Data-rich universities are both targets and treasure troves

Cyberattacks targeting universities are on the rise, and the threat to higher education is more severe than many realise, says an expert in the Middle East.

“If you look at the statistics that say where education is ranked in terms of cybersecurity attacks worldwide, we’re towards the higher end,” says Iman Megahed, associate vice-president at the American University in Cairo (AUC), where she leads on digital transformation and security.

It is also much harder to protect universities from cyberattacks than it is to secure big commercial organisations such as banks, she believes.

“In a bank, you control everything, right? No one can bring in a new PC and just plug it in. No one can use the internet except to run certain things. In education, you have students. They come in with so many devices – laptops, PCs, watches. And you have faculty who want to do research. You can’t really enforce the level of security controls that you can in a bank,” she says. “But you still have to secure it.”

Megahed adds that she has to employ more tools and tactics to counter the “people” element of security (which is always the hardest, she says), and must ensure that she keeps abreast of the latest threats.

“The world is changing rapidly. We are seeing so many security attacks that we have never seen [before],” she says.

Has this threat increased with the recent geopolitical instability? “If you read the literature of the Russia-Ukraine war, you find that a lot of the risks happening there were cyberattacks. So I don’t see why not.”

Universities hold vast amounts of data on their students, she points out, including transcripts of their academic progress, records of their physical and mental health (if they have accessed university support services), and information about their parents’ finances (if they receive financial aid). All of this must be kept secure.

Then there is the academic research that must be kept private, while also allowing faculty to collaborate with researchers at other institutions. “The research piece is even more challenging…They [scholars] want to be able to have students or people who collaborate from other universities to have access to all of this, but it has to be secure.”

How to prepare and protect your institution against a future cybersecurity attack

The Egyptian government is currently bringing in a data privacy law, similar to the European Union’s General Data Protection Regulation (GDPR). “Just like everywhere else in the world, this is becoming very big. I’m happy that we’re not lagging behind. But then again, it’s putting a lot on our plates,” Megahed says.

The American University in Cairo, which is more than 100 years old, was an early adopter of technology. Nevertheless, until recently, its digitisation initiatives were fragmented, Megahed says. She has been working on a comprehensive digital transformation strategy. “We’re not shying away from change. We changed our learning management system this year; we changed our network completely. You have to be brave about these things, and learn that there will be some failure, and have some tolerance for failure.”

One project that has put AUC at the cutting edge globally is its business intelligence platform. “We realised that we had a landscape that was very data-rich but information-poor, and fragmented and not integrated.” Each unit of the university could previously produce its own data reports, but combining them to gain deeper insights was a chore. Now all the data feeds into a single platform, which can generate reports in any format.

One way the platform is being used is to help select students for enrolment and then to track their academic and career journey. The university combined its data with information from LinkedIn. “You see which schools they [students] were admitted from, which majors they took, what they did, and what their GPA was during college, and then where they ended up…how many of them were CEOs, CFOs.”

Another, perhaps more mundane, use of the business intelligence platform is solving parking issues. With a sudden increase in demand for parking spots and queues building up, the platform can provide data on how many people are arriving and what their profiles are. “This would then help our decision-makers to say, ‘OK, maybe we need a rule that anyone who’s not an undergraduate student in the morning should not be allowed.’”

The tricky part of building the system was persuading different departments to share their data and raise their quality standards, Megahed says. Now, however, all across the campus, the system is valued. “When we set it up, we thought we’re going to have change resistance, and no one’s going to want it. But you cannot imagine. Every time someone sees data, they just ask for more.”

The Arab University Rankings 2024 will be published on 4 December.