Case Study: The lessons learned from the ANU hack
In June 2018, ANU discovered they had a security breach that involved the threat actors gaining access to a variety of personal information such as contact information, birth dates, tax identifying information, payroll information, bank account details and raw student academic records. Shortly after the announcement of the breach, the university courageously released a comprehensive report to the public.
According to the report, the university’s cyber security system was complex enough, but the systems leveraged in the attack were outdated and the actors were persistent.
The initial understanding of the ANU attack and the university’s report seem to link the cause of the cyberattack to common factors witnessed in educational institutes such as failing to do the following:
- Patch and retire legacy systems.
- Segment the network, separating external facing systems, legacy systems, the IT management network and the general user population.
- Build a mature cyber incident detection and response capability.
- Fully roll out multifactor authentication (MFA) for externally facing systems and privileged accounts.
- Tune email filtering technology to block a vector attack.
There is a focus on increasing cyber regulatory measures to protect education institutions. Poor IT controls increase the risk of inappropriate access, cyber security attacks, data manipulation and misuse of information security policies, so it is important to understand these organisational weaknesses.
Five guiding principles
1. Protect what matters most
In an environment such as the education sector where there is so much to protect, leadership must focus on securing the information and assets that have the biggest impact on their business’ mission.
2. Manage cybersecurity risk at the right level
Confirm that the institution takes a whole-of-organisation approach to cyber security, with operating units understanding their roles.
3. Provide the right access at the right time
By simplifying access processes for the user base, educational institutions can provide a better user experience and more easily identify unauthorised users.
4. Recover quickly and securely
From IT professionals with hands on keyboards to the university’s senior management and Senate, it is essential that educational institutions know what to do when a cyber incident occurs.
5. Practice proactive cyber security
Proactive security combines traditional security defences and a strong security foundation with realtime monitoring and intelligence-led data to predict security events.
Find out about more about a cyber security approach for leadership in education.
Summary
When it comes to network compromise, it is no longer a question of if, but when. At its core, cyber security seeks to reduce vulnerabilities and build capacity to identify and respond to these incidents. Although a cyber security program cannot guarantee absolute security, it will provide the capability to manage the impact of such malicious cyber incidents and enable the reduction of harm to reputation, manage the impact of such malicious cyber incidents and reduce the reputational harm to the institution due to the compromise of the confidentiality, integrity, or availability of systems or data.
