In the two weeks between recent revelations that hackers stole data on students, alumni and faculty from the University of Maryland-College Park and Johns Hopkins University, nearly 360,000 records were swiped in similar attacks at schools in Pennsylvania, Indiana and North Dakota.
Last year, breaches included possible exposure of 2.5million Social Security and bank-account numbers associated with an Arizona community college system; 74,000 Social Security numbers of University of Delaware students and staff; and 145,000 applications to Virginia Tech, according to the Privacy Rights Clearinghouse.
Colleges and universities often are attractive targets for hackers because there are many access points into their networks, which contain not just financial and personal data but also valuable intellectual property. That threat is forcing academics to reassess the way they keep and protect vast collections of information, often held in decentralized computer networks accessible to thousands of students, professors and researchers.
“It’s been a long-standing concern that our culture of collaboration and trust kind of flies in the face of the need for security to be more closed, more alert and more skeptical and cynical,” said Rodney Petersen, senior policy adviser for SecuriCORE, a higher-education information security project at Indiana University.
Just as campuses have added gates, guards and surveillance cameras in recent decades, they may have to end the era of open access to online resources, he said.
The University of Maryland and other institutions reeling from major data thefts are redoubling efforts to confine and protect sensitive data spread across networks - sometimes so scattered that it’s a complicated task simply to learn where the data might be hiding and vulnerable. The growing security risks also may require new barriers around networks that have been traditionally open in the name of academic discourse and unfettered access.
But unlike retailers, banks and other companies that guard sensitive data, universities can’t mandate what devices or software are used to access their networks. And they must accommodate students and researchers spread across the globe, making it more difficult to prevent and detect security breaches.
Since January 2013, more than 50 colleges, universities and school systems across the country have been the targets of attacks that may have compromised personal information, according to the Privacy Rights Clearinghouse, a California-based consumer advocacy group.
Such attacks are not confined to colleges and universities. The school systems in Maryland’s Howard and Carroll counties, for example, have reported network disruptions linked to possible cyberattacks this year, though personal data were not thought to have been at risk in either case.
Since a breach compromised names, Social Security numbers and birth dates of 287,580 students, faculty and staff members at the University of Maryland on Feb. 18, officials said they have purged more than three-fourths of the sensitive records, some of which dated back to 1992. But they are also hastening to learn how vulnerable the university’s information remains, and how to prevent future attacks.
A cybersecurity task force that university President Wallace Loh called together within 24 hours of the attack is set to consider whether information-technology systems on campus should be centralized to keep sensitive data in one place, rather than scattered across various colleges and departments. The group, which met for the first time recently, also is starting an effort to scan all university databases for personal information that could be at risk.
Similar actions have taken place at Johns Hopkins, where officials on March 6 announced an attack that occurred late last year compromising names and email addresses of 848 biomedical engineering students, as well as confidential evaluations of classmates. In response to attacks and at the urging of auditors, the university has moved to prioritize what information needs the highest levels of protection, said Darren Lacey, the university’s chief information-security officer.
Cybersecurity experts familiar with educational institutions’ challenges fending off hackers said the strategies are common responses to the growing threats. While they have traditionally used “open coffee-house style” networks, institutions are increasingly rearranging how they organize business systems such as tuition processing or employee payroll, said James Robinson, director of security for Accuvant, a cybersecurity company that works with higher-education clients.
That sort of strategy is one of their few options, given the broad access allowed on a university network. While a company can control what technology their employees use to connect remotely - often through secure virtual private networks - universities don’t have that luxury. And though security measures typically include automated systems that look for unusual activity or known malicious actors, that can be like finding a needle in a haystack.
Lacey said of Hopkins’ monitoring efforts, “Really, everything is an anomaly. If I get a million connections from another country, a corporation might say, ‘That’s not good.’ In our world, because we have students and faculty all over the world, that doesn’t necessarily trigger any response from us.”
Some experts suggest that access to some parts of university networks should be limited, cutting down on the points through which hackers could gain access. One option is so-called two-step verification, forcing users who log in on a new device with a user name and password to then provide a code sent via text message or email, Robinson said.
But higher-education officials may be reluctant to compromise the openness of their networks, at the risk of disrupting research that involves sharing large amounts of data. Tighter security could particularly challenge computer science research seeking to learn more about the very attacks officials hope to avoid.
“I think things are going to get a lot harder for everyone,” said Matthew Green, an assistant research professor of computer science at Johns Hopkins. “It’s good to be secure, but it’s good to be open. You have to really be careful how much you do to prevent people from the work they’re supposed to be doing.”
Business, Pages 19 on 03/24/2014