British University Data Breaches Are A Lesson For All

Data breaches have been back in the headlines recently after hackers found a way to break in the Progress Software MOVEit transfer tool.  The hack was predicted to give hackers personal details of over 100,000 employees of some of the world’s best known organisations, through no fault of their own.

Sadly, this episode has been another example of the risk posed by supply chain attacks, where a hacker attacks a third-party provider with the aim of causing disruption, or gaining access to the systems of another company in the supply chain to impact them directly.  

This can be by encrypting their data, as was experienced with the NHS data breach - which affected the entire country by comprising the personal data of over a million patients and caused operational systems to be taken offline. 

Higher Education’s Higher Risk

These attacks should not be viewed as only impacting large enterprises or suppliers to those organisations. Our own research of online criminal markets has found that UK universities are at high risk of major cyber security incidents being launched using breached login credentials.  Our Trillion team discovered 2.2 million breached credentials available on the dark web for the top 100 UK institutions, with 57% belonging to the 24 Russell Group Universities.  The University of Manchester found itself in the news previously over emails threatening a data breach, and is working with the ICO to investigate. It won’t be the last.

To put these figures in perspective, there were over 2.41m staff and students at UK universities in the 21/22 academic year (HESA student and staff records) studying for degrees, including 679,000 students from outside the UK. The potential reach and impact of a breach is serious, placing personal information at risk and disrupting the studies of millions that have chosen the UK as the place to invest for their future.

It's Not Just The Students At Risk

It would be easy to think that this is just a risk for the students and staff whose details have been breached.  However, the UK university sector is renowned for the quality of its research facilities, driving innovation across many sectors including healthcare and technology, as well as government funded programmes of national importance such as nuclear energy and defence.  Considering the following figure through that lens is more worrying – 54% of the breached credentials we found came from UK universities with research facilities.

UK universities and research facilities are among the most respected in the world, and protecting that reputation includes protecting the students, staff and information that is shared with them for research projects by government, the public and private sector, through effective cyber security practices.  

The challenge for the sector, is that higher education environments are amongst the most uniquely challenging to protect with overlapping requirements for secrecy and openness - so many attack paths need to be factored.

A Lesson For All, Not Just Higher Education

There are best practices that every higher education institute should employ, but they are not unique to that sector. And regardless of those processes every organisation should be proactively monitoring for stolen credentials, as these could be revealed through a third party breach somewhere else in the supply chain, or through a service that a member of staff uses in their personal life.

Every organisation should consider whether it has strong enough policies and processes in place in the following areas:

  • Use Two Factor Authentication (2FA) on user accounts - Using 2FA on internal systems is a good start. But this does not always protect you when working with external partners, such as law firms, expense portals etc, as their systems may not require it. So, you should always remain vigilant.
  • Does single sign-on (SSO) protect us? Not really. If an attacker can obtain a valid password for your SSO application then they can use it for wider access. If they can access your email account then they can probably request password resets, which they can then carry out.
  • Resetting passwords is only a temporary fix - The problem goes away until one of your new passwords is leaked again by another site you are using. So you need to maintain an ongoing process of protection.
  • Have a policy that enforces complex passwords - The NCSC website has good guidance on choosing secure passwords. But remember your passwords still need to be unique for each website. And even a complex password, if it’s stolen from a 3rd party, can still be used against you.

It is impossible to be 100% secure, and that should always be the mindset, but by putting in place the systems and processes outlined above, all organisations can go a long way to protecting their staff, students, partners and supply chains from becoming victims of a data breach that could have far reaching consequences.

Stuart Jubb is UK Group Managing Director at Crossword Cybersecurity

You Might Also Read: 

Higher Education: Lessons In Cybersecurity:

 


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Protecting Your Home Devices Against Attack
Have We Become Complacent About The ‘Insider Threat’? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

GSMA - IoT Security Guidelines

GSMA - IoT Security Guidelines

GSMA has created a set of security guidelines for the benefit of service providers who are looking to develop new IoT products and services.

Avast Software

Avast Software

Avast Software is a security software company that develops antivirus software and internet security services.

OnSystem Logic

OnSystem Logic

OnSystem Logic has developed a unique, patent-pending solution to solve the problem of the exploitation of flaws in application software as a technique for cyber attacks.

Cybersixgill

Cybersixgill

Cybersixgill was founded with a single mission: to protect organizations against malicious cyber attacks that come from the deep and dark web, before they materialize.

Cybersecurity Advisors Network (CyAN)

Cybersecurity Advisors Network (CyAN)

CyAN provides a not-for-profit platform that helps private and public organisations as well as governments to identify trusted advisors in the area of Cyber Security and Cyber Crime.

Redborder

Redborder

Redborder is an Open Source network visibility, data analytics, and cybersecurity Big Data solution that is scalable up to the needs of enterprise networks and service providers.

Utility Cyber Security Forum

Utility Cyber Security Forum

The Utility Cyber Security Forum offers a focused venue in which utility executives can network one-on-one with colleagues facing issues in protecting against cyber attacks.

MassMutual Ventures

MassMutual Ventures

Mass Mutual ventures backs companies building category-defining businesses in markets including enterprise software, digital health, cybersecurity, and fintech.

Stealth-ISS Group

Stealth-ISS Group

Stealth–ISS Group is your extended IT, cyber security, risk and compliance team, providing strategic guidance, engineering and audit services, along with technical remediation and security operations.

Realsec

Realsec

RealSec is an international company and is a developer of encryption and digital signature systems and Blockchain for the Banking and Methods of Payment sectors, Government and Defense and Multisector

BluescreenIT (BIT)

BluescreenIT (BIT)

BluescreenIT is an IT Security Consultancy and IT and Cyber Security Training company supporting industry, local authorities, MoD and governmental IT departments.

eCloudvalley Digital Technology

eCloudvalley Digital Technology

eCloudvalley Digital Technology is a born-in-the-cloud partner focused entirely on AWS services across APAC region.

GuardYoo

GuardYoo

GuardYoo's SaaS platform allows cybersecurity professionals to perform Compromise Assessment remotely from anywhere in the world.

J.S. Held

J.S. Held

J.S. Held is a global consulting firm providing technical, scientific, and financial expertise across all assets and value at risk.

Codezero Technologies

Codezero Technologies

Codezero is at the forefront of microservices development, employing an identity-aware overlay network that delivers zero-trust security to DevOps.

Backblaze

Backblaze

The Backblaze Storage Cloud provides a foundation for businesses, developers, IT professionals, and individuals to build applications, host content, manage media, back up and archive data, and more.