As Hacking Efforts Mature, Higher Education Will See More Sophisticated Threats

Those of us in higher education IT often talk about dramatic shifts in the cybersecurity landscape, and we all know intuitively and from experience that things are indeed changing. But it’s important to pay attention to exactly how and why these changes are occurring, because only then can we craft the most effective response. 

In “The Cybersecurity Insight Report,” three security experts share insights with CDW about the nature of today’s computing environment and how it is affecting cyberthreats. 

SIGN UP: Get more news from the EdTech newsletter in your inbox every two weeks!

Cyberattackers Deploy Fake Sites and Personalized Messages

For starters, threats today aren’t merely increasing in frequency and severity. They are more sophisticated, reflecting a new level of social engineering that can be devastatingly effective. 

John Robinson, an anti-phishing/cyber security strategist with Cofense (formerly PhishMe), says that cybercrime has essentially become a professional enterprise, run by coordinated organizations that do much more than blast out emails hoping to find an unsuspecting recipient. Instead, Robinson says, these groups create entire online ecosystems that are fake, but look real enough to convince even a skeptical email recipient that a message is legitimate. 

For example, says Chris Schreiber, a consulting systems engineer with FireEye, hackers can actually purchase a toolkit (and associated customer support) to create a fake site that looks exactly like a trusted site. 

Another circumstance in hackers’ favor is the vast amount of information that individuals share on social media and elsewhere online. That makes it incredibly easy, Robinson says, for criminals to learn the names of recipients’ coworkers and details of their organizational process: information they can then use to customize a message toward a specific recipient and make it even more convincing. 

After all, no matter how much training we give a faculty or staff member about how to recognize a suspicious message, it’s hard to blame them for failing to recognize a message that is crafted and customized to look as innocuous as possible.

The nature of work today also makes it easier for hackers to gain entry. Consider how much business we conduct over email and the cloud, says Ryan Kalember, senior vice president of cybersecurity strategy for Proofpoint. Both trends have created new areas of opportunity for criminals. 

Similarly, the “always on” work habits of many employees also are a factor, Schreiber points out. Our tendency to stay in touch with work via our mobile phones, whether we’re at home or out of town, means that we put even more institutional data online, often accompanied by login credentials. And, as IT experts know all too well, all it takes for a hacker to cause damage is a single door into the system, opened by an unwitting employee. 

Educate Users on Hacking Tactics to Build Awareness

Hacking attempts that use customization to target individual employees, whose very purpose is to overcome users’ defenses, must be on the radar of IT security professionals. Even though technology solutions are also becoming more sophisticated, particularly with the emergence of data-driven analytics and artificial intelligence, users will always be an important part of any security strategy. 

That’s not to say IT leaders are necessarily confident in their colleagues’ ability to consistently screen out hacking attempts. In a survey by CDW and IDG featured in “The Cybersecurity Insight Report,” only 30 percent of IT leaders expressed high confidence in the ability of people and processes to protect against cyberattacks. 

One strategy that can increase leaders’ confidence is to ensure that users, just as much as security experts, understand the landscape in which we all operate today. To that end, IT staff who develop campus awareness initiatives may find it useful to educate users not only on specific signs to watch out for — for example, characteristics of phishing emails — but also on the broader context of hacking itself. Many users may not realize, for example, the extent to which hacking has become a big business, complete with the tools and resources to craft effective deception. 

The more information we give our users, the more secure that they and our institutions will continue to be.

This article is part of EdTech: Focus on Higher Education’s UniversITy blog series.