Attacks/Breaches

Universities Get Schooled by Hackers

Colleges and universities are prime targets for criminals due to huge sets of personal information and security that is weaker than in many businesses.

As university students leave campus for holiday breaks, they may carry more than new knowledge home to family and friends. Recent research points out that colleges and universities are coming under more aggressive security attacks while their defenses struggle to keep up with growing demand.

In "Defending Networks at Higher Learning Institutions — Heroes Needed," a report issued earlier this fall, researchers at InfoBlox pointed out that the complexity of the university network environment makes effective defense difficult. "Years ago we planned 'one jack per pillow,' and that's changed in such a short period of time," says Victor Danevich, Infoblox CTO. He believes that each student on campus represents approximately seven IP addresses, making most state and many private universities the home of hundreds of thousands of connected devices.

And while the complexity and levels of attacks are growing, the issues in higher education cybersecurity aren't new. A report released by EdGuards, "A Brief History of Higher Education Insecurity," walks readers through attacks from 2002 through 2018 to show how hackers have evolved. One of the growing issues is the size of the databases sought and compromised by criminals, with tens to hundreds of thousands of records exfiltrated in attacks on scores of schools.

That evolution is aided by legitimate university network users. More than half of the administrators surveyed by InfoBlox say that 25% of students arrive on campus with their devices carrying malware. "The 25% infected rate shows the devices that students are bringing from home," Danevich says. "It's not laptops. It's IoT devices [and] mobile devices." For university security teams, the implication is simple. "You can't take a look at the security once a year. You have to be much more current because it changes so fast," he explains.

While students are a common infection vector, they are not the ultimate target. "Business applications, such as HR, Financial and Campus Solutions by PeopleSoft or other vendors, are the main target, as they store the most critical data and are vulnerable to both hackers and malicious insiders," the EdGuards paper states. 

University security teams hamstring themselves when they see security as a traditional perimeter game because new devices and techniques simply bypass classic perimeter defenses, Danevich says. He recommends defense at the network perimeter, in-network control, and thorough, constant monitoring with automated assistance.

"You can put up a blacklist, but now it has to be taken a step farther with a collection of information that's come from a variety of devices hooked to a SEIM and passed to a Splunk or ArcSight," he says. Ultimately, he explains, "We need to use more machine learning and be smarter with what we do."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ThomasMaloney
50%
50%
ThomasMaloney,
User Rank: Apprentice
1/14/2019 | 2:11:45 AM
Lax in security
It is not really that shocking to know that educational institutions have a higher tendency to be lax in their security measures as compared to organisations from various other fields. This is because of the nature of their operations which is considered to be less risky in comparison against other sectors like finance. This makes them even more vulnerable to attacks which usually come unexpectedly.
Joseph Castro
50%
50%
Joseph Castro,
User Rank: Apprentice
1/6/2019 | 11:19:48 PM
Overall Changes
By now, every school system should not be running on old technology. As stated, level of attacks is growing. They're becoming more sophisticated, and schools need to be on top of it. This also requires a good security team with skills to support them. Too many don't pay attention, get comfortable or aren't following basic procedures. Of course, you can't be 100% secured, but if higher education security is still a problem, something is wrong here. Budget shouldn't be the reason either. Colleges and Universities make so much money! If so, this leads to even more than just a security problem. As for students, they should have security awareness training while their attending college. It should be part of their curriculum and required to pass it. In my experience, I deal with users without any decent knowledge. For example, passwords are still weak, mind sets are still on "I will never get hacked" mode, and so many more! The lack of awareness and training carries over. Again, there needs to be change and those with higher voices can make this happen.
ChristopherJames
100%
0%
ChristopherJames,
User Rank: Moderator
1/6/2019 | 8:51:08 PM
Expensive Upgrades
I think the problem here is that universities don't have the money to keep upgrading their systems. I don't think it's because they don't want to keep their facilities protected, but the price that's involved in maintaining the network is very high! Unless they can source the protection to some computing studies students....
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6443
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
CVE-2019-6444
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.
CVE-2019-6445
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.
CVE-2019-6446
PUBLISHED: 2019-01-16
An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
CVE-2019-6442
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.