Hostile nation states pose the major long term cyber threat to UK universities, according the National Cyber Security Centre (NCSC).
It has raised the warning in its first threat assessment of the sector, urging the institutions to adopt security-conscious policies and access controls to mitigate the risks.
There is also a more immediate threat from malware and phishing attacks launched by cyber criminals.
The dangers derive partly from the open and outward-looking nature of the universities sector. While allowing collaboration across international borders, it also eases the task of a cyber attacker.
Some of these are criminals looking to commit fraud or sell on or ransom stolen material, while others are state backed attackers aiming to undermine research and the UK’s larger national interest.
The latter threaten to damage the value of some of research, notably in STEM subjects, reduce the UK’s advantage in knowledge in certain fields, and undermine investment in the affected universities.
Iranian attack
Among the examples highlighted in the assessment was an attack from last year attributed to Iranian actors in which they were able to steal the credentials of their victims after directing them to fake university websites.
The attack took place across 14 countries, including the UK, and many of the fake pages were linked to university library systems, indicating the actors’ appetite for this type of material.
Among the sector’s vulnerabilities are that its population of users changes frequently, which makes it more difficult to maintain strict controls over network access. NCSC says universities should make the effort to tightly control access, and partition any high value research to make it more difficult for attackers to find sensitive information.
In addition, many university networks contain a collection of smaller, private networks providing services for faculties and laboratories, and these can create vulnerable points if there is no strong central oversight. But the segregation also offers an opportunity to separate high value or sensitive information and apply a higher level of protection.
Better understanding
Sarah Lyons, deputy director for economy and society at the NCSC, said: “The UK’s universities are rightly celebrated for their thriving role in international research and innovation collaborations.
“The NCSC’s assessment helps universities better understand the cyber threats they may face as part of the global and open nature of research and what they can do about it using a trusted research approach.
“NCSC is working closely with the academic sector to ensure that, wherever the threat comes from, they are able to protect their research and their universities in cyberspace.”
The assessment also highlights the financial damage which can be caused by cyber attacks on UK universities, citing previous figures from UK Finance which estimated that university losses from cyber crime for the first half of 2018 were £145 million.
Image from iStock
