British University Data Breaches Are A Lesson For All

Data breaches have been back in the headlines recently after hackers found a way to break in the Progress Software MOVEit transfer tool.  The hack was predicted to give hackers personal details of over 100,000 employees of some of the world’s best known organisations, through no fault of their own.

Sadly, this episode has been another example of the risk posed by supply chain attacks, where a hacker attacks a third-party provider with the aim of causing disruption, or gaining access to the systems of another company in the supply chain to impact them directly.  

This can be by encrypting their data, as was experienced with the NHS data breach - which affected the entire country by comprising the personal data of over a million patients and caused operational systems to be taken offline. 

Higher Education’s Higher Risk

These attacks should not be viewed as only impacting large enterprises or suppliers to those organisations. Our own research of online criminal markets has found that UK universities are at high risk of major cyber security incidents being launched using breached login credentials.  Our Trillion team discovered 2.2 million breached credentials available on the dark web for the top 100 UK institutions, with 57% belonging to the 24 Russell Group Universities.  The University of Manchester found itself in the news previously over emails threatening a data breach, and is working with the ICO to investigate. It won’t be the last.

To put these figures in perspective, there were over 2.41m staff and students at UK universities in the 21/22 academic year (HESA student and staff records) studying for degrees, including 679,000 students from outside the UK. The potential reach and impact of a breach is serious, placing personal information at risk and disrupting the studies of millions that have chosen the UK as the place to invest for their future.

It's Not Just The Students At Risk

It would be easy to think that this is just a risk for the students and staff whose details have been breached.  However, the UK university sector is renowned for the quality of its research facilities, driving innovation across many sectors including healthcare and technology, as well as government funded programmes of national importance such as nuclear energy and defence.  Considering the following figure through that lens is more worrying – 54% of the breached credentials we found came from UK universities with research facilities.

UK universities and research facilities are among the most respected in the world, and protecting that reputation includes protecting the students, staff and information that is shared with them for research projects by government, the public and private sector, through effective cyber security practices.  

The challenge for the sector, is that higher education environments are amongst the most uniquely challenging to protect with overlapping requirements for secrecy and openness - so many attack paths need to be factored.

A Lesson For All, Not Just Higher Education

There are best practices that every higher education institute should employ, but they are not unique to that sector. And regardless of those processes every organisation should be proactively monitoring for stolen credentials, as these could be revealed through a third party breach somewhere else in the supply chain, or through a service that a member of staff uses in their personal life.

Every organisation should consider whether it has strong enough policies and processes in place in the following areas:

  • Use Two Factor Authentication (2FA) on user accounts - Using 2FA on internal systems is a good start. But this does not always protect you when working with external partners, such as law firms, expense portals etc, as their systems may not require it. So, you should always remain vigilant.
  • Does single sign-on (SSO) protect us? Not really. If an attacker can obtain a valid password for your SSO application then they can use it for wider access. If they can access your email account then they can probably request password resets, which they can then carry out.
  • Resetting passwords is only a temporary fix - The problem goes away until one of your new passwords is leaked again by another site you are using. So you need to maintain an ongoing process of protection.
  • Have a policy that enforces complex passwords - The NCSC website has good guidance on choosing secure passwords. But remember your passwords still need to be unique for each website. And even a complex password, if it’s stolen from a 3rd party, can still be used against you.

It is impossible to be 100% secure, and that should always be the mindset, but by putting in place the systems and processes outlined above, all organisations can go a long way to protecting their staff, students, partners and supply chains from becoming victims of a data breach that could have far reaching consequences.

Stuart Jubb is UK Group Managing Director at Crossword Cybersecurity

You Might Also Read: 

Higher Education: Lessons In Cybersecurity:

 


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Protecting Your Home Devices Against Attack
Have We Become Complacent About The ‘Insider Threat’? »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

DTEX Systems

DTEX Systems

DTEX Systems is the global leader for insider risk management. We empower organizations to prevent data loss by proactively stopping insider risks from becoming insider threats.

American International Group (AIG)

American International Group (AIG)

AIG, is an American multinational insurance corporation. Commercial services include cyber risk insurance.

mnemonic

mnemonic

mnemonic helps businesses manage their security risks, protect their data and defend against cyber threats.

SecurePay

SecurePay

SecurePay is Australia's premier payment gateway, with a range of secure online payment solutions for online retailers, SMEs and enterprise businesses.

Sentia

Sentia

Sentia is an IT and infrastructure firm, with focus on Outsourcing, IT operation and management, Hosting, Co-location, Network, and IT security.

Protection Group International (PGI)

Protection Group International (PGI)

PGI helps organisations and governments to manage digital risk. From cyber security services to business intelligence, we help reduce the risks to your finances, reputation, assets and people.

Oak Ridge National Laboratory (ORNL)

Oak Ridge National Laboratory (ORNL)

ORNL conducts basic and applied research and development in key areas of science for energy, advanced materials, supercomputing and national security including cybersecurity.

Sonda

Sonda

SONDA is the leading systems integrator and IT service provider in Latin America.

Cortado Mobile Solutions

Cortado Mobile Solutions

Cortado Mobile Solutions creates enterprise mobility and file sharing solutions for companies, teams and freelancers.

Cyber Threat Defense (CT Defense)

Cyber Threat Defense (CT Defense)

CT Defense specialize in penetration testing and security assessments.

CYBER.ORG

CYBER.ORG

CYBER.ORG's goal is to empower educators as they prepare the next generation to succeed in the cyber workforce of tomorrow.

Summit 7 (S7)

Summit 7 (S7)

Summit 7 is a national leader in cybersecurity, compliance, and managed services for the Aerospace and Defense industry and corporate enterprises.

Firesand

Firesand

Based in Milton Keynes, Firesand Ltd provides penetration testing services to improve your cyber security and protect your company against hackers.

Cyrex

Cyrex

Cyrex is a Web3 security and development company. Our mastery over decentralized applications, smart contracts and blockchain will keep you secure across Web3.

iomart Group

iomart Group

iomart is a cloud computing and IT managed services business providing secure hybrid cloud, network connectivity, data management, and digital workplace capability.

SPIE Switzerland

SPIE Switzerland

SPIE Switzerland AG, a subsidiary of the SPIE Group, is a Swiss full-service provider of ICT, multi-technical and integral facility services.