Campus and university ransomware isn’t going anywhere anytime soon, and higher ed IT departments are still struggling to prepare for inevitable cyber-attacks
Earlier this year, the University of Central Florida was the target of a cyber-attack in which hackers gained access 63,000 Social Security numbers belonging to current and former students and staff. Unfortunately, this is nothing new, as between 2006 and 2013, 550 universities reported some kind of data breach–and those are just the ones we know about. However, there’s a new trend in cybercrime. Attackers are no longer concerned with just stealing your data. They’re now bent on locking it up and throwing away the key–unless you pay the ransom, of course.
Ransomware Holding America Hostage
Unlike the traditional malware attacks that most of us are used to, ransomware attacks aim to encrypt every bit of stored information on your computer’s hard drives. In this way, your computer and everything on it is essentially “held for ransom,” with attackers promising to unlock the data and information once their demands are met. Campus Safety Magazine has actually recently released a report claiming that 2016 is the “year ransomware holds America hostage,” highlighting just how dire the situation has become.
The reason that ransomware has had such an impact across industries is that there is nothing anybody–not your IT people, not the Geek Squad, not even the FBI–can do to remedy the situation, leaving the user with essentially two options: wiping the hard drive clear of everything including the infectious code (assuming you have data backups), or paying the attacker’s ransom. As such, many institutions and victims will feel they have no choice other than to pay up. The University of Calgary is just the latest high-profile victim of such attacks–they recently paid criminals about $16,000 to release a gang of valuable ransomware-encrypted emails.
Why Campuses and Universities?
With the exception of healthcare IT, which is being hit just as hard by ransomware and other data security challenges, it seems colleges and universities are affected by ransomware more than other institutions and organizations because of the “relatively open nature of campus IT systems,” according to the Breach Insights 2016 report by Beazley, a world leader in data breach response insurance. To make matters worse, even more Universities are moving critical systems into the cloud. One report shows that by 2017, at least 75% of new and replacement student information systems will be SaaS- or cloud-based, presenting attackers with even more opportunities to access sensitive student information.
As such, higher ed IT teams are going to have to stay on their toes, and be vigilant in securing such traditionally open campuses. With so many unsecured laptops and cellphones (and users lacking proper cyber-education operating them) it’s no wonder that campus breaches due to hacking and malware rose from 26% in 2014 to 35% 2015. To combat this rise, higher ed IT needs to start taking the ransomware threat much more seriously and lay down preventative measures if they haven’t already.
6 Steps Toward Protection
The United States Computer Emergency Readiness Team lists six preventative steps to better secure your organization against the threat of impending ransomware attacks:
- Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
- Maintain up-to-date anti-virus software.
- Keep your operating system and software up-to-date with the latest patches.
- Do not follow unsolicited web links in email. (Refer to the Security Tip Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks)
- Use caution when opening email attachments. (For information on safely handling email attachments, see Recognizing and Avoiding Email Scams)
- Follow safe practices when browsing the web. See Good Security Habits and Safeguarding Your Data for additional details.
Of course, this list is not definitive. Additional measures that college and university IT departments can employ include firewall and intrusion detection system installation, incident response plan implementation, and ongoing education of users and faculty.
Don’t get caught with your pants down and take action now. While the reality of cybercrime today is that there’s no preventing a critical attack, there is no excuse for preparing against one. Protect yourself and your students today.
