Universities Get Hacked the Hardest

According to California’s Office of Privacy Protection, 28 percent of that state’s security breaches since 2003 have taken place at a college or university. The people we talked to say it’s not a surprise. Why? Three reasons.

First, college networks are decentralized; some of their infrastructure is outdated; and there is a lack of training and accountability among students, faculty and staff, says Connie Sadler, director of IT security at Brown University. In addition, students who consider hacking a game and are out to prove their ability view colleges and universities as excellent targets.

Second, hackers start out by trying to get into their own records, and then they move into more sophisticated infrastructures, says Larry Ponemon, adjunct professor of ethics and privacy at Carnegie Mellon University and founder of the Ponemon Institute, a think tank whose mission is to advance privacy management practices in business and government. High school and college students tend to hack institutions with which they already have a relationship.

And third, colleges and universities have done a poor job vetting business partners who handle data in their work, Ponemon says. Colleges in general need to do a better job vetting the technology controls—for example, at a student loan services company or other partner—before entering into a business relationship, Ponemon adds.