Conducted in May 2022 using data from QS Top Universities, the Proofpoint analysis also found that 97 per cent of the top 10 universities across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud. These findings are based on domain-based message authentication, reporting and conformance (DMARC) analysis of the top 10 universities in each country.

DMARC is an email validation protocol designed to protect domain names from being misused by cyber criminals. It authenticates the sender’s identity before allowing a message to reach its intended destination. DMARC has three levels of protection — monitor, quarantine and reject — with reject being the most secure for preventing suspicious emails from reaching the inbox.

Steve Moros, senior director, advanced technology group, Asia-Pacific and Japan at Proofpoint, explained that the rapid shift to online learning has increased the risk of being targeted by cyber criminals.

VIEW ALL

“Higher education institutions hold masses of sensitive personal and financial data, perhaps more so than any industry outside healthcare.

“This, unfortunately, makes these institutions a highly attractive target for cyber criminals.

“The pandemic and rapid shift to remote learning has further heightened the cyber security challenges for tertiary education institutions and opened them up to significant risks from malicious email-based cyber attacks, such as phishing,” Mr Moros said.

Following the data breach of the University of Western Australia’s (UWA) student information system Callista, which exposed personal information and grades of current and past students, Tony D’Angelo, vice-president of public sector at Lookout, suggested steps that would assist in thwarting university-targeted cyber threats.

“Universities are a prime target for cyber criminals because of the large amount of sensitive data they handle, process and store, such as personally identifiable information (PII) of staff, students and families.

“They’ve always faced data protection and cyber security challenges because of their decentralised security, with different departments and colleges operating with their own protection practices and IT teams, and often engaging their own third-party providers.

“The move towards hybrid learning has only exacerbated this problem because people are now connecting universities’ networks across countless locations, unmanaged apps and devices, creating even more gaps for criminals to gain entry,” Mr D’Angelo said.

The attack on UWA comes just a month after Deakin University was hit by a cyber attack, where the cyber criminal accessed one of Deakin’s third-party providers, which led to the compromise of names, IDs and mobile numbers of 47,000 students. Around 10,000 of these students were sent a text purporting to be from the university, asking them to pay a fee through a link.

Mr Moros noted that notably, Proofpoint’s recent Voice of the CISO report found chief information security officers (CISOs) in the education sector felt the least backed by their organisation.

In line with these findings, the World Economic Forum reported that 95 per cent of cyber security issues are traced to human error, highlighting that many CISOs still significantly underestimate the risk posed by users. With this, only 47 per cent of education sector CISOs believe users to be their most significant risk. 

Email remains the most common vector for security compromises across all industries, Mr Moros further explained, with business email compromise schemes on the rise.

“In recent years, the frequency, sophistication and cost of cyber attacks against universities has increased. It’s the combination of these factors that make it especially concerning that only one of Australia’s top 10 universities is fully DMARC-compliant.

“With the shift to remote learning and now hybrid learning, these figures will continue to climb.

“The lack of protection against email fraud is commonplace across the tertiary education sector, exposing countless parties to impostor emails, also referred to as business email compromise (BEC),” he said.

BECs are a form of social engineering designed to trick victims into thinking they have received a legitimate email from an organisation or institution. Cyber criminals use this technique to extract personal information from students and staff by using luring techniques and disguising emails as messages from the university IT department, administration, or a campus group, often directing users to fake landing pages to harvest credentials.

Email authentication protocols like DMARC are the best way to shore up email fraud defences, Mr Moros added, in order to protect students, staff, and alumni from malicious attacks.

“As holders of vast amounts of sensitive and critical data, we advise universities across Australia to ensure that they have the strictest level of DMARC protocol in place to protect those within their networks.

“People are the last line of defence against email fraud but remain one of the biggest vulnerabilities for organisations.

“DMARC remains the only technology capable of not only defending against but eliminating domain spoofing or the risk of being impersonated. When fully compliant with DMARC, a malicious email can’t reach your inbox, removing the risk of human interference,” Mr Moros said.

As digital learning continues to become the norm, Mr D’Angelo stressed that higher education institutions need cyber security that works regardless of where data is moving.

“With consistent, end-to-end protection, universities can have full control over their infrastructure.

“This means they can intercept nefarious entry via applications, preventing the devastating consequences for students and staff, both past and current, that can result from such attacks,” Mr D’Angelo concluded.