[论文解读] Understanding Cyber Threats Against the Universities, Colleges, and Schools

Harjinder Singh Lallie, Andrew Thompson+2 more|arXiv (Cornell University)|Jul 15, 2023

Information and Cyber Security被引用 10

一句话总结

本文对全球教育领域的网络威胁进行评估，提供了58起攻击时间线，分析来自学生的内部威胁，并提出缓解建议。

ABSTRACT

Universities hold and process a vast amount of valuable user and research data. This makes them a prime target for cyber criminals. Additionally, universities and other educational settings, such as schools and college IT systems, have become a prime target for some of their own students -- often motivated by an opportunity to cause damage to networks and websites, and/or improve their grades. This paper provides a focused assessment of the current cyber security threat to universities, colleges, and schools (`the education sector') worldwide, providing chronological sequencing of attacks and highlighting the insider threat posed by students. Fifty-eight attacks were identified, with ransomware being the most common type of external attack, and hacking motivated by personal gain showing as the most common form of internal attack. Students, who have become a significant internal threat by either aiding or carrying out attacks are not a homogeneous group, as students may be motivated by different factors, therefore calling for targeted responses. Furthermore, the education sector is increasingly reliant on third party IT service providers meaning attacks on third parties can impact the university and its users. There is very little research analysing this problem, even less research analysing the problem in the context of schools. Hence this paper provides one of the first known assessment of the cyber attacks against the education sector, focusing on insider threat posed by students and offering recommendations for mitigating wider cyber threats.

研究动机与目标

• 识别全球教育领域网络威胁的范围与演变。
• 突出学生带来的内部威胁，并区分学校和大学生之间的差异。
• 提供攻击时间线，作为进一步研究与比较的平台。
• 评估第三方服务商在传播教育机构风险中的作用。
• 提出缓解措施，并使建议与如 JISC 等机构的现有指南保持一致。

提出的方法

• 综合来自网络安全公司、新闻媒体和政府来源的公开数据，以构建网络攻击时间线。
• 将攻击编码为四个属性（实施者、攻击类型、影响、动机）以进行可视化与分析。
• 将攻击分为外部威胁与内部（学生）威胁，并量化动机与结果。
• 将事件汇总并总结为包含日期、类型、描述、归因和影响的主表。
• 将发现与现有报告（如 JISC）进行比较，并讨论数据质量与报告的局限性。

实验结果

研究问题

• RQ1 全球范围内的大学、学院和学校所面临的网络攻击的范围与时间序列是什么？
• RQ2 在动机和攻击类型方面，学生内部威胁在学校与大学之间有何不同？
• RQ3 教育机构常见的外部攻击向量及其影响是什么？
• RQ4 哪些缓解策略和政策建议可以降低风险并提升教育领域的韧性？

主要发现

• 在1988年至2022年间共识别出58起网络攻击，其中勒索软件是最常见的外部威胁，成绩篡改是一个显著的内部威胁。
• 勒索软件是主要的外部干扰，而学生的内部攻击最常涉及黑客入侵和成绩篡改。
• 内部威胁并非同质；学校学生与大学学生表现出不同的动机和攻击特征，因此需要定制化的应对措施。
• 对第三方IT服务提供商的依赖日益增加，意味着对这些第三方的攻击可能会影响受害机构。
• 事件的公共披露不均衡，普遍存在低报，实际情况中全面披露相对较少。