This presentation discusses how and why universities are now being targeted in continuous cyberattacks, and the relationship to national security.

1. Cyberwarfare:
Focusing on
Higher Education
as a Prime Target
Nicholas A. Davis, CISSP, CISA
Chief Information Security Officer
University of Wisconsin System
March 9, 2016

2. Higher Education
in the United States
Research, both private and
government focused
Openness, the commitment to
learning and freely sharing ideas
Access to third party research
and intellectual property
An easy backdoor into other
organizations

3. Higher Education
In the United States
Dynamic student demographics,
international students, government
employees, members of the
military
Decentralized governance
structures
High speed networks with massive
capacity to serve as a base to
launch attacks
Strained funding models, in some

4. Higher Education is a
Lucrative Target
Theft of research for financial gain,
national security benefit, or both
Openness implies an assumption of
good intentions among all who
access the data, not arousing
suspicion
Identity theft at a university can be a
treasure trove, not just for financial
gain

5. Higher Education is a
Lucrative Target
• Decentralized governance may
lead to decentralized IT
infrastructure, with technology
gaps, enabling cyberattacks
• Lack of funding may leave known
vulnerabilities intact
• Concern about individual right to
privacy impacts IT security

6. Favored Methods of
Cyberattack Against
Universities
Conduct computer intrusions
Collect sensitive research
Utilize students or visiting professors to
collect information
Spot and recruit students or professors
Send unsolicited email or invitations
Send spies for language and cultural
training, and to establish credentials
Fund or establish programs at a
university

7. Dr. Reece Roth
University of Tennessee
Despite university warnings on the
restrictions on his research, University of
Tennessee professor Reece Roth employed
a Chinese and an Iranian student to assist in
plasma research
Roth also traveled to China with his laptop
computer containing export-restricted
information and had a sensitive research
paper emailed to him there through a
Chinese professor’s email account
In September 2008, Roth was found guilty
on 18 counts of conspiracy, fraud, and
violating the Arms Export Control Act; he
was later sentenced to four years in prison

8. Difficult to Change Mindset
of Some in Academia
Quote from Dr. Reece Roth
“I see this interpretation of the export
control act and concern about homeland
security as a deadly threat to free
scholarly inquiry,” he says. “The problems
I worked on in the plasma lab were not
easy problems. They were hard
problems. When anyone who does
research refuses to hire Chinese or
Iranian students, they’re cutting off their
nose to spite their face.”

9. University of Maryland
Attacker accessed social security
numbers and other personal
information up to 20 years old for
310,000 student, staff, and faculty
Who do you think targeted the
University of Maryland, and why did
they do it?

10. Knowledge of Identities of
Many Federal Employees

11. Summary
Higher education ranks as the third
biggest cyberattack target, behind
banks and retail
The nature of the business of
higher education makes it an
attractive and easy target, creating
both motives and opportunities for
cyberattack

12. Summary
To better prepare for continuous
cyberattacks, universities, in
general, could benefit from:
Newer technologies, such as Cloud
More homogeneous environments
A model which funds cybersecurity
in a manner consistent with the
value of the assets being
protected…………HOWEVER,

13. Evolving Mindset is Most Critical
For Improving Higher
Education’s Readiness

14. Contact Information:
Nicholas Davis, CISSP, CISA
Chief Information Security Officer
University of Wisconsin System
Email: ndavis@uwsa.edu
Resource: FBI Whitepaper
Higher Education and National Security: The
Targeting of Sensitive, Proprietary, and Classified
Information on Campuses of Higher Education
https://www.fbi.gov/about-
us/investigate/counterintelligence/higher-education-and-
national-security