Can You Hack It?

As much as we hate to admit it, higher education institutions are far from immune to hackers and other security breaches. Data shows that sensitive personal records are highly vulnerable to attack on higher institutions’ networks — just as they are in other business sectors.

There have been 148 cases of publicly disclosed data breaches at colleges and universities since 2005, out of 634 overall incidents in all sectors, according to Privacy Rights Clearinghouse — a nonprofit organization that strives to raise consumers’ awareness of how technology affects personal privacy. Whether they know the numbers or not, higher ed information technology personnel know all too well the unique challenges they face in securing data.

“We’re always trying to balance access and security,” says Lori Temple, vice provost for information technology at the University of Nevada at Las Vegas. “But our people change so often at the university level that it presents a unique challenge. At a corporation, they hire employees and then they occasionally leave, but our students come and go and are guaranteed to change every four years. As a transient group, they need access to a lot of resources, so you have to make systems that aren’t hard for them to get into.”

UNLV kept one would-be hacker out in early 2005, when a security check on network activity discovered a hacker trying to download university data, according to a report in the Las Vegas Review-Journal. Though Temple said she couldn’t discuss the case’s details because of ongoing legal action, she added, “I can tell you it opened our eyes to how easily this can happen.”

Tracy Schroeder, University of San Francisco’s vice president for IT, concurs, claiming no university avoids hacking attempts. Her school deals with “thousands” of attempts every day — some from the paying customers. “Our most significant hacking attempt is from the inside from ambitious students who want to test the university,” she says. “Our successful monitoring is through administrators who watch certain behaviors and have been able to identify anonymous activity on campus. You can find individuals without too much problem, and we’ve been able to take some action based on that. We have never had confidential data compromised or needed to prosecute a student for hacking.”

Chris Christiansen, an IDC security analyst, says the worst-case scenarios of breaches can be harsh. “It’s every ugly scenario from university machines hosting industrial espionage, gross theft of copyrighted material, bot networks attacking other network user machines to even illegal fraudulent auction schemes,” he says.

Where’s the Harm?

If there’s a silver lining, it’s that security incidents at higher ed institutions are rarely the worst-case type. Christiansen says most student hacking is harmless, and he estimates criminal hacking makes up 1 to 2 percent of the higher ed hacking.

Philip Howard, an assistant professor in the communication department at the University of Washington, agrees that student hacking is often not as damaging as hacking in other sectors. Howard and University of Washington doctoral candidate Kris Erickson wrote a report analyzing publicly disclosed data security breaches over a span of more than a quarter of a century. Their report, “News Accounts of Hacker, Consumer, and Organizational Responsibility for Compromised Digital Records, 1980–2006,” says that although higher ed institutions made up a high percentage of hacking incidents, fewer records were breached, compared with breaches at corporations.

“I think it means hackers are targeting universities and colleges almost for practice, because they’re not getting large volumes of records,” Howard says. “People with criminal intent go to commercial firms.”

Still, having to disclose breaches leaves educational institutions with egg on their faces. And the more cases of hacking, the more chance that somebody will hack with criminal intent. Having all those hackers practice on their networks is only one major hurdle campus security officers face in staying secure. Another hurdle at many institutions is that their networks aren’t centralized.

“It’s quite challenging for the computing and communications office at a university to keep all department and all wings of the university on the same security standards,” Howard says.

There are many ways higher ed institutions can stay vigilant against attack. Temple says you should be prepared for attacks before they ever start. “You need to have a set of policies and checklists in place,” she says. “Ask, ‘Who will audit what to make sure you will follow it?’ The ideal is to have staff that can pretend to be hackers and can ‘beta up’ the systems and run programs to see how good they are. Another important question is, ‘do you have resources for these policies so you can have administrators even to do a checklist?’ You give hacking the best attention you can give it and concentrate on the most vulnerable systems. Work your way out to the heart of the data.”

But Temple warns that you also have to prioritize, because not all data can be easily found that’s been breached. “Any place where you have social security numbers, those have to be focused on, along with university grant data,” she says. “Financial data is open for a lot of universities, so at least you don’t have to worry as much about that.”

By the Book

Schroeder prepares by going with the age-old model of keeping it simple. “We outline our plan in our information security policy, and the keys there are having the right people involved — a single coordinator in IT for breaches and having that person coordinate all of the logistics,” she says. “But you need to be aware of when it’s time to also bring in local authorities and student affairs for judicial matters. Bottom line, the person who coordinates the incidence response needs to be well connected with different areas of the university that are involved, so when a breach happens they know who needs to be informed.”

Temple believes another way to avoid hacking is to mirror what the university is there for: education. “We’re informing people about servers and vulnerability. We’re also moving servers from their own care to IT because we have safer data centers,” she says. “We have a campaign we put together called ‘think before you click’ — it educates students about avoiding attachments you don’t know or answering an e-mail you’re unsure of.”

Schroeder also leans heavily on system-level trainers. “They check their logs for any unusual activity — we have some scripts that run on particular systems to alert if there is a service outage and we are looking at third-party services for application performance monitoring,” she says. “Monitoring services can tell you not just that you have a problem but also help you diagnose what the problem is. Intrusion detection or prevention is another piece, and that is challenging. We have intrusion prevention for our enterprise information systems, but it doesn’t cover the entire network and is currently only in detection mode.”

Offensive Posture

It’s always good to be prepared, but sometimes every preemptive measure in the world can’t stop the successful hack. Temple believes you need a few teams to succeed in responding should this dark day come.

“Have one team working on the hack itself, and capture data on the hacks to get forensics data to report it,” she says. “Another team needs to be ready to deal with whatever those findings are for disclosure. Will you need to let folks know and do you have policies in case? Also, what is state law and will you report because of ethics of the university? You need to also have Web pages ready for those whose data has been compromised to go get information they need for fraud alert.”

Universities also have to figure out with the help of law enforcement agencies if the hack is the work of international cybercrime or more mature networks of people making their living from compromising systems. “You can tell the difference by tracing back the Internet routing, and often it will take you back to the particular country,” says Schroeder. “Once traced, you can notify the ISP [Internet service provider], and they may take action in accordance of their policies. But we’ve never pursued it beyond that.”