Anticipating Cyberattacks on College and University Campuses

From the Association of Governing Boards:

Anticipating Cyberattacks on College and University Campuses

Malicious cyberattacks are a fact of life and a constant challenge for every organization today. As The Economist noted in a 2013 article, “Computer Hacking: A Byte for a Byte,” “Security experts like to say that there are now two types of companies: those that know they have been hacked and those that have been hacked without realizing it.” In 2013, when the University of Delaware suffered its first large-scale security breach, it collated information on cyberattacks at two dozen colleges and universities as reported in news-media accounts. The number of persons affected by breaches during a three-year period ending in 2013 ranged from a low of 3,300 to a high of 760,000 and averaged about 150,000. The prevalence and disruptive impact of cyberattacks have only grown since then.

College and university computer systems are particularly inviting targets for hackers, for three reasons. First, institutional servers typically contain intellectual property of considerable scientific and commercial worth. “Universities and their professors are awarded thousands of patents each year, some with vast potential value, in fields as disparate as prescription drugs, computer chips, fuel cells, aircraft and medical device,” notes Richard Pérez-Peña, in “Universities Face a Rising Barrage of Cyberattacks” in the New York Times (July 16, 2013). On top of that, it might come as something of a revelation to the average board member to learn how much data colleges and universities also gather on students who apply and attend their institutions.