This morning The Times detailed how cyber security breaches at university institutions including Oxford, Warwick and University College London have doubled in the past two years to 1,152 in 2016-17, with cyber criminals targeting scientific, engineering and medical activities; including research into missiles, according to data released after a range of freedom of information requests.
To what end? Experts fear that this increased targeting of universities and the resulting access to sensitive data, like military and medical research, is being sold to foreign powers.
While successful attacks have doubled, thousands more have been thwarted, with one university receiving between 1,000 and 10,000 attempted attacks each month, according to the report in The Times.
>See also: Don’t play the data breach blame game
Data from the FOI requests found that the University of Oxford had experienced 515 cases of unauthorised access to accounts last year, while UCL faced 57 cyber attacks in 2016-17.
Paul Cant, VP EMEA at BMC Software, commenting on this, says: “With the number of cyber attacks on our universities known to have nearly doubled in the past two years, and, in this case, the data that some of them harbour being of critical importance to our national security, watertight digital defences are more essential than ever.”
The targeted files range in subjects, from medical record to military designs for ‘stealth fabrics’, which are thought to help ‘disguise’ military weapons and vehicles.
Carsten Maple, head of computing and director of cyber security at Warwick University, said hackers were targeting intellectual property that had been in development for years.
“If someone can get that very quickly, that’s good for them,’ Maple said. “Certainly somebody might attack a university and then provide that information to a nation state.”
>See also: Swedish Government’s major data leak: lessons for the enterprise
Maple also said he was concerned with the lack of secure defences concerning cyber-physical attacks, which target areas like hospital heating systems.
Henry Seddon, VP EMEA, Duo Security warns that “the challenge is that phishing attacks are increasingly sophisticated – a targeted spear phishing attack can be particularly difficult to spot – but they can ultimately compromise the security of the entire network. They open the doors to hackers, with stolen credentials, to access an organisation’s system virtually undetected, posing as an authorised user. Worryingly, phishing is now the most popular way of delivering ransomware onto an organisation’s network.”
Indeed, these more sophisticated attacks are a growing trend, with the GCHQ’s National Cyber Security Centre revealing earlier this year that Britain had faced 188 high-level security attacks in three months.
Ciaran Martin, director general of cyber security at GCHQ said many of these attacks “threatened national security” by trying to access foreign policy and defence secrets.
>See also: NHS staff personal data leaked in latest data breach
Commenting on the latest figures of the FOI requests, Shadow Home Office minister, Louise Haigh said that more security investment was needed
“There should be no compromise on cybersecurity but in difficult financial times many public sector organisations are being left with outdated operating systems.”
Cant agrees with Haigh, and says that “Across both the public and private sector, the threat from hackers is constantly on the rise. And, as prime sources of intelligence and information gathering, this data indicates the desperate need for far greater investment to be ploughed into the cyber defences of our educational institutions.”
“SecOps teams must also ensure they do not buckle under the pressure to patch known vulnerabilities, fortify any barriers to sensitive information, identify any threats, and prevent them from reaching crisis point before it’s too late.”
