining cybersecurity departments in higher-ed institutions leads to more vulnerabilities due to lax security standards.

Strategies to Strengthen Cybersecurity in Higher Education

In the U.K., 92% of higher education institutions were affected by cybersecurity compromises in 2022 — significantly higher than the 39% average rate for all businesses. While attacks keep mounting, only 13% of global industries will protect their data in 2023. It’s time to start proactively changing cybersecurity awareness by adopting a security mindset.

Here’s how universities and colleges can adopt a cybersecurity stance and bolster their defenses against bad actors.

1. Test and Assess Existing Systems for Vulnerability

Many universities and colleges have outdated systems and minimal security safeguards. Bad actors can exploit this situation, force their way into supposedly secure networks and access sensitive information. Higher education institutions must examine their systems, test existing security measures and address vulnerabilities. Acknowledging areas for improvement and staying open to adopting possible solutions are the first steps to defending against cyberthreats.

2. Implement Rigorous Cybersecurity Measures

Cybercriminals are leveling up their game by adopting new technologies and strategies to steal valuable information. If they are ramping up their methods to infiltrate secure systems, higher education institutions must also recognize relevant trends and take steps to bolster their defenses. Enabling newer cybersecurity protocols and adopting modern technologies like access control and multifactor authentication can help universities improve their defenses against data breaches. Security teams must monitor critical networks for suspicious activity and patterns outside normal user behavior.

3. Leverage Digital Literacy to Defend Against Cyberthreats

Cybersecurity is a collective responsibility. The quicker education institutions recognize this, the better. University and college leaders should address security issues at every level — from students and administrators to faculty and stakeholders. Digital literacy can be a powerful tool to reduce human errors and prevent data breaches. Higher education institutions must leverage their educational background to promote cyber hygiene in the school community. Launching cybersecurity campaigns is a viable solution to addressing existing issues. Universities and colleges must inform users of existing cyberthreats and train them to use systems responsibly.

4. Allocate Resources for Cybersecurity

While funding can be a delicate topic for many universities and colleges, it’s high time they adapt to the changing digital landscape. Gone are the days when passwords, firewalls and antivirus software are enough to protect against malware and other cyberthreats. Leaders in the higher education sector must recognize the growing risk of cyberattacks. Universities must allocate ample resources to hire qualified professionals and implement updated cybersecurity strategies to protect sensitive data and secure critical networks. Massive adoption of online learning and the rise in connected devices open a new attack vector for bad actors. As learning methods change for the better, security standards must also keep up to protect everyone’s valuable data and sensitive information.

5. Upgrade to Newer, More Secure Systems

Old universities and colleges are traditional institutions and most likely use legacy systems to process and store data. As the education sector faces new challenges, it must transition into updated methods to help shield its users from cyberthreats.

Moving away from outdated systems and establishing attack-resistant ones will give higher education institutions more peace of mind. Although budget constraints can be a significant obstacle, upgrading systems is still a more financially logical alternative to paying expensive ransoms to cybercriminals.

Future-Proofing Higher Education with Cybersecurity

Higher education institutions should be safe spaces for students, staff and faculty — both physically and digitally. Improvements in education and cybersecurity standards must go hand in hand to prepare for a future with evolving technology and threats. Leaders in academia must acknowledge the need for more robust systems and strategies and implement them to ensure everyone’s safety.

About the Author

Zac Amos is the Features Editor at ReHack, where he covers cybersecurity and the tech industry. For more of his content, follow him on Twitter or LinkedIn.