Cybersecurity

Nearly 20 years ago, Tom Coates, an early adopter of the internet at the BBC, wrote about media companies who were terrified that broadband might kill linear TV. He compared the reaction to their plight to people being pursued by a giant snail. Doom was inching ever closer, yet their feet remained pinned to the floor. Rather than make any movement, there was a lot of shouting. Still the snail advanced. We can all see how that’s turning out for linear TV.&nbsp;When it comes to the digital transformation of higher education, there is widespread agreement that universities must adapt, bringing in the skills and technologies needed to thrive in an era of mass online learning and artificial intelligence. With a handful of notable exceptions, however, the sector seems to find it hard to translate those words into tangible, radical change.&nbsp;How to create a start-up dynamic in academiaHigher education needs a united approach to AIHow small universities can make big digital changesUniversities are institutions where multidisciplinarity, experimentation and optimising for learning are deeply embedded. Yet that isn’t always the case when it comes to the fabric of the organisation itself. There are good reasons for that. The substrates of old IT systems, ropey data and steering committees create friction, a problem far from unique to universities. A cultural gap between academics and professional services can mean a lack of trust on both sides. And higher education also faces a real and growing cybersecurity threat. Building a shining city on a hill when foundations are rocky is not straightforward.&nbsp;Yet however formidable the challenge, the giant snail is not going away. There are practical, tangible ways for universities to make headway and build momentum with their digital transformation.&nbsp;Switch your mindsetDelivering the benefits of digital transformation requires a change of mindset. Organisations built before the internet best navigate this disruption when they fundamentally change how they think about technology.&nbsp;Rather than starting with business requirements, successful examples began by establishing what users – students, staff, alumni – need through data and qualitative research. All universities must meet two different types of need: transactional (“submit an assignment”) and advisory (“prepare for remote learning”).&nbsp;A new mindset goes beyond just thinking differently about services. Instead of building everything upfront and launching to an unsuspecting audience, successful efforts employ a test-and-learn approach. This means starting small, building prototypes, gathering feedback – and repeating that cycle. Instead of the burden falling on the IT team, delivering services is a multidisciplinary endeavour, often requiring the incorporation of new skills into the mix.&nbsp;Rather than layers of governance boards checking in on deliverables, leaders set outcomes, track the data that indicates progress and work to remove blockers to momentum. If an organisation as complex as the government can pull this off during a crisis in teams like the Covid Vaccine Taskforce, so can others.Lead from the frontCreate clear, accountable leadership roles for the services that matter most to users. Responsibility for services often seems either distributed across multiple individuals, or focused at senior executive level far away from day-to-day delivery. Identifying service owners and empowering them to lead improvements makes ownership clearer, speeding up decision-making and turning the focus to what users are asking for, rather than the institution talking to itself.&nbsp;The Open University recently appointed Nick Macarte as the first service owner for their enrolment service. His goal is to radically simplify student enrolment by spotting and removing friction for those going through the process. Early on, he learned the importance of prioritisation, stating: “It’s the first time there’s been a single point of accountability for the enrolment service. We’ve worked hard to set focus and priorities, based on understanding the needs of our students. This allows us to be clear about what changes we will make now and what will come later.”Live the changeAnother crucial trick of digital transformation is to show, not tell. Many will be fed up with promises of technology-enabled change that never seem to amount to much. Winning the argument for this kind of change on paper with abstract arguments and business cases can only take you so far. Pick one or two simple but highly visible exemplar services to change – like “find a bursary” or “attend an open day” –&nbsp;and demonstrate what you mean by new ways of working by living them. Build prototypes. Record people’s reactions. Show stakeholders how much change you can make in a couple of weeks. By doing so, you quickly uncover the longer-term structural changes – to legacy technology, data and processes – the institution needs to secure bigger prizes.&nbsp;Collaborate to innovateNo institution is alone in facing these problems. As Mark Thompson pointed out at the THE Digital Universities conference in April, there is a compelling logic for the sector to work more closely together to address common challenges. Higher education institutions usually require the same components of digital services – systems for taking payment, for example – where there is no competitive advantage to be gained from building one’s own. Collaborating on developing and running these utilities could save institutions time to focus more on what makes them unique, while saving money.&nbsp;Higher education faces a tough time on several fronts. Among them, the giant snail of digital disruption will continue to advance. Best start moving.Andrew Greenway is managing director of&nbsp;Public Digital and an independent member of council at the University of Exeter.If you would like advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the Campus&nbsp;newsletter.

Change is coming, whether higher education likes it or not

Universities may talk about digital transformation, but are yet to translate it into action. Here’s how to start building the momentum for change, instead of standing still 

The AI tech giant OpenAI recently faced a storm of controversy when releasing a voice tool that sounded suspiciously like actor Scarlett Johansson, after she declined to provide the voice herself. Although records now show this wasn’t a deepfake but rather a voice actor hired to provide input, it raises some critical questions regarding how our images and voices may be replicated without our knowledge or permission.&nbsp;What would you say if your university asked to create a digital avatar of you to deliver your lectures? What if this was a condition of your employment? Or what if a student shared a video of you saying something you never said? These are the real questions that we are going to face as this technology becomes more mature and widespread in society.&nbsp;In tackling this topic, the first thing to understand is that there are differences between deepfakes and synthetic media. When we talk about synthetic media, we are referring to images, audio or video which is not of a specific person or institution, but is AI-generated. Deepfakes, on the other hand, are faked media of a real individual.&nbsp;In an artificially intelligent age, frame higher education around a new kind of thinkingHow to prevent cyberbullying from rearing its ugly head in universitiesApply the principles of critical pedagogy to GenAIThe underlying technology is a form of Generative AI (GenAI) which uses Generative Adversarial Networks (GANs) to mimic voice, facial expressions and lip movements. Deepfakes have been around for a while but the technology is now maturing fast. Despite not releasing it for public use, Microsoft recently demonstrated an application called VASA-1, which can create a talking head from a single image and short voice clip, complete with natural head movements and facial expressions. It’s not long before other tech companies catch up – and applications that create less sophisticated deepfakes quickly and simply are now available online.&nbsp;Many governments are making certain forms of deepfakes illegal, including the UK, the EU, South Korea, China, and Canada. However, while legal frameworks are essential for dealing with the risks of this tech, there is currently little focus on what these technologies mean for higher education. These technologies are sneaking up on us while our industry is preoccupied with other concerns. &nbsp;What’s more, we’re providing the material that can be used to create deepfakes of ourselves online. We upload videos, images and audio clips of ourselves to our social networks or through other channels, and this publicly available data may leave us vulnerable to impersonation. &nbsp;In fact, one app we tested required just two minutes of footage to create a deepfake that fooled even close friends and relatives. This isn’t just on the horizon, it’s already here.&nbsp;For educational institutions, deepfakes pose a special set of risks that we need to consider and plan for, both at the level of individual educators and at the policy level. Educators hold crucial roles of responsibility for preparing students for the future and working to safeguard the academic integrity and reputation of our institutions. Deepfakes enable damaging new forms of cyberbullying, academic dishonesty and damage to our credibility.&nbsp;The potential effects of deepfakes on higher educationDeepfakes may be used by bullies to create distressing and humiliating content of students or staff, including non-consensual pornography. Such cases can severely impact young people especially, and the realistic nature of deepfakes makes it difficult to refute their authenticity, thereby exacerbating the victim’s suffering. It has the potential to be far more distressing than traditional cyberbullying.&nbsp;Other effects of deepfakes could also cause problems for schools and universities. Fake recommendation videos from high-profile individuals may begin to plague admissions applications, and deepfake technologies may be used to fabricate research data. This undermines the integrity of educational institutions and devalues the achievements of genuine students. Imagine a scenario where a student submits a deepfake video as a recommendation from a well-known academic or senior professor. The ability to create such convincing fabrications can undermine the credibility of education and lead to inequity.Furthermore, the spread of deepfake misinformation can also severely damage the reputation of a school or university. A single deepfake incident, such as a fabricated video of a university leader making inappropriate remarks, can erode public trust and tarnish the institution's image. In fact, one disgruntled teacher in the US created a deepfake of a school principal, framing them as racist. Incidents such as these could lead to decreased enrolment, loss of funding and a tarnished reputation that takes years to rebuild, as well as sowing social divisions among the students, staff and stakeholders at a school.&nbsp;How to take actionThere are a few things educational institutions need to do to get ready for when an inevitable deepfake incident occurs, which we discuss in more detail in our recent preprint. The first, most straightforward action to take is to update cyberbullying policies to explicitly address the creation and spread of deepfakes. Students and parents need to be made aware of clear definitions, consequences for violations, and the mechanisms in place for reporting and addressing incidents. It’s crucial that these policies are communicated effectively to all students and staff to ensure widespread awareness and understanding.Second, raising awareness about deepfakes is crucial. Educational programmes should focus on teaching students and staff how to recognise AI-generated content and to be critical of any videos they come across. Workshops and training sessions can help build digital literacy and resilience against misinformation, which will prepare them well for the future. For example, integrating media literacy into the curriculum can equip students with the skills needed to critically analyse digital content and identify potential deepfakes.Schools and universities should also develop comprehensive crisis management plans to respond swiftly to deepfake incidents. These plans should include strategies for ongoing crisis communication, communicating with stakeholders and restoring trust. Proactive measures, such as informing potential targets about deepfake risks, can also be beneficial. A university could establish a rapid response team trained to handle deepfake incidents, to provide a coordinated and effective response.Finally, as educators, we need to recognise that while these technologies are risky, there are also potential benefits. Deepfake technology may be used to create immersive learning experiences or enable students to engage in simulated conversations with leading historical figures, or enable the creation of compelling lectures from nothing more than notes and a photo.&nbsp;At the same time, we should adopt a critical-first approach and be prepared for the havoc that could arise from the fact that we can now see anyone doing or saying anything with a few clicks of a button.&nbsp; Balancing innovation with vigilance will be key to ensuring that the benefits of AI and synthetic media enhance rather than undermine the educational experience.Jasper Roe is the head of the department of English and lecturer in social sciences at James Cook University, Singapore, and Mike Perkins is head of the Centre for Research and Innovation at British University Vietnam.If you would like advice and insight from academics and university staff delivered direct to your inbox each week, sign up for the Campus newsletter.

Deepfakes are coming for education. Be prepared

Deepfakes are easier than ever to make, leaving students and academics vulnerable to cyberbullying, reputational damage and educational integrity. Here’s how to be vigilant against them

Deepfakes are coming for higher education. What can we do to prepare?  

There is nothing fundamentally technical about cybersecurity.It may seem counterintuitive, but effective cybersecurity is more about people.&nbsp;After all, it doesn’t matter how much technology you have in place if all it takes for a breach to happen is for one person to click on a phishing email – and phishing emails account for 90 per cent of initial compromises globally. Firewalls and multi-factor authentication have an essential role to play, but they can’t defend against an individual’s lack of understanding of the consequences of their actions – which can be disastrous and long-lasting.&nbsp;Everything you need to know about cyberattacks (but were afraid to ask)How to prepare and protect your institution against a future cybersecurity attackSupporting cybersecurity literacy for workforce-ready graduatesGetting to the stage where cybersecurity awareness is built into every level of an institution requires a major shift in organisational culture.&nbsp;In a connected community such as the UK higher education sector, everyone has a part to play in combating the growing threat. A failing at one establishment can have implications for many others, so it’s imperative that individual organisations account for the risks they face and the criticality of the functions for which they are responsible. The same applies to individuals: one mistake can massively affect the wider community.What’s needed is a willingness on the part of everyone – not just the IT department – to work together to do the right thing and make the sector safer.Institutions can put in place a few basic people-level habits that will help boost sector-level security.Avoiding acronyms is a good startCybersecurity starts at the top; securing commitment at the highest levels is key. Not only does it ensure that the risks and proposed solutions are clearly understood from the outset, but it also gives the right signals to the whole organisation, making it easier to convince others to collaborate in a concerted effort to defend as one.&nbsp;The best way to raise the issue of cybersecurity with senior management and staff is by speaking in terms of business rather than technology. No one on the leadership team wants to hear about RPZ feeds or port 3389, so avoid jargon and acronyms. It’s not other people’s job to understand them.What’s more important is understanding the institution’s needs, the business processes that need protecting, how they work and what their correct outcomes should be. It’s about taking a holistic view of the environment, knowing what data there is to protect and where it is.&nbsp;Clarify the risks&nbsp;The whole point of universities and research institutions is openness, and that’s not always conducive to effective cybersecurity. Any approach to cybersecurity therefore needs to balance the (often conflicting) demands of confidentiality, integrity and availability.&nbsp;Senior management should therefore clarify the organisation’s goals to ensure cybersecurity is supporting them. Cybersecurity exists to enable an institution to conduct its learning, teaching and research activities in a secure, safe manner based on an acceptable risk appetite – which, in this sector, is usually low.&nbsp;To really bring home the potential risks and the importance of being prepared, cyber exercises are a useful tool. These simulate the problems that occur during a real-life incident in a safe environment and can be delivered at different levels for management and IT staff. Afterwards, everyone in the organisation should be aware of exactly what they need to do in the event of an attack.Understanding the costs of a cyberattackOnce the risks and vision are clearly understood, the discussion inevitably moves to finance. Preventing cyberattacks costs money. It requires investment in cyber professional staff, in training, in technical solutions. And, while senior management might be worried about cyber risk, they may not fully appreciate the situation and will – understandably – be reluctant to throw money at a problem that might never happen.Prevention, however, is always better than cure – and usually less costly.Remember that a serious cyber incident has other impacts that go beyond the financial, such as the human cost incurred not only during an attack but during the recovery period as well. It’s important to factor these into any cost analysis.As part of their Joint Information Systems Committee (Jisc) membership, any UK research or education institution connected to the&nbsp;Janet Network can avail themselves of the accredited expertise of Jisc’s cyber-protection teams, along with essential core services to help maintain a safe digital environment.Demystifying cybersecurityBuilding a culture of cyber awareness throughout an entire institution and its staff and learners is an enormous task. But we are definitely seeing a change as cyber is demystified and integrated into the everyday use of technology in teaching and learning. Increasingly, cyber awareness is being included in student inductions and taught as part of non-IT-related courses.A valuable resource for awareness building is the&nbsp;Jisc cybersecurity community group. With 1,700 members, this fast-growing community provides an open forum where peers can exchange knowledge and best practice.By discussing and demystifying cybersecurity we can shift it from being a technology issue to being all about people. And that’s key to building a culture of collaboration and common purpose, which will make the sector safer for everyone.David Batho is the director of security at Jisc.If you would like advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the Campus&nbsp;newsletter.

Cybersecurity is not a technical issue

Discussing and demystifying cybersecurity can help us shift it from a technology issue to being all about people, even at the sector level, writes David Batho

There’s nothing technical about cybersecurity

US institutions of higher education (HEIs) have asserted that part of their mission is creating knowledge and serving the public good through the robust exchange of ideas. But with that comes one of the fastest-growing challenges for higher education: protecting faculty and staff from attacks online. This is particularly true if universities expect faculty and staff to engage in potentially controversial topics.

The Covid-19 pandemic created a dependency on online engagement and interaction for HE and society. Classes, meetings and almost all other interactions moved online. As quickly as those environments were created, the reports of interruptions and cyberattacks came. In education, as in other sectors, there was a renewed focus on creating secure platforms, explanations of online expectations and accountability policies to preserve the online environment for its intended purpose.&nbsp; 


	Collective voices, zero tolerance
	The dark side of AI’s promised efficiencies
	Eliminating harmful digital technologies in universities: a guide


In January 2021, the PEW Research Center published a State of Online Harassment update. It reported that the overall rate of online harassment was consistent with research conducted in 2017, with one significant difference: there was evidence that the actuals had intensified. The Anti-Defamation League (ADL) Center for Technology &amp; Society created a nationally representative survey in 2022. Its&nbsp;report in June 2023 expanded on the work of PEW, with specific questions about the types of harassment and lifetime versus year-on-year feedback. Across the board, the data revealed an increase in the instances and severity of online harassment. 

As we launch a new academic year, educational institutions struggle to find ways to prevent online harassment and support faculty and staff in the event of an attack. Here are five strategies to consider:

1. Offer a statement of support and no tolerance from institutional leadership

One of the first recommendations of the American Association of University Professors&nbsp;(AAUP)&nbsp;is to “speak out clearly and forcefully to defend academic freedom and to condemn targeted harassment and intimidation of faculty members”. The statement alone won’t prevent bad behaviour, particularly in the larger online community. However, making faculty and staff aware of the institutional commitment to employees, their well-being and the educational mission is an essential first step. In April 2023, the University System of Georgia memorialised the AAUP statement on academic freedom as policy for all 26 higher education institutions. The system also directed the chancellor to conduct a review of best practices and ways to support freedom of expression.

2. Create an educational awareness campaign

In US higher education, awareness campaigns are sometimes required by federal or state law, while some are created as responses to local events. September is National Campus Safety Awareness Month. This is a great time to focus on online safety as well physical safety, and it’s also an excellent opportunity for different units, such as the public safety/police department, to work with the IT department on creating a safe online environment. Other opportunities arise throughout the academic year to tie in prevention and safety information for faculty, staff and students. 

3. Understand state and local harassment definitions

Given the breadth of state and local legislation regarding prohibited or criminalised behaviour, each institution must clearly understand what may or may not be permitted within the jurisdiction. Clear information should be provided to all faculty and staff about what may or may not be prosecuted or protected within the definitions of harassment and cyberstalking. Because of the difference in local and state laws, it is important to clarify and explain to faculty and staff how language or behaviour at the institution might be protected. Be aware also that many legal definitions do not consider changing technologies, and increased threatening or harassing behaviours might not be covered by legislation.&nbsp; 

4. Provide secure technology options (or explain limitations of technology)

Faculty affairs or human resources (depending on the structure of an institution) should work with technology staff to provide information to all employees about the capacities of the technology available to community members. With the pandemic came a greater understanding and use of technology to support education. Recording content, providing materials before or after classroom sessions in alternative formats and providing alternative assessment options all became much more common after March 2020. However, what will have been used at the pandemic’s start might or might not be recommended as you start the 2023-2024 academic year. Together with the teaching and learning centre, human resources and faculty affairs can provide information on best practices for securing academic/educational materials.

5. Provide resources and support for reporting and responding to online harassment

Institutions can provide online resources and information for faculty, staff and students for reporting and responding to online harassment. The University of Chicago’s Office of the Provost has also provided the community with information about securing their online footprint. The University of California Irvine has created quick reference and resource sheets for staff. 

At Georgia Institute of Technology, centres such as the Equity and Compliance Programs office and the victims advocate group provide information to all employees, including faculty and staff, of prohibited behaviours, resources and ways to report through an annual compliance campaign. 

Creating the opportunity for one central reporting unit enables the institution to gather information quickly and regularly about the experiences of faculty and staff online. This allows for assessing what additional resources, education or support might be needed based on pattern behaviours.

In conclusion, institutions have ways they can prepare and protect faculty and staff from increasing threats and harassment in the online space and create or share resources through the institution. It’s important to leverage established policies and procedures, as well as put resources in place to help faculty and staff understand what constitutes online harassment, how to report it and what they can do to protect themselves.

Alexis Martinez is executive director of equity and compliance programmes and interim Title IX coordinator in the Division of Institute Diversity, Equity &amp; Inclusion at Georgia Institute of Technology.

If you would like advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the Campus newsletter.

How universities can protect faculty from online harassment

With more online engagement and interaction have come increased threats and attacks against faculty, staff and students. Here are measures institutions can take to raise awareness and provide support

Five ways universities can protect faculty from online harassment

Let’s be clear: the metaverse (however you define it) is decades away.&nbsp;

Which is not to say that it can be ignored in the meantime. Because while it may seem like science fiction or over-inflated hype at the moment, the fact remains that huge amounts of money and effort are being poured into making it happen – and educators need to at least be aware of its possible implications.

What is the metaverse?&nbsp;

There is no single definition.&nbsp;

It’s often described as the internet but in 3D: an immersive virtual world where users can socialise, play and work. Using our mobile devices, PCs and game consoles, we will all share collective virtual spaces, participate in new digital experiences and have the opportunity to be part of&nbsp;an online economy where we can create, own and sell digital assets.&nbsp;

The metaverse will run 24/7: it will never stop. Our digital avatars will be able to flit&nbsp;seamlessly from one virtual world to another, wearing clothes bought in the metaverse and interacting with other avatars. 

That’s the vision, anyway.&nbsp;&nbsp;


	The metaverse is much more than a virtual copy of your campus
	Immersive tech in teaching and learning: first steps into the metaverse
	The metaverse will change everything – including academic research


What the metaverse is not&nbsp;

The metaverse is not virtual reality.&nbsp;&nbsp;

Virtual and augmented reality (VR/AR) are already well-defined technologies that are being used now to benefit education. While the metaverse will be accessible through VR headsets or AR glasses, VR/AR technology will only be one of the components for interacting with the metaverse.&nbsp;

It’s not a single entity.&nbsp;&nbsp;

The metaverse will not be owned by one company; rather, it will be a vast, decentralised network of connected virtual spaces that includes the sum of all virtual worlds, augmented reality and the internet.&nbsp;

It’s not a step change.&nbsp;&nbsp;

The metaverse will evolve from the convergence of a range of existing technologies: not just VR/AR but artificial intelligence (AI), blockchain, cybersecurity and connectivity.&nbsp;

And it’s not here yet.&nbsp;&nbsp;

It’s important to bear in mind that the metaverse is still very much a hypothetical concept that requires extraordinary technical advancements before it can be made to function as intended.&nbsp;For example, there is no protocol yet that would allow avatars to move from one virtual world to another – which is one of the metaverse’s fundamental tenets.&nbsp;

What might the metaverse mean for education?&nbsp;

The education metaverse is being touted as a virtual reality teaching environment that will enable a more immersive style of teaching and learning: an “embodied” internet where, instead of just viewing content, we will be in it.&nbsp;

But educators really need to ask: “So what? What is it about immersion that leads to a better, more engaging learning experience? And what does ‘engaging’ really mean?”&nbsp;

And how will this be different from our current use of VR?&nbsp;&nbsp;

As we know, VR headsets, simulators and full-body immersion suits are already adding value to education by providing a virtual alternative to real-world experience. By simulating complex environments they can give learners extra practice in otherwise dangerous, tricky or expensive physical tasks such as repairing offshore wind farms, for example.&nbsp;&nbsp;

However, one big difference to note between VR and the metaverse is that, while the experiences in VR systems cease the moment you switch them off, the metaverse – being a shared and persistent world – will continue to run. So, even when you remove your headset and exit the metaverse, your avatar could still be present in the digital world. Acting as a digital twin and using AI, it would continue to undertake tasks such as gathering resources for your next assignment.

The technology still has a long way to go&nbsp;

Plenty of hurdles need to be overcome before the metaverse has any impact on education.&nbsp;&nbsp;

For a start, the next level of immersive reality will require much more complex technology.&nbsp;

We are far from being able to produce shared, persistent simulations synchronised in real time for millions of users.&nbsp;The world just doesn’t have enough online infrastructure to sustain that number of people accessing the metaverse at the same time. It has been suggested that current state-of-the-art computational efficiency would need to increase by 1,000 times to power truly persistent and immersive computing at scale.&nbsp;

And that amount of computing power will obviously go hand in hand with a major increase in carbon emissions. While the metaverse might limit the need for physical travel, this has to be weighed against its reliance on technologies such as blockchain, which is extremely energy hungry.&nbsp;

Then there are the legal, regulatory and ethical issues...&nbsp;

As the next iteration of the digital economy, the metaverse will empower users to develop their own virtual spaces and solutions. This would establish a creator economy that allows users to own virtual assets and experiences that have a “monetary” value. Whether that value will be transferable between different virtual worlds (or into the real world) remains unclear – but the fact that parts of the metaverse will be profit-driven could make it incompatible with the mission and values of education.&nbsp;

To access the metaverse will also require more – and more expensive – kit. That’s always a barrier to mass adoption and could widen the existing digital poverty gap.&nbsp;

And last, but by no means least, is the issue of data privacy.

The metaverse will enable – or even require – the collection, analysis and use of personal data from every user, including the tracking of eye and finger movements, or facial reactions. Monetising these data and sharing them with other parties constitutes the risk with the widest implications when it comes to privacy in the metaverse.&nbsp;

Making it a safe place for learners will require an overhaul of current legal and regulatory procedures, a reimagining of the security landscape and significant changes in user behaviour.

So, how should educators start preparing for the metaverse?&nbsp;&nbsp;

It’s important to be critical about what are being presented as the benefits of any new technology, and the metaverse is no exception.&nbsp;

While there may well be some exciting, transformational applications in the educational field, these are early days, and it will be difficult to determine appropriate strategies for use until the infrastructure matures.

The metaverse will most likely emerge in business and entertainment first – and by then it may be too late to influence how it develops and how to address the evolving technological, legal and ethical challenges around its use.&nbsp;&nbsp;

For now, educators should focus on proven technologies and look at using AI and VR to lay the groundwork for future advances.&nbsp;

Paul Bailey is head of co-design at Jisc.

If you found this interesting and want advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the&nbsp;THE Campus&nbsp;newsletter. 

What is it and what might it mean for the future of education? 

Should we be worried? An educators’ introduction to the metaverse 

If you’re not aware that London South Bank University suffered a major malware attack, then I’ll claim at least some credit for how we dealt with the incident, as I&nbsp;was unlucky enough to have been the designated “gold commander” in charge of any major issues on the afternoon of Saturday 12&nbsp;December 2020.

Let’s be clear – an attack of that nature affects everybody in an institution, in ways that you can hardly begin to appreciate unless you’ve been on the receiving end, and nobody was happy with the situation in which we found ourselves. But I&nbsp;was genuinely amazed at the pragmatic and inventive ways that everybody carried on with business, education and research. On a personal level, however, I&nbsp;would say it was 10&nbsp;times worse to handle than Covid, as you really do feel like you’re fighting a huge battle almost entirely on your own because only a handful of colleagues really appreciate the complexity and challenges of the situation.


	Failing fast: what universities need to consider when adopting edtech
	Developing a faculty-IT partnership for seamless teaching support
	How to prepare and protect your institution against a future cybersecurity attack


Let me give you a timeline of what happened before focusing on three specific issues that I&nbsp;hope will provide constructive guidance concerning malware attacks.

The timeline essentially ran in three phases. The first phase lasted for the week or so after we discovered that key operating systems had been encrypted and that we’d need to pay a ransom (which we didn’t) to get them restored; from that point, the Metropolitan Police’s fraud division took control of our servers (ie, “the crime scene”), and we had to quickly work out how to continue teaching, carry out business functions, communicate with staff and students – and pay staff their Christmas salaries!

Phase two was an incredibly intensive period of about six weeks in which adequate workarounds were put in place and the student virtual learning environment was reinstalled – amazingly, that was back online on day two of semester two, so was unavailable for only 36 hours of term time. The third and final phase was the reinstallation of all software and data, which took a further six months or&nbsp;so.

Like most (but by no means all) universities, all of our data is routinely backed up, and that had happened the day before the attack. So I&nbsp;naively thought that once our software had been reinstalled, we could simply draw back down the data and carry on as before – how wrong I&nbsp;was.

Despite months of trawling through our servers, the fraud division never found the attack route, and this meant that our security systems had been breached – but we didn’t know how. So we needed to install a new and upgraded security system and also revalidate all users. However, and this turned out to be one of the biggest problems, the new security systems ran only on newer operating systems, and we had dozens of databases that had bespoke design but which were coded to interface through older operating systems.

Do not delude yourself into thinking that you have only a handful of key programmes that you’d need to reinstall and (almost certainly) redesign – education is complex, so dozens (probably hundreds) of databases need to be linked together for all the activities in a big institution, and they will all need amending to work with newer operating systems or security processes. Time frames are also incredibly difficult to predict. One IT expert told me that a crucial interface issue we had would probably take an hour to fix – but it would take somewhere between one and 14 days to locate the problem! And don’t forget that other cybercriminals will ride on the back of your misfortune, using the uncertainty and confusion of staff to lure colleagues into clicking links that appear to be genuine university workarounds.

So the three key things you ought to know about all this (but were afraid to ask):

1. Communications is the biggest nightmare, especially as everyone needs certainty about academic deadlines. I&nbsp;wish I&nbsp;didn’t know as much as I&nbsp;do now about our intranet, but this detail is of no interest to 99&nbsp;per cent of staff and 100&nbsp;per cent of students – all they want to know is when the systems will be running again. And why the IT team is so incompetent.

2. Everything, and I mean everything, runs through your computer systems. All financial, business support, academic and buildings-related systems went down – even getting into buildings becomes a&nbsp;major issue when access is controlled by an “identity management system”.

3. If you’re well prepared, it’ll still take six to 12 months to fully recover.

And my top three pieces of practical advice if you do find yourself and your institution on the receiving end?

1. Those around you won’t want you to communicate more than the minimum because of all the uncertainties. My advice is to fight against that, to stick to regular updates for staff and students and to be as open and honest as possible. For the first week, the police told us to minimise our communications in order to reduce the risk of scammers being alerted to potential uncertainties that they could exploit. But there was frequent pressure to delay updates if there was little to report or if an application “might be available if we waited another day” − this just feeds the rumour mill. Plus, it quickly became obvious that, even if emails were only read by, say, 40&nbsp;per cent of staff and 20&nbsp;per cent of students, the messages did get shared and regular updates were really appreciated.

2. Keep talking to staff “at the sharp end” to find out where the issues are and what you can do that will be of most help – the stress on staff is huge, often in unexpected ways. &nbsp;For example, some issues caused delays for students in being able to submit work (if they couldn’t access course-specific software, for example), and this created huge pressure on staff in terms of meeting immovable end-of-term marking deadlines. Colleagues were already under stress from Covid, and so small, practical measures (better support for home printing; carry-over leave) were really helpful.

3. The sheer quantity, technicality and jargon associated with IT systems affected by a malware attack is mind-boggling. As well as communicating with 2,000 staff and 18,000 students, there are big, risk-based decisions that need to be taken. For example, how much should you compromise security in order to meet an end-of-term deadline? Or do you fix the finance system or student applications software first? Only a&nbsp;few people have a good understanding of the IT issues and are also able to relay them in everyday language or relate them to broader strategic planning − nurture them and integrate them into key processes and decisions when all is well because, when an IT&nbsp;crisis strikes, they are like gold dust.

Patrick Bailey is an independent HE consultant in education, leadership and sustainability. He is also an emeritus professor and honorary fellow at London South Bank University, where he served as deputy vice-chancellor/provost from 2014 to 2021.

If you found this interesting and want advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the&nbsp;THE Campus&nbsp;newsletter. 

From communication to recovery times, Patrick Bailey provides an insider’s guide to dealing with the havoc wrought by cyberattacks, based on first-hand experience

Everything you need to know about cyberattacks (but were afraid to ask)

The higher education sector, it might be fair to say, presents challenges to effective data protection. This is because of the fragmented nature of relationships between controllers (institutions), individuals employed by institutions who might collect data on their behalf (for example, administrators and academics) and data subjects (for the purposes of this article, students), as well as the high level of autonomy of employees within organisations.

Due to increasing attention on universities from those wishing to access valuable personal data held by institutions or deny access to legitimate users, our minds have been focused on this issue. We need a sector that is aware of its data protection responsibilities and the rights of those whose data we hold. Failure to do so can result in significant fines for institutions and disciplinary action for those who might have caused the breaches.

If we take, for example, the traditional academic scenario of posting exam grades on a student noticeboard (or a virtual platform in these more digital times), we are immediately faced with a challenge to the fair processing and sharing of personal data related to that student. Assessment data related to a student is personal. Although the institution is collecting and processing that data, it still belongs to the student, and if we are choosing to share it, we need to both make the owner aware of the intention to share as well as their right to not have&nbsp;their&nbsp;data displayed in a public forum.


	Social media can help new students make friends – but we must regulate it
	Cybersecurity in the HE sector – getting the basics right
	Cybersecurity remains a critical issue that universities must face


While a short article cannot cover all aspects of data protection and privacy rights exhaustively, I will aim to prompt thoughts around what student data is and how it is used.&nbsp;

Understand that technical controls have limits 

Perhaps the most important thing to bear in mind is that this cannot all be managed and controlled with technical controls. Many technical measures (such as access control, authentication and effective data management) can be put in place to mitigate the risks of unauthorised access and breaches, but these cannot do everything. Many breaches are beyond the control of the IT department (such as the oft-cited email attachment containing the personal data of thousands sent to the wrong recipient), and those with data processing responsibilities cannot assume that those clever folk in IT can mitigate any potential breach.

Under principle 1 of the General Data Processing Regulations (enshrined in UK law in the Data Protection Act 2018), any data collected should be processed fairly, lawfully and in a transparent manner. If data are collected for one aim (for example, an assessment), they should not then be used for a different purpose (for example, a disciplinary procedure) without the consent of the subject. Being in possession of students’ personal data does not give you carte blanche to do what you wish with it.

Be mindful that it is well within a student’s rights to make a subject access request; this requires the organisation to provide all electronic data they hold regarding the student. This is a growing practice as individuals become more aware of privacy rights and the responsibilities of organisations to handle their data in a responsible manner. “Electronic data” extend to email and other forms of digital communication. Ensure that any discussion of students is professional and any information shared is done so for fair and lawful reasons. A failure to disclose all data held on an individual, which is subsequently discovered, could result in more significant sanctions for the institution.&nbsp;&nbsp;

Outsource with care

Consider how any use of off-campus systems might affect the host’s (and your) data collection responsibilities. For example, a cool online system that provides informal quizzes on an academic subject might be viewed as a good opportunity to provide extra resources for teaching and learning. However, systems hosted overseas (particularly those without GDPR compliance) that might collect personal data about the student – and which then results in the student being spammed by the third party – need careful consideration. At the very least, a data protection impact assessment to assess whether the organisation has responsibility for the processing of students’ data needs to be carried out.

This is not the same as the use of cloud providers to implement core institutional services, such as email systems and learning platforms. There will be formal agreements in place between the institution and provider (processors) with appropriate impact assessments being carried out before entering into service delivery. This is not the case with the ad hoc use of third-party systems used on a whim by a member of staff.&nbsp;

Social media can be a double-edged sword

Consideration should also be given to the use of informal platforms and social media for communication with students. While this might seem like meeting students in “their world”, the risk of blurring social and work boundaries, which may impact on student privacy, is significant. 

For example, a WhatsApp message to a student giving them guidance on an assessment may unfairly advantage that student and lead to accusations of bias or unfairness. 

Similarly, setting up WhatsApp groups to allow students to discuss a learning subject has the potential to share personal data (for example, mobile numbers), which students may not wish to do, and if they “opt out”, they may be placed at a disadvantage. 

Keep all communication on institutionally managed systems where impact assessments have been carried out, regardless of how convenient informal systems might at first appear.&nbsp;

Make sure everyone understands data protection duties

Finally, ignorance is no defence in law. While there is a growing trend to provide online data protection training, institutions need to consider whether this is sufficient to make staff both aware of data protection duties and how to respect student privacy. It is likely that many “solutions” do little more than provide weak arguments for institutions that: “Well, they’ve been trained, so it’s not our fault.” This claim might be found wanting in the event of a disclosed data breach or unlawful practices discovered as a result of a subject access request. 

Anyone with data protection duties needs to be effectively briefed regarding these responsibilities, receive appropriate training and have their responsibilities made clear through documented policy.&nbsp;

Perhaps the best advice is: if in doubt, ask. All institutions should have data protection officers and professional staff with designated data protection responsibilities, and if they don’t know the answer, they might be able to delegate to external data protection experts.

Andy Phippen is professor of digital rights at Bournemouth University.

If you found this interesting and want advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the THE&nbsp;Campus newsletter.

Increased scrutiny of universities as keepers of valuable data means institutions need to be well versed in data protection responsibilities. Andy Phippen offers key aspects to consider

Balancing student data collection and privacy protection

A worrying 92 per cent of higher education institutions identified breaches or attacks in the past 12 months, according to the recently published 2022&nbsp;Cyber Security Breaches Survey. As I&nbsp;write this, five institutions were in their second week of actively managing the impact of a cyberattack. Such an incident can take days or weeks to recover from, and in some cases many months. The average cost is £3.2&nbsp;million, according to IBM’s Cost of a Data Breach Report 2021. Can any of you reading this say with certainty that there isn’t a nefarious character lurking somewhere on your network, waiting quietly and poised to attack?

I recently participated in two panel debates on cybersecurity, one at “Ahead by&nbsp;BETT” and the other at the UCISA22 Leadership Conference. Both sessions included chief information officers (CIOs) who had been through a cyberattack and come out the other side – me&nbsp;included. So what have we learned from these harrowing experiences?


	Cybersecurity remains a critical issue that universities must face
	Supporting cybersecurity literacy for workforce-ready graduates
	Cybersecurity in the HE sector – getting the basics right


1. Prevention is better than cure, so be better prepared

I’m sure all of us have a business continuity plan, somewhere, maybe gathering dust. It will invariably include a&nbsp;section on loss of&nbsp;IT. It might actually include a section on recovering from a cyberattack. But when was the last time it was tested? Those plans need a good rehearsal. Get everyone around a table. If you lost everything, where would you start? Is there a clear priority for recovering systems and services? Are you sure you know all the interdependencies? What if your data backup systems were encrypted by ransomware? Ours were.

Few business units really appreciate what having no&nbsp;IT is&nbsp;like. Everyone always assumes that IT will be up and running again soon. Those units must have contingency plans in place to deal with a prolonged outage. Moving services to the cloud may lull you into a false sense of security. Hosted services might not be immune, and if authentication stops working, you might not be able to access them at&nbsp;all.

Be ready with the comms plan and get messages drafted now in the cool calm of normality. How will you communicate with staff and students if the IT systems are down? How will you communicate with each other, especially if you are working remotely? Try to avoid having to use your website home page to get important messages across, otherwise you are sharing them with the rest of the world.

2. Get buy-in from the very top

Cybersecurity is not just a matter for the IT department. Everyone needs to understand what their responsibilities are – at an individual level, at a business unit level and right to the very top. The vice-chancellor, governing bodies and audit and risk committees should have full visibility of cyber risks and mitigation strategies.

A good checklist for senior management is Jisc’s “16&nbsp;questions you need to ask to assess your cyber security status”.

3. Use the tech and use it well

Most security breaches occur weeks and months before the obvious attack occurs. While there are some sophisticated (and correspondingly expensive) threat detection and protection systems out there, and you should certainly consider investing in them, there are also some very simple steps that must be done.

Ensure that all users (yes, students too) have strong passwords and multi-factor authentication enabled. This is the norm across most online services now, and it should be the norm in universities, too. A show of hands at UCISA22 suggested that less than half had enabled this.

Review your privileged accounts. Do you really need them? After the University of West London’s (UWL) breach, we reduced the number of domain administrators from more than 50 to just a handful. It’s a lot easier to do those now than it is to wait until you have to assume that all accounts have been compromised, forcing a wholesale password reset.

Segregate networks so that if an attacker gets access to one device, they can’t access the whole IT estate. Ensure that systems are properly patched at both a system and application level.

4. Invest now, and don’t wait until it’s too late

While a crisis might help to fund work on cyber improvement plans, don’t wait until it’s too late. The case for investment should be made now. Jisc and Universities&nbsp;UK have been pushing cyber at the door of vice-chancellors. From a media perspective, these attacks are still seen as high-profile and garner significant coverage, resulting in reputational risk. There are enough of us now to speak of our experiences to executive teams and governing bodies to help nudge investment cases over the line.

Get expert help and support on tap for when you’ll need it. Whether it’s through sector-led shared services such as HEFESTIS, through dedicated cyber insurance and recovery assistance (although that’s becoming harder to source by the day), or via a specialist tech company, get the contract in place now. Trying to set up a new supplier and getting a significant purchase order approved in a hurry and without any IT systems working is not easy – and I&nbsp;know.

5. It’s all about people

As good as the tech may be, people invariably are and always will be the weakest link. Six years on from its data breach, the University of Greenwich had enough time to really embed a “security first” culture. Staff have to complete compulsory cyber training. At UWL, this is refreshed every year, and cyber is a recurring theme at termly all-hands meetings. Those universities that have deployed the tech need to ensure that people and processes are in place to act on the alerts generated. When the attack hits, it’s important to protect key staff so that they can get on with the fix and don’t burn out in the process. It can be a very stressful time, and their welfare needs careful consideration.

6. A problem shared is a problem halved

It is really important that we can share, in a safe space, details of any cyberattack with each other – so that others can be forewarned of potential threats and so that the sector can better support itself. I&nbsp;can attest that being a chief information officer in the middle of a cyber event is a scary and lonely place to be, and perhaps the most challenging of my career thus far. Being able to speak to others who had been through that nightmare was invaluable.

So act now. Be prepared, and good luck when your day eventually comes!

Adrian Ellison, associate pro vice-chancellor and chief information officer, University of West London and chair of UCISA.

Thank you to my fellow panellists for sharing their experiences and insight: “Paul&nbsp;A”, the National Cyber Security Centre; Trevor Baxter, director of IT innovation, King’s College London; Rachel Bence, chief information officer, Queen Mary University of London and chair of the Russell Group IT directors’ group; Paul Butler, director of information and library services, University of Greenwich; James Crooks, director of learning and information services, University of Central Lancashire; Mark Ferrar, chief information officer, Newcastle University; David Gillard, interim chief information officer, University of Hertfordshire; Deborah Green, CEO, UCISA; Steve Kennett, executive director for security at Jisc; and David Robertson, chief information security officer at HEFESTIS.

If you found this interesting and want advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the&nbsp;THE Campus&nbsp;newsletter.

It’s not a matter of if your institution will be hit by a cyberattack but when. Adrian Ellison shares some key actions for universities to better prepare for the inevitable

How to prepare and protect your institution against a future cybersecurity attack

Cybersecurity’s profile in higher education has grown in recent years, with numerous universities offering dedicated courses and several now recognised as Academic Centres of Excellence in Cyber Security Education. However, much of this work targets students specifically studying the topic and does not address the need for those across all disciplines to be cybersecurity-literate. The result is that many students enter university with limited cybersecurity knowledge and then graduate in much the same state.Alternatives to this approach include embedding cybersecurity in university curricula more broadly and running awareness campaigns that make clear the distinction between online safety and cybersecurity.Cybersecurity in the HE sector – getting the basics rightSecure and transparent use of student dataCybersecurity in online learningDigital literacy is not enoughUniversities often take a stance on digital literacy and support students in developing the capabilities to use technology in general. However, attention towards cybersecurity (a key underpinning of using the technology safely) is often lacking. Looking at Jisc’s digital capability framework as an example, cybersecurity gets a mention, but you could easily miss it.Seeking a cybersecurity-literate workforceUniversities can enable the future workforce to be cybersecurity-literate. Successive releases of the UK’s Cyber Security Breaches Survey have shown that organisations don’t address awareness to a significant or even sufficient extent. For example, the latest findings suggest that in the past year only 17 per cent of UK business have provided cybersecurity training or awareness-raising sessions for staff who are not directly involved in cybersecurity. Awareness and training consequently end up ill-served compared with most other aspects of cybersecurity, and certainly get less attention than technical measures. And yet we’re continually told that people are the “weakest link” in cybersecurity. Is it any wonder if we don’t support them and they are left to fend for themselves?Getting the message acrossThose heading towards the workplace need to get their awareness from somewhere, and universities are well placed to take a role in providing this knowledge. Although it would be nice to imagine that incoming students are already up to speed, cybersecurity isn’t necessarily on their radar or properly understood. Schools have (quite rightfully) established a strong message around e-safety issues such as cyberbullying, data sharing and grooming, but cybersecurity aspects haven’t come through as clearly. There is also a risk of the issues being conflated, such that students consider they know about cybersecurity because they think it’s the same as online safety.By covering the foundational cybersecurity knowledge and behaviours, universities would reduce the need for organisations to address basic awareness and hygiene aspects. This would also make the graduates themselves more workplace-ready.What does cybersecurity literacy look like?As a baseline, everyone should know the fundamentals promoted by the National Cyber Security Centre’s Cyber Aware campaign. This covers a series of important measures, which readers may also wish to check against their own knowledge and practices. These are:protecting your email accounts with a strong password (an email account can contain sensitive information, and often represents a “hub” account to which&nbsp;password reset messages for other accounts will be sent)keeping devices updated and turning on automatic updatesenabling two-factor authentication on important accountsenabling security features on devices (such as authentication, auto-lock and any “find my device” features)using antivirus and firewall protection where availablesecuring smart/connected devices (ensuring that they are not overlooked alongside our traditional computing devices)ensuring downloads are from trusted/official sourcesbacking up data and enabling automated backups.Shaping and sharing the messageUnfortunately, simply directing students towards the guidance and relying on them to read it is unlikely to get very far. Many won’t look anyway, and those who do may have questions about how to put the advice into practice. The NCSC site has “how to” links for some points but being told is often no substitute for being shown.So, another opportunity for universities to contribute is by promoting the advice to students more proactively, providing the chance to explain it more fully, offering practical guidance to help people apply it on their own devices, and framing the messages so that they speak to the student audience, highlighting the relevance to their university life and beyond.Exactly how to do it depends on the appetite, capacity and commitment of the university. We can think in terms of a layered approach, depending upon how much support the university is willing and able to provide. A baseline would be an awareness campaign, aligned with (or even directly promoting) a wider initiative such as Cyber Aware. Going further, this could be supplemented by internal roadshows or pop-up events, or more structured opt-in skills training that focuses on ensuring that students can do what Cyber Aware is suggesting.But arguably the most valuable and impactful approach would somehow integrate cybersecurity skills training by default within curricula. In this way they are sure to feature somewhere within the student experience, and we boost the chances of shaping workforce-ready, cybersecurity-literate graduates.Steven Furnell is professor of cybersecurity at the University of Nottingham.If you would like advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the Campus&nbsp;newsletter.

Employers need a cybersecurity-literate workforce, and higher education could play a valuable role in filling the gap

Supporting cybersecurity literacy for workforce-ready graduates

With IT now almost essential in our everyday lives and the internet of things (IoT) becoming more mainstream, we’re adding more and more potential risks into our networks, and the education sector is no exception. Crucially, schools and academic institutions are struggling to tackle the cybersecurity challenge, above all else forgetting to implement the fundamentals. 

Typically, the easiest way for a bad actor to gain access to any system is through people – staff and students – via social engineering tactics such as phishing. But often this only provides the bad actor user-level access, a foothold in the network – what hackers are really after is administrative control and “owning” systems, because at this point their options become limitless.

To achieve ownership, the bad actor will generally look for known vulnerabilities to exploit, bearing in mind they will have already bypassed protective measures such as internet firewalls. If successful, they will gain further access privileges until they end up with administrative access to a system. The attack is far simpler than you would think, requiring tools that can be legitimately downloaded from the internet for free – the same tools often used for more ethical purposes such as penetration testing and vulnerability assessments.


	Cybersecurity remains a critical issue that universities must face
	Tips on implementing cybersecurity in online learning
	Cybersecurity is not just for the geeks in the IT department
	&nbsp;


Of course, with this kind of high-level access, cybercriminals can acquire all kinds of data including teaching resources, financial records and staff, student and parent information. What we’ve also seen in the past year among higher education institutions is a rise in ransomware, where hackers may encrypt breached data and demand a sum of money for its release. The National Cyber Security Centre (NCSC) has issued official alerts to encourage the sector to take better preventative action.

So, how can schools and higher education institutions do this?

Training staff and students to recognise social engineering attempts is of course beneficial, but humans are always going to make mistakes, so it is likely that someone will succumb to and be caught by a phish at some point, which may well result in their own credentials being compromised. Multi-factor authentication is strongly recommended for every user on every system that supports it to ensure that if someone does have your password because of a successful phishing attempt, they won’t have access to the multi-factor solution – your phone, for example.

These measures are important, but it should also be assumed that at some point, whether through malware, a remote access solution or a compromised password, a bad actor will get in somehow. At this point, vulnerabilities – 164,873 of which are currently listed in the CVE (Common Vulnerabilities and Exposures) – may be exposed, which hackers can often exploit using pre-written code published on the internet.

The “basics” that the education sector needs to be looking at to reduce its risk should target these vulnerabilities. This is achieved through making sure all operating systems, software and applications have the latest security updates applied so that the HE institution is not running anything with serious flaws and vulnerabilities. 

A good example of software that is generally seen as problematic in the tech world is Adobe Flash, which currently has 1,460 known vulnerabilities (far higher than similar browser-based technologies such as QuickTime or Shockwave) listed in the CVE database, 11 of which are “new” since the product was discontinued by Adobe in December 2020. That’s 11 potential gaps available for a bad actor to use for gaining access to an institution’s systems. 

We are also seeing a newer risk arise with IoT devices, purchased mainly by departments and not necessarily adopted by IT teams, all of which are connected to the internet and running software which itself could have vulnerabilities and be exploited. It sounds crazy, but it won’t be long before there’s a breach caused by a software vulnerability in a fridge or coffee machine.

While higher education institutions face several challenges regarding cybersecurity, particularly in managing many users on its network (often on their own devices), more must be done at a basic level to tackle the cyber threat. Along with a good process to manage security updates, universities should have a vulnerability review programme in place, completing at least annual vulnerability assessments to ensure they know exactly what they have and what, if any, risks there are. If discovered early, these issues can be remediated, avoiding any old exploitable vulnerabilities being live and available within a network.

Good password policies and multi-factor authentication are also essential, the latter of which can, in most cases, be deployed easily throughout your systems at no additional product cost. Cyber awareness training for both students and staff will also play an integral role in a university’s cybersecurity strategy, as human error will likely always be the most common cause of cyberattack or breach.

On a final note, higher education institutions can begin to address these core cybersecurity controls by aligning with Cyber Essentials, the UK standard developed by the NCSC, which is specifically designed to deal with the basics, reducing the risk of suffering commodity-based attacks by up to 80 per cent. 

Cyber Essentials may also be stipulated for certain grants and funding in the education sector, for example, it is now required by the Education and Skills Funding Agency. We recommend everyone looking at the standard and, at least, ensuring they align; at best, achieving the certification.

Clive Madders is chief technical officer and assessor at Cyber Tec Security and has more than 25 years’ experience in the industry.

If you found this interesting and want advice and insight from academics and university staff delivered direct to your inbox each week,&nbsp;sign up for the THE&nbsp;Campus newsletter.

Managing security updates, vulnerability reviews, password policies and multi-factor authentication are staple university needs, says Clive Madders

Cybersecurity in the HE sector – getting the basics right

It’s no surprise that our latest cybersecurity survey shows that universities cite ransomware as the top threat this year. There’s been a huge spike in this type of attack against our sector, with the number of incidents in the first half of 2021 surpassing the total in all of 2020. It’s fair to say that it’s no longer a question of whether an institution will face a cyberattack, but when.

Jisc and partner agencies including the National Cyber Security Centre have, for some time, been advising tertiary education providers&nbsp;on how to defend themselves. Even so, devastating attacks continue − systems are crippled, data are lost and stress levels soar for staff and students alike. Recovery can take months and cost millions.

It’s vital that we work together to reduce risk and strengthen security, and it’s essential that senior leaders get involved. Jisc’s role is to provide threat intelligence and guidance and protect the national research and education network, Janet, on which our members rely. 


	Secure and transparent use of student data
	Cybersecurity in online learning
	Running safe and secure online meetings and calls
	&nbsp;


Vice-chancellors and boards are responsible for ensuring there is protection in place for the cyberspaces within their institutions, but our survey suggests that not all senior leaders are as engaged as they need to be.

Although 86 per cent of higher education institutions (HEIs) regularly report on cybersecurity risks and resilience to their executive board, and a similar percentage report that cybersecurity is a strategic priority at their university, this still leaves a significant minority where this is not the case. 

These institutions are unlikely to have sufficiently robust processes and technical solutions in place to stop or mitigate an attack when it happens − and very unlikely to have recovery plans.

There is no silver bullet for this issue. Reducing the risk is multilayered and requires a range of interventions. We need ongoing government support for critical infrastructure, financial investment from the sector in specialist staff and services and leadership from senior teams to create the conditions to enable change to happen within their institutions.

Given the financial implications of the pandemic, investment will be a challenge, but it’s likely to be substantially cheaper than the devastating impact of a significant and sustained system outage and/or data breach. 

There’s no doubt that recruiting skilled security and IT staff is difficult because of the UK’s technical skills shortage. While the government is tackling the skills gap in several ways, including rolling out free courses in STEM subjects such as cybersecurity, the public sector cannot easily compete with the much higher salaries offered by commercial organisations. 

Remote or hybrid working policies will help expand the pool of candidates beyond geographical boundaries, but attracting and retaining the right people will remain a problem for the sector.

There are effective steps universities can take to help protect themselves in terms of processes and services. We encourage all senior teams to engage with their technology leaders to ensure these things are happening in their institutions − noting that significant investment may well be required to put them in place:

Vulnerability management and patching procedures are essential for all systems, with priority given to critical and externally accessible services. &nbsp;&nbsp;

Segmenting and isolating all critical service infrastructure helps prevent attackers who gain access to one system moving on to others. 

Implementing segregated central logging and monitoring of critical systems enables early warning of potential problems and will help in incident investigations. 

Ensuring backups are segmented, secured and tested regularly is paramount, as is frequently rehearsing incident response plans and procedures. Practice won’t make security perfect, but it will ensure that your response in the event of an attack is effective and that you can recover as quickly as possible. 

Controlling system access is vital too. Only those people who need access should have it. Multi-factor authentication (MFA) has a significant role to play in controlling system access more widely and, therefore, reduces the risk of a successful ransomware attack. 

There has been a sharp rise in the deployment of MFA during the pandemic, but it’s not yet in place across the board. We recommend that it’s rolled out to all systems, all staff and all students. Our survey shows that 87 per cent of HEIs are now implementing MFA for some or all staff (up by 15 per cent on 2020) and 49 per cent have it in place for some or all students (an increase of 27 per cent on 2020). 

Similarly, security awareness training is a key tool in preventing security incidents caused by phishing and other “human errors”, which the survey acknowledges as the second and third top threats this year, behind ransomware. 

To help underpin knowledge-sharing and maintenance, we advocate mandatory training for all. The survey reveals this to be an opportunity area for the sector, with 73 per cent of universities running compulsory training for staff, but only 9 per cent insisting that students take a course. 

Continuing the trend of the past five years, perceptions of cybersecurity protection are not high in HEIs, with only 17 per cent (16 of 93 respondents) scoring themselves at 8 or more out of 10. The mean score is 6.3. 

So, while the latest stats show the trajectory is heading in the right direction, we believe, as many of you will too, that more could be done. And Jisc is here to help.

Heidi Fraser-Kraus is CEO of Jisc.

Statistics show that universities are getting better at defending against and preparing for cyberattacks, but much more needs to be done, says Heidi Fraser-Krauss

Cybersecurity remains a critical issue that universities must face

While many in the higher education sector view cybersecurity knowledge as solely the domain of the IT department, computer science students or shadowy hackers, this year has highlighted many examples of how online learning, and students’ wider use of online platforms, would benefit from a greater understanding of online security fundamentals.Protecting one’s devices from unauthorised access and the downloading of personal images, or preventing someone from playing pornography in an online class, requires not only awareness of harms and the correct safeguarding policies but also some technical capabilities to help everyone mitigate digital risk.The need for online safeguarding to extend into higher education is, thankfully, gaining traction, albeit hampered in the UK by a lack of interest from the regulator. It is perhaps unsurprising that this has garnered greater interest in a year of online teaching and the associated online pastoral support for students.As two academics who have worked hard to encourage universities to engage with online safeguarding in a proactive manner over recent years, we are pleased to see an increase in coverage in the higher education press, along with calls from institutions for help defining policy, raising student awareness or putting systems in place to support students at risk of online abuse. Obviously, this THE Campus Spotlight addressing many aspects of online safeguarding reflects the increased importance placed on the topic by the sector.&nbsp;However, one aspect that seems to be missing from these discussions is the intersection between online safeguarding and cybersecurity. Both disciplines have at their heart the wish to manage risk when online, but from an educational perspective it seems that the two exist on parallel tracks with no chance of convergence in the future. This is not unique to HE; we see similar a situation in statutory settings, where online safety is viewed as an aspect of social education and cybersecurity is a technical skill.&nbsp;However, to take a simple example, if someone shares intimate images with their partner, it is possible that these images end up in a cloud store. Without effective password practices&nbsp;– using strong passwords that aren’t easy to break or, even better, two-factor authentication – the subjects of those images are immediately placed at risk should someone try to guess the password to the store and download and distribute those images. Put simply, good cybersecurity knowledge results in a better skill set to mitigate the risk of online abuse.&nbsp;If we are concerned about the level of online safeguarding knowledge of our students when transitioning from school to university, we should be doubly concerned about their cybersecurity knowledge.While there are some statutory requirements for schools to deliver some form of online safety education to their students (notwithstanding education poorly defined in national guidance and rarely inspected by the regulator), no such requirements relate to cybersecurity knowledge. While there is some coverage of cybersecurity basics in the computer science curriculum in schools, there is no requirement to study this subject beyond Key Stage 3. Or, to put it another way, our first-year university students might have received no education on cybersecurity since the age of 13.&nbsp;When extending the cloud store scenario above around the need for effective authentication knowledge, we have had many discussions with students about the use of technology in personal relationships.While initially surprised by disclosures, we have become used to confessions of sharing passwords and devices with partners “because we trust each other”, only to see relationships break down and subsequent unauthorised access to devices and file stores, which has resulted in coercive control and harassment by the once-trusted ex.Again, with better knowledge of access control, and the associated rationale for not sharing the means to access devices with others, regardless of how much they love each other, a mitigation of risk of abuse in these scenarios is achieved.&nbsp;From a staff perspective, there is certainly a need to be aware of cybersecurity fundamentals in delivering education online and helping students mitigate their risk of harm. We have seen increased attacks on the higher education sector recently, sufficient to raise concerns for the National Cyber Security Centre, which has updated its guidance to the sector regarding how to address ransomware.While the infection vectors of recent attacks have not been determined to date, we know that phishing – disclosing data such as usernames and passwords as a result of being misled by convincing emails – is a popular route and there have been successful, high-profile phishing attacks on the sector in the past.Further examples of the need for cybersecurity knowledge come from issues that have arisen around Zoombombing, where pornographic content has been played during online lectures. In some cases it seems that unknown participants play this content; in other cases it is known students. Regardless, good knowledge of access control means that, first, the lecture is not open to those without a password and, second, participants are not provided with the means to take over a session. Furthermore, a knowledgeable member of staff will know how to manage, and if necessary eject participants from, a session.Clearly, there is real need for cybersecurity knowledge that extends far beyond corporate IT – a digitally resilient institution is one that has effective safeguards in place but also one that equips all stakeholders with the knowledge to keep their, and corporate, assets protected. While this might seem like yet another call for yet another session of staff training and student education outside their programme of study, these are, essentially, life skills. They are as fundamental to employability as the capability to construct a CV.Andy Phippen is professor of digital rights at&nbsp;Bournemouth University and Emma Bond is professor of socio-technical research at the&nbsp;University of Suffolk. Between them they have more than 30 years’ experience researching online safeguarding.

Our first-year university students might have received no education on cybersecurity since the age of 13, say Andy Phippen and Emma Bond

Cybersecurity is not just for the geeks in the IT department

When then UK Labour leader&nbsp;Jeremy Corbyn’s plan for free high-speed broadband was presented in 2019 it was seen as “crazed” by some, but then the pandemic hit and we realised that access to the internet should be seen in the same light as electricity – as an essential utility. Access to the internet has been vital over the past year as many were forced to work from home and needed to connect with others.

Schools, colleges and universities across the world had to quickly mobilise resources to ensure continuity of learning for their students, to varying degrees of success. For many this was uncharted territory and inevitably mistakes were made, from unauthorised users “Zoom-bombing”&nbsp;online classrooms and posting abusive messages and obscene images, to inadvertent sharing of information. Our own prime minister was a victim of this, sharing the ID of an online meeting in a tweet.

So, how should education providers navigate the dangers of online teaching to keep their students and staff safe?

Training is key 

Many at our university were already working in the online space, so when the pandemic hit it wasn’t a massive change in our daily activities. For many universities, though, the move to online has required a complete overhaul of working practices, the use of dozens of new tools and the sharing of a lot of personal information online – whether through the backgrounds on a Zoom call or the details shared with a tech provider when setting up an account.

We made the move from face-to-face to online very quickly, including a major switch from one online conferencing tool to another. This occurred with minimal disruption because we recognised the need for training to ensure everyone bought in to the change.

There are some key elements that training should cover:

Using the technology 

Ensure that everyone understands how the tools work, what features they provide and what the points of failure may be. Zoom is great for getting multiple users in a virtual room, but it also offers polling, breakout rooms and screen sharing –&nbsp;features that are great for encouraging engagement but not familiar to everyone. We conducted our training using the same tools that academics would use, so they felt what it was like to be a student.

Online etiquette and the role of moderation 

We&nbsp;all watched with amusement the Handforth parish council meeting that went viral recently, but on a more serious note, such unreasonable behaviour needs to be managed and dealt with in the same way as in a face-to-face classroom. This means ensuring that participants mute themselves so as not to distract the session and intervening when discourse becomes unacceptable.

Adhering to privacy requirements 

Ensure that students are not sharing personal or identifying information. This applies not just to what is posted in chat but to webcams. In addition, academics need to check what they have open on their screens: turning on content sharing may reveal that&nbsp;private email you are composing to a student, for example. When creating meetings these links are shared only with our students via our Virtual Learning Environment, not posted publicly. Meetings always have the waiting room enabled so that we can actively manage the session participants and who joins. Allowing only the host to share content also ensures that students can’t share anything inappropriate, along with their email addresses. A multiple screen setup may help here, moving content over and sharing it from a separate screen.

Keeping meetings secure is essential 

Using a paid-for version for a tool will give you more options than the free one and gives you more flexibility in terms of number of participants and where recordings are held. We bought a number of additional licences and increased our capacity to hold recordings in the cloud as we ramped up the number of sessions we were running. Students need to understand their responsibilities: it must be made clear they should not share their login details or meeting IDs with others.

Educating users about phishing attacks 

Staff and students should be trained in what to look out for to avoid phishing emails that entice people to click on links then install malicious software on their PC or laptop, allowing hackers to hijack the machine. These emails can be very cleverly crafted and even seasoned professionals can fall prey to them if they have been designed to look like they came from colleagues. It is worth equipping staff and students with additional knowledge and tools to spot telltale signs. Institutions should test awareness, with the IT department sending out a&nbsp;test email with a link to see how many blindly click it, and put in place remedial training for those that don’t check the legitimacy of emails.

Having all this training available in an online repository would be helpful. Building it into the induction process for new staff and students at the start of an academic year would be the ideal time to ensure&nbsp;it is delivered.

We can now see the light at the end of the tunnel in terms of returning to the classroom but technology-enhanced learning and online teaching is here to stay in some form. We need to continue being vigilant and protecting our students and staff as we integrate online tools into our teaching.

Mohammed Rehman is&nbsp;head of the School of Computing at&nbsp;Arden University. 

Mohammed Rehman explains what steps universities should take to educate staff and students about cybersecurity and how to protect themselves when teaching and learning online

Cybersecurity

Change is coming, whether higher education likes it or not

Deepfakes are coming for higher education. What can we do to prepare?

There’s nothing technical about cybersecurity

Five ways universities can protect faculty from online harassment

Should we be worried? An educators’ introduction to the metaverse

Everything you need to know about cyberattacks (but were afraid to ask)

Balancing student data collection and privacy protection

How to prepare and protect your institution against a future cybersecurity attack

Supporting cybersecurity literacy for workforce-ready graduates

Cybersecurity in the HE sector – getting the basics right

Cybersecurity remains a critical issue that universities must face

Cybersecurity is not just for the geeks in the IT department

Cybersecurity in online learning

Discover

More from THE

Sign up

Collaborate with THE

About

Legal stuff

Cybersecurity

.css-1ndcrd1{overflow:hidden;overflow-wrap:break-word;max-height:108px;text-indent:0px;}Change is coming, whether higher education likes it or not

Deepfakes are coming for higher education. What can we do to prepare?

There’s nothing technical about cybersecurity

Five ways universities can protect faculty from online harassment

Should we be worried? An educators’ introduction to the metaverse

Everything you need to know about cyberattacks (but were afraid to ask)

Balancing student data collection and privacy protection

How to prepare and protect your institution against a future cybersecurity attack

Supporting cybersecurity literacy for workforce-ready graduates

Cybersecurity in the HE sector – getting the basics right

Cybersecurity remains a critical issue that universities must face

Cybersecurity is not just for the geeks in the IT department

Cybersecurity in online learning

Change is coming, whether higher education likes it or not