TPRM and Higher Education: Why Hackers Want Student Data

The higher education (higher ed) sector has become a prime target for cybercriminals, and cyberattacks are on the rise. Almost 64% of higher ed institutions were hit by ransomware and cyberattacks in 2022. By comparison, 44% of higher ed institutions reported cyberattacks in 2021. Several data breaches at higher ed institutions occurred at the third-party vendor level. And it was platforms hosting online learning systems that were particularly vulnerable. 

Why Higher Education Has Become a Prime Target for Cyber Crime

The administrators of several higher ed institutions, especially those without mature third-party risk management (TPRM) programs, are left with many questions about how and why higher ed has become a prime target for cybercriminals. 

Some of the main reasons cybercriminals target higher ed institutions are:

1. Security issues. A 2018 report by Security Scorecard ranked education last in cybersecurity of all other industries surveyed. Most colleges, particularly public ones, can’t maintain adequate budgets for IT security. Many also lack formal third-party risk management programs which can identify and mitigate potential risks before they become a problem.
2. Open networks and lots of apps. It's common for departments to buy their own systems and apps. Many systems and app vendors don't complete a central vetting process or security screening. Security screenings, if they exist, are often limited to cloud-based providers.
3. Students are easy targets. Colleges welcome new students each year. With such a large population, it’s difficult for them to provide comprehensive cyber education. Many people lack experience in cybersecurity and are susceptible to common forms of hacking, such as phishing, social engineering, website spoofing, and password theft. 
4. Unregulated devices are prevalent on college campuses. Almost everyone has a laptop, desktop, phone, or tablet. Every unregulated device connecting to the network creates a new opportunity for hackers.
5. Open campuses. You can't find a better environment for social engineering, tailgating, or man-in-the-middle attacks than a college campus. Visitors can sometimes enter undetected, plant USBs, intercept traffic, or enter labs and research areas.

Protecting Student Data With Third-Party Risk Management 

While many higher ed data breaches occurred with third-party online learning platform providers, the need for TPRM does not stop with cloud-based services. Institutions seek to cut administrative costs by contracting with third parties to provide services. That means there is an increase in vendors who have potential access to personal data, including student health services, student housing, and food services, to name a few. Institutions that neglect to implement robust third-party risk management practices play a dangerous and often losing game of cybersecurity roulette.

This is why proper TPRM is needed to protect institutions’ and students’ data. Here are some benefits third-party risk management can bring to the higher education industry: 

• Manage vendors appropriately. When TPRM practices are effectively implemented throughout an organization, all vendors can be evaluated for risk and managed appropriately. This includes activities such as re-assessments and ongoing monitoring to ensure that organizations are protected from new and evolving risks.
• Prioritize vendor scrutiny based on the risk posed. A risk-based TPRM approach allows for higher-risk vendor relationships to be prioritized and managed with more scrutiny. For example, vendors that store sensitive data about financial aid would undergo more rigorous monitoring than a vendor that provides custodial services. 
• Review vendor controls. TPRM practices, such as vendor risk assessments and due diligence reviews, proactively identify those vendors with insufficient controls, such as  cybersecurity practices that are too relaxed and substandard privacy protections.

Institutions should take inventory of all third-party providers and create policies and procedures to ensure that all vendors are evaluated for risk. Colleges and universities must establish robust third-party vendor management programs to protect their students' data and prevent cyberattacks.