Security for Higher Education

# Security for Higher Education

Definition

Higher education cybersecurity is the discipline of protecting universities, colleges, and research institutions against a threat landscape that is, in several respects, more demanding than what most commercial enterprises face. A mid-sized research university might have 30,000 students, 5,000 faculty and staff, dozens of affiliated research centers, a teaching hospital, and contractual relationships with the Department of Defense, the National Institutes of Health, and dozens of private sponsors, all operating on a shared network that was architecturally designed to be open.

That openness is not a bug. Academic culture has a foundational commitment to the free flow of information, collaborative research, and the right of faculty to pursue inquiry without institutional interference. Security programs that treat universities the way they treat banks will fail, both technically and politically. The discipline demands a different approach: security that is genuinely enabling rather than obstructive, that protects specific high-value assets without collapsing the open environment that makes universities function.

What makes higher education uniquely challenging is the combination of a massive, perpetually churning user population with an enormously varied set of compliance obligations. A research university simultaneously manages FERPA-protected student records, HIPAA-regulated patient data if it runs a medical center, export-controlled defense research subject to ITAR and EAR, and federally mandated cybersecurity requirements for grants from NSF, NIH, and the Department of Defense. No other industry sector faces this breadth of regulatory obligation from a single organizational unit.

The stakes are high. Lincoln College permanently closed in April 2022, the first U.S. institution of higher learning to shut down as a direct result of a ransomware attack. The University of California San Francisco paid a $1.14 million ransom in 2020 to recover research data. Nation-state actors specifically target universities with defense research contracts, treating academic institutions as lower-resistance paths to the same intellectual property they would need to breach the Pentagon directly to obtain.

---

Threat Landscape

Nation-State Espionage Targeting Research Assets

The highest-consequence threat to research universities is state-sponsored intellectual property theft. Chinese APT groups, particularly those operating in support of People's Liberation Army and Ministry of State Security collection requirements, have demonstrated sustained, patient interest in U.S. university research programs with defense applications. The targets are specific: universities with contracts under the Defense Advanced Research Projects Agency, NIH-funded pharmaceutical and biomedical research, and AI and machine learning research programs in university labs.

The FBI and CISA issued a joint advisory in 2023 specifically warning research institutions about this targeting pattern. The approach is methodical. Threat actors establish long-term presence inside university networks, sometimes remaining undetected for months or years, exfiltrating research data incrementally rather than in ways that would trigger anomaly detection. The goal is not disruption; it is collection. Universities often do not know they have been compromised until a federal counterintelligence inquiry surfaces indicators.

The challenge is structural. Universities accept graduate students and postdoctoral researchers from around the world, including from countries subject to export control restrictions. Some percentage of those individuals will have intelligence collection obligations to their home governments, whether voluntary or coerced. This is not a hypothetical; the Department of Justice has prosecuted numerous cases involving individuals who took research data from U.S. universities on behalf of foreign governments. The security program must account for insider threat without becoming an instrument of ethnic or national-origin profiling, which is both legally problematic and antithetical to academic values.

Ransomware and Destructive Attacks

Ransomware operators have identified higher education as a productive target. Universities have three characteristics that attackers value: sufficient financial resources to pay meaningful ransoms, enormous amounts of sensitive data that can be used for double-extortion leverage, and IT environments complex enough that recovery without paying is genuinely difficult.

The Lincoln College closure illustrates the existential dimension. Lincoln was already under enrollment and financial pressure before the attack. The ransomware struck during an already-difficult period, disrupting admissions systems and student services at exactly the moment the college needed those systems most. The board voted to close shortly after the attack. The ransomware was not the sole cause, but it was the final cause.

Beyond research universities, community colleges are frequent targets precisely because they have fewer security resources. A community college with two IT staff and no dedicated security function is not equipped to respond to a sophisticated ransomware deployment. The sector as a whole has significant security capacity gaps at the less-resourced end of the institutional spectrum.

Social Engineering and Credential Theft

University users are statistically more susceptible to phishing than corporate users. The reasons are structural: students have not been through corporate security awareness training, faculty operate with high autonomy and low tolerance for friction in their workflows, and the volume and variety of external communications that faculty and researchers legitimately receive (conference invitations, grant notifications, journal submissions) provide abundant pretexting material for adversaries. Spear-phishing attacks against faculty are highly effective when the attacker understands academic culture.

SMS-based MFA, which many universities rely on, is increasingly inadequate given the prevalence of SIM-swapping attacks and real-time phishing proxies that harvest and replay one-time codes. Universities that deployed SMS MFA as a security improvement five years ago have a false sense of protection that needs to be corrected.

Student-Originated Threats

Students represent a genuine and underappreciated insider threat vector. Students have legitimate access to university systems, including student information systems, course management platforms, and increasingly, research computing environments. A percentage of students will attempt to access grade systems, alter academic records, or exfiltrate copyrighted course materials for commercial sale. The accountability mechanisms that constrain employee behavior, such as termination and professional consequences, apply weakly to students. Expulsion is the primary sanction, and many students calculate, often correctly, that institutions are reluctant to use it.

---

Industry-Specific Challenges

FERPA and the Education Records Boundary

The Family Educational Rights and Privacy Act governs the privacy of student education records and creates specific obligations for institutions that receive federal funding, which is essentially every U.S. college and university. Under FERPA, institutions must protect student records from unauthorized disclosure, provide students the right to inspect and correct their records, and notify students when records are released under specific exceptions.

From a cybersecurity standpoint, FERPA creates a data classification problem. Student records are not a discrete database; they are distributed across dozens of systems, including course management platforms, advising systems, financial aid systems, student health systems, and the gradebooks of individual faculty members. A comprehensive data inventory required to implement any serious data protection program will regularly surface student record data in unexpected locations.

FERPA also creates a breach notification complexity. Unlike HIPAA and most state breach notification laws, FERPA does not contain a specific breach notification requirement. However, the Department of Education has issued guidance indicating that institutions have FERPA obligations following breaches that expose student records, including obligations to notify affected students. Institutions that conflate "FERPA has no breach notification requirement" with "we have no notification obligation" are misreading the regulatory environment.

Export Control Compliance: ITAR, EAR, and the Foreign National Problem

Export control law represents the most legally hazardous compliance dimension in university security. The International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) restrict the transfer of controlled technology and information to foreign nationals, including within the United States. The problem is that universities accept foreign national students and researchers as a matter of mission, and the controlled technology in question often lives in labs and on systems that those individuals access in the normal course of their work.

A "deemed export" occurs when controlled technology is shared with a foreign national on U.S. soil. If a graduate student from a restricted country works in a lab where ITAR-controlled research is conducted, accessing data or equipment without proper authorization may constitute an unlicensed deemed export, which is a federal violation. Universities with defense contracts face particular scrutiny; their contracts often include ITAR compliance obligations that flow down from the prime contractor or from the government directly.

The cybersecurity implication is a mandatory access control requirement. Controlled research must be segregated onto systems where access is limited to individuals who have been cleared, licensed, or determined to be U.S. persons. This requires identity management sophistication that many university IT environments do not have: fine-grained access controls based on citizenship and visa status, enforced at the network and application layer, with audit logging adequate to demonstrate compliance to federal investigators.

Decentralized IT Governance

Most research universities operate under a federated IT model. There is a central IT organization, but each school, department, and major research center operates its own IT staff and makes its own technology decisions. The physics department runs different systems than the medical school, which runs different systems than the law school. A researcher who needs a specialized compute cluster for their work builds it, connects it to the university network, and manages it with whatever security practices they find acceptable.

The result is a network security perimeter that is, in practice, impossible to define. The university's attack surface grows continuously as new systems come online. Security operations teams often do not have accurate inventories of what systems exist. The central CISO's authority over departmental IT is typically advisory rather than directive; a department chair who decides that a security policy impedes research has more organizational leverage than the CISO in most university governance structures.

This is not a problem that can be solved by imposing corporate-style centralized IT governance. The faculty senate will not permit it, the accreditors would consider certain restrictions problematic, and the practical effect would be that research programs move their computing infrastructure off the university network entirely, creating an even less visible and less secure environment. The solution has to be architectural: network segmentation that limits the blast radius of any single compromise, detection capabilities that do not depend on uniform endpoint coverage, and risk tiering that focuses controls on the highest-value assets rather than trying to uniformly harden everything.

Federal Grant Cybersecurity Requirements

The federal grant landscape is rapidly adding mandatory cybersecurity requirements that universities must meet as a condition of funding. The Department of Defense now requires CMMC (Cybersecurity Maturity Model Certification) compliance for contractors handling Controlled Unclassified Information, and universities with DoD research contracts are subject to this requirement. NIST SP 800-171 compliance has been required for DoD contractors since 2017 but has been inconsistently enforced; the CMMC framework introduces third-party assessment to close that enforcement gap.

NSF and NIH are moving in the same direction. The increasing sophistication of grant requirements is creating a compliance burden that smaller institutions and individual research PIs are not equipped to manage. A chemistry professor who wins a $500,000 NSF grant is now potentially responsible for implementing and documenting a security program that a mid-sized company would struggle to manage. The compliance infrastructure is not scaling with the compliance mandate.

---

Related Articles

• Salt Typhoon and Telecom Espionage [VS209]
• Security for Healthcare and Life Sciences [VS-healthcare]
• Export Control and Cybersecurity: ITAR and EAR Obligations
• FERPA Compliance for Security Professionals
• CMMC 2.0: What Defense Contractors Need to Know

---

Sources

1. Verizon. "Data Breach Investigations Report: Education Sector Analysis." 2023. https://www.verizon.com/business/resources/reports/dbir/
2. EDUCAUSE. "2024 Top 10 IT Issues in Higher Education." 2024. https://www.educause.edu/top-10-it-issues
3. FBI/CISA. "People's Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices." Joint Cybersecurity Advisory, 2023.
4. National Institute of Standards and Technology. "SP 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." 2020. https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
5. U.S. Department of Education. "Protecting Student Privacy: Cybersecurity Guidance for FERPA Compliance." 2022. https://studentprivacy.ed.gov/
6. Internet2. "Higher Education Information Security Council: 2024 State of the Sector Report." 2024. https://internet2.edu/communities/higher-education-information-security-council/