Information security breaches are constantly in the news. ID theft experts Sontiq, who maintain a list of the most severe incidents, identified at organizations ranging from Microsoft to Marriott International hotels. While no higher education institutions made the 2020 list, you don鈥檛 have to look back too far to come across major data breaches in the industry.聽
Hackers Have Hit Education Industry Hard
Hackers from China infiltrated computer systems at Pennsylvania State University鈥檚 College of Engineering in a that lasted more than two years and targeted the university鈥檚 intellectual property. A second group of attackers reportedly gained access to personal information, including Social Security numbers, for 18,000 people. To help mitigate the damage to its reputation, the university offered those individuals free credit monitoring. It was also forced to notify more than 500 public and private research partners of the breach.聽
Rutgers University in New Jersey fell victim to perhaps the worst attack in higher ed history in 2015 when a Distributed Denial of Service (DDoS) attack took down the school鈥檚 networks and forced Rutgers to postpone exams and class registration. The attacker, a Rutgers student, pleaded guilty to violating the US Computer Fraud and Abuse Act in 2018 and was , the amount Rutgers estimated it cost them to respond to the attack.聽
Education Lags in Security Performance
With massive volumes of personal information1 and intellectual property under their responsibility, higher ed institutions are obvious targets for cybercrime. Beyond that, Institutions face some unique vulnerabilities, with widely distributed networks and large and constantly shifting user bases.聽
Add it all up and you鈥檝e got a recipe for trouble. Cybersecurity ratings company BitSight analyzed six major industries and found that education had the , a type of malicious software that blocks access to the victim鈥檚 data unless they pay the hackers a large sum of money.聽
13% of education institutions BitSight evaluated had experienced ransomware on their network, more than double the rate in government, the next most victimized industry analyzed (5.9%). Separate found that 17% of all data breaches occur in higher ed.
How Higher Ed Institutions Can Improve Their Information Security
In this challenging risk landscape, it鈥檚 essential for institutions to make information security a top priority. With this in mind, I sat down with ApplyBoard鈥檚 Chief Information Security Officer, , to get his thoughts on how schools can protect themselves and their students.聽
Meti Basiri: Why is information security so important in higher ed?
Paul Mason: Over the past few years, we鈥檝e seen a growing understanding among users in all industries of how much of their personal data is out there and how vulnerable it is to theft. In higher ed, students expect the institutions they attend to do everything they can to protect their privacy.聽
Governments have responded to this urgency by enacting legislation that protects data subjects鈥攖he people whose data is being collected鈥攁nd institutions need to comply or face steep fines and potentially legal exposure if a breach occurs.
Meti Basiri: Tell us about some of this legislation.
Paul Mason: The EU鈥檚 , which came into force in 2018, was a big leap forward in data protection and compliance. The GDPR laid out a series of legal bases that allow companies to collect personal data, established a set of rights for data subjects, greatly increased transparency between data collectors and subjects, and put in place significant penalties for noncompliance.聽
All of ApplyBoard鈥檚 partner universities in the UK abide by the GDPR, as well as its post-Brexit UK equivalent. The GDPR actually applies to organizations located outside the EU, as well. If a company collects or processes personal data for individuals located inside the EU, it needs to abide by the regulation. This means any institution outside the EU that enrolls EU students.
The GDPR has become a model for many jurisdictions outside the EU. In Brazil, a similar piece of legislation, the , came into effect in February 2020. Like the EU GDPR, it applies to organizations outside Brazil who collect data on Brazilian residents. The Indian government tabled its own in December 2019, but implementation has been delayed due to the pandemic.聽
In Canada, the federal government has introduced a bill to replace the 20-year-old Personal Information Protection and Electronic Documents Act (PIPEDA) with a new . It鈥檚 expected to become law within the next six months. The CPPA is even tougher than the GDPR in terms of requirements it places on organizations and the penalties it imposes if they fail to meet them. For certain offences, fines can reach up to C$25 million or 5% of the organization鈥檚 gross global revenue in the previous year, whichever is larger. The CPPA also gives individuals the right to sue organizations that fail to manage their data in accordance with the legislation.聽
In the US, the was approved by voters in California during last year鈥檚 election and will take effect on January 1, 2023.聽
Meti Basiri: What can institutions do to ensure they’re compliant with this legislation?
Paul Mason: Most large, research-focused institutions have a Chief Information Security Officer (CISO), which is a management-level position that monitors systems for breaches and continually reevaluates compliance with legislation. These schools should ensure they鈥檙e giving their CISO the resources that person needs to work efficiently and effectively. And they should ensure the CISO has a seat at the table with senior leadership, reflecting the importance of info security today.聽
Smaller institutions, such as community colleges, can be in a bit of a bind. They may be wary about the costs of bringing in an experienced security leader to fulfil the CISO role. But with the sophistication and variety of threats out there today, security is just not a function that can be filled at a lower level.聽
星空影视supports our partner schools big and small with their information security. We deal with the exact same personal data for our students, so we鈥檙e intimately familiar with the risks and the challenges institutions face. Before we begin working with a partner school, we test that school鈥檚 ability to send proper encrypted communications via email, which is essential when dealing with personal data. If a partner is deficient, we help them meet those security requirements.聽
We also leverage our BitSight licence. BitSight provides comprehensive, up-to-the-minute analysis of an organization鈥檚 security on a number of fronts: botnet infections, spam propagation, insecure systems, user file sharing, patching cadence, and many more. It allows organizations to see how their security rating compares to the industry average and to specific competitors.聽
Like a credit rating, BitSight information is visible to anyone with a BitSight licence. Prospective partners can check each other鈥檚 security rating before agreeing to work together. Or, a potential client could check a vendor鈥檚 security rating before subscribing to their service.聽
星空影视has reached out to a number of organizations whose security ratings have taken a hit, from partner schools to companies involved in our international financial transfers, and given them access to their BitSight profile through our licence. We鈥檝e then advised them on corrections and enhancements to make to address deficiencies and improve their rating. Once they鈥檙e where they need to be, we monitor them to help ensure they maintain their rating and alert them to any concerns we see.聽
Meti Basiri: What’s your biggest concern for institutions around information security right now?
Paul Mason: It鈥檚 the degree of change. For schools with little to no data governance infrastructure, meeting the requirements of GDPR, LGPD, CPPA, and similar laws means going from 0 to 100 in a really short period of time. That鈥檚 why it鈥檚 critical to stay on top of things. 星空影视currently has more than 20 internal projects on the go to proactively enhance our security. It鈥檚 a big investment, but it鈥檚 what鈥檚 necessary to stay ahead of both the evolving legal situation and ever-more-sophisticated cybercriminals.
As ApplyBoard鈥檚 Chief Information Security Officer, Paul Mason leads our internal security functions and advises our partner schools on their information security challenges.聽
Published: February 26, 2021
Subscribe to ApplyInsights
Sign up for the latest insights on international education.
Co-Founder and Chief Marketing Officer (CMO)
Meti is driven by the belief that education is a right, not a privilege. He leads the International Recruitment, Partner Relations, and Marketing teams at ApplyBoard, working to make education accessible to people around the world. Meti has been instrumental in building partnerships with 1,500+ educational institutions across Canada, the United, the United Kingdom, and Australia. Working with over 5,000 international recruitment partners, 星空影视has assisted over 150,000 students in their study abroad journey. for more access to ApplyInsights and key industry trends.
FOOTNOTES:
1. Including social security numbers, medical records, and financial data for faculty, staff, and students.
