rvlsoft - Fotolia
DDoS attacks on universities normally performed by “disgruntled” students or employees
The majority of distributed denial of service attacks on universities are made by students or employees, says the head of infrastructure services at the University of London
Many distributed denial of service (DDoS) attacks on universities are carried out by disgruntled students or staff, according to Steve Knibbs, head of infrastructure services at the University of London.
Knibbs explained at Jisc event Networkshop 44 that many DDoS attacks experienced by universities are an attack on a person in the organisation, rather than the organisation itself.
“There’s always a reason for it,” said Knibbs. “In most cases it’s because people are unhappy – disgruntled employees, for example.”
Knibbs used University College London (UCL) as an example of these cases, where a student carried out an attack against the organisation because they were unhappy with how the college was working”.
Knibbs described the University of London as unusual because, rather than cater to on-campus students, the university looks after approximately 50,000 distance learners across Asia-Pacific (Apac).
The University of London survived 15 years of attack until September 2015, when an ex-staff member launched a cyber attack against the senior manager who was responsible for dismissal, attempting to take the organisation down in the process.
“Not only were they attacking the person, they were attacking the company they had worked for,” said Knibbs.
“That was a DDoS attack. But if you read the press, one in three universities are being attacked every two hours a day.”
According to Knibbs, attacks can usually be categorised as “macho” – a display of force against an organisation to prove it can be done – or a secret attack used to gain an organisation’s data.
“Sometimes an attack is by a student who sees it as a challenge or who doesn’t want to do an exam,” he adds.
Gaining back control
To ensure students and staff are safe when using university technology, Knibbs recommended taking back some of the control over campus systems.
“There’s this balance of giving academics the freedom of the network, but IT needs to make sure we protect the network,” said Knibbs.
“We need to make sure people can do their jobs, but things such as giving people admin rights should be controlled by the IT team.”
Part of providing this balance in ensuring fast support is given to academics to ensure they don’t try and side-step security protocol – something made harder by the bring your own device (BYOD) trend.
Read more about cyber security skills
- UK survey highlights the importance of understanding the online behaviour of young people to prevent them being drawn into cyber crime.
- Despite the UK’s shortage of cyber security skills, recent changes to immigration rules make it no less difficult to hire skilled workers from outside the European Union.
Although students are aware of cyber security, research suggests there is a disconnect between how students feel cyber security affect them versus how it affects organisations.
To combat this, Knibbs suggested providing proper guidance to university students to make them more aware of how to use technology safely and securely.
“There should be best practice given to students, because some of these young students don’t understand cyber – they’re brought up with IT now and it’s so easy, but is security the most important thing to them? Probably not,” Knibbs said.
“What the university should have a responsibility for doing is giving them some good best practice and guides.”
Condemning the term “digital native”
Like many, Knibbs shot down the term “digital native”. He said that, although they have grown up learning how to use technology, younger people still need training to ensure they can use it appropriately in the workplace.
“The older people in my organisation have been through it all. They know what the best practice is,” said Knibbs. “Some of the more mature IT people in the company teach the younger ones.”
The IT industry is currently facing a skills gap with a predicted 756,000 unfilled digital jobs across Europe by 2020, with cyber security professionals in high demand.
“There should be more courses in cyber security,” said Knibbs. “The more young people we have in the IT industry, the better.”
