Tests conducted on the defense of universities against cyberattacks proved that in all cases, hackers were able to gain access to data within about two hours.
The tests were carried out by “ethical hackers” who worked for Jisc, the internet services provider for universities and research centres in the United Kingdom.
University research programmes have been primary targets of hackers, with more than 1,000 attacks having taken place last year.
The tests were carried out at more than 50 universities in the United Kingdom, with some experiencing attacks many times.
A report on their effectiveness, published by Jisc (formerly Joint Information Systems Committee) and the Higher Education Policy Institute (HEPI), showed 100% success in bypassing internet defenses.
Within two hours and in some cases even one hour, the hackers were able to access the personal data of students and staff, to bypass financial systems and to gain access to research databases.
The tests were carried out by Jisc's internal team of ethical hackers, with one of the most effective approaches being the so‑called “phishing”.
John Chapman, head of the Jisc security operations centre, warned about the risk of a «catastrophic data breach or network outage».
Universities and research centres faced repeated attacks from hackers, with more than 200 institutions reporting over 1,000 hacking attempts last year, aimed at data interception or service disruption.
“Universities hold massive information on sensitive research”, said Nick Hillman, director of Hepi, which if they fall into the wrong hands could have disastrous consequences for the country. They also have many personal information about their students.
The professor at Greenwich University, David Maguire, said that universities “gather massive amounts of data” and this “places a burden of responsibility on the institutions, which must ensure the security of their electronic systems”.}.
The National Cyber Security Centre (NCSC), part of GCHQ's intelligence service, said that most attacks on United Kingdom universities are related to electronic phishing and aim to spread ransomware and malicious software.
But foreign states also targeted universities, to steal intellectual property and to “gain a technological advantage”.
“The experts of NCSC work closely with the academic sector to improve their security practices and help protect educational institutions from cyber threats”, said a spokesperson for the cyber protection service.
