Protecting university research and data from insider and foreign-interference risk

In today’s interconnected world, universities are hubs of innovation and knowledge creation, which makes them attractive targets for anyone seeking research, intellectual property or personal data. Much of that risk sits inside the institution: thousands of staff, researchers, students, visitors and contractors with legitimate access to systems and data, changing roles every semester. Most incidents are accidental, such as a file shared too widely or a dataset copied to the wrong place. A small number are deliberate, and some involve foreign interference. This article looks at four areas of insider risk facing the university sector (unauthorised access to research, foreign interference and espionage, unauthorised data access, and cyberattacks) and at how universities can protect themselves with controls based on behaviour and access that apply equally to everyone.

The Australian Government and the university sector have published Guidelines to Counter Foreign Interference in the Australian University Sector, developed through the University Foreign Interference Taskforce, first released in 2019 and refreshed in 2021. They cover governance and risk frameworks; communication, education and knowledge sharing; due diligence, risk assessments and management; and cybersecurity. Their principles include that security must safeguard academic freedom, that security is a collective responsibility, and that it should be proportionate to the institution’s risk. They are a good starting point for any university reviewing its approach.

Unauthorised Access to Research

Unauthorised access to research materials is a paramount concern within the university sector. Universities are centres of cutting-edge research, innovation and the development of intellectual property, making them magnets for people seeking access to valuable information. Anyone with an account, whether a researcher, student, administrator or contractor, can inadvertently or intentionally compromise the institution’s research.

1. Inadvertent Access: Many instances of unauthorised access are unintentional. People eager to get their work done may overstep boundaries by opening restricted material without understanding the rules, or find they can reach a sensitive dataset simply because a folder was shared too broadly. This underscores the importance of clear orientation for everyone who joins a research project about research ethics and data access policies.
2. Deliberate Misuse: In rarer cases, someone with access may deliberately take sensitive research data, trade secrets or confidential information, whether for personal gain, at the request of an outside party, or under pressure. The signs are in behaviour, not in who someone is: unusual requests for research data, access outside a person’s project, or bulk copying of files.
3. Access Controls: Effective data governance is crucial. Universities should implement robust access controls, such as role-based permissions and multi-factor authentication, and review regularly who can reach sensitive research, removing access when projects end or people leave.
4. Data Classification: Universities should classify research materials by sensitivity. By clearly labelling data as restricted, confidential, internal or public, people can better understand what they may access and share, and access policies can be enforced against those labels.
5. Education and Awareness: Foster a culture of ethical research and data integrity. Regular workshops on research ethics, data security and the consequences of unauthorised access raise awareness across the whole academic community.
6. Incident Response: Despite preventive measures, incidents may still occur. A well-defined incident response plan should cover investigating and containing unauthorised access, preserving evidence, and taking appropriate disciplinary or legal action when necessary.

Foreign Interference and Espionage

Espionage involves collecting sensitive information, trade secrets, research data or classified knowledge to benefit a foreign government, organisation or entity. Foreign interference more broadly covers covert, deceptive or coercive activity intended to influence a university’s research, decisions or people. Universities, with the wealth of valuable data they hold, are attractive targets. Anyone with access can be approached, and the response must focus on activities and relationships, never on a person’s nationality or background.

Why People Become Involved

People who take part in espionage or interference may do so for several reasons:

1. Financial Gain: Money or other rewards offered in exchange for sensitive information.
2. Ideological Motives: Personal beliefs or loyalties to a cause.
3. Recognition or Career Advancement: Taking valuable findings to gain standing elsewhere.
4. Coercion: Threats to a person’s safety or that of their family. People in this position are victims as well as risks, and need a safe way to ask for help.

Warning Signs

Identifying this activity can be challenging, but some common indicators, which can apply to anyone, include:

1. Unusual Data Access Patterns: Frequent and unexplained access to sensitive research outside a person’s role or project.
2. Undisclosed Affiliations: Outside appointments, funding or collaborations that haven’t been declared under the university’s conflict-of-interest policies.
3. Attempts to Recruit Others: Approaches to colleagues to share restricted material.
4. Data Leaving the Institution: Sensitive files moving to personal accounts, personal storage or unapproved services.

Countermeasures

Universities should take proportionate, transparent steps that apply to everyone:

1. Due Diligence on Partnerships: Assess the risks of international collaborations, funding and agreements, as the Guidelines recommend.
2. Disclosure Requirements: Ask staff and researchers to declare outside interests, appointments and funding, and make this routine rather than accusatory.
3. Need-to-Know Access: For sensitive or defence-related research, limit access to the people on the project, and apply any required security vetting to the role, not to particular groups.
4. Visibility into Data Movement: Understand how sensitive research data moves, so that unusual activity, such as bulk downloads or files sent to personal accounts, can be reviewed promptly and fairly.
5. Reporting Mechanisms: Establish confidential reporting channels so that anyone, including someone being pressured, can raise concerns without fear of retaliation.
6. Collaboration with Authorities: Where espionage or interference is suspected, work with the relevant law enforcement and security agencies.

Supporting Your Community

A supportive culture is one of the strongest defences. This includes:

1. Inclusion: Help everyone integrate into the academic community, reducing the isolation that can make people vulnerable to approaches.
2. Mental Health and Wellbeing: Offer resources and support, as personal difficulties can be exploited.
3. Ethical Education: Promote ethical research and academic practice, fostering a shared sense of responsibility and integrity.

Unauthorised Data Access

Universities hold a vast amount of sensitive data, including student and staff records, financial information, research findings and intellectual property. Unauthorised access, whether intentional or inadvertent, can lead to data breaches, privacy violations and academic misconduct.

Types of Unauthorised Data Access

1. Record Tampering: Attempts to change grades or academic records.
2. Financial Data Breaches: Access to financial records can lead to identity theft, fraud, or misuse of scholarship and financial aid information.
3. Research Data Breaches: Research data misused or shared with external parties, compromising the institution’s intellectual property.
4. Privacy Violations: Unauthorised access to personal information, leading to privacy breaches and identity theft.

Access Control Measures

1. Role-Based Access: Assign permissions based on roles and responsibilities, so people can only reach data relevant to their academic or administrative work.
2. Authentication: Use multi-factor authentication (MFA) for anyone accessing sensitive data.
3. Data Classification: Categorise data by sensitivity, making it easier to enforce access controls.
4. Permission Reviews: Find sensitive data that is overshared, for example files open to the whole university or to external guests, and tidy it up.

Detection and Auditing

1. Timely Alerts: Flag unusual data access or movement, such as large downloads or sensitive files leaving the institution, for prompt review by people who understand the context.
2. Regular Audits: Review user accounts, permissions and access logs to identify anomalies.
3. Investigation: In the event of a breach, access logs provide critical insight into its extent and cause.

Education and Awareness

1. Orientation: Include data access policies and responsible use of university resources in orientation for all new staff, researchers and students.
2. Ethical Education: Emphasise data integrity and responsible data handling.

Incident Response

1. Response Team: Establish a team for data breaches, including IT, legal and communications specialists.
2. Communication Protocol: Define how affected people are notified, in line with legal requirements such as the Notifiable Data Breaches scheme.

Legal Consequences

Make sure everyone understands the consequences of unauthorised data access, which can include academic penalties, dismissal or expulsion, and legal action.

Cyberattacks

Cyberattacks represent a growing and complex threat within the university sector, and anyone in the university community can be targeted or become an unwitting part of an attack. Universities hold a wealth of sensitive data, from research findings to student records, making them attractive targets for cybercriminals.

Types of Cyberattacks

1. Phishing: Deceptive emails that trick students or staff into revealing login credentials or financial details.
2. Ransomware: Malicious software that encrypts data and holds it hostage. A single infected file or malicious link can be enough.
3. Botnets: Compromised devices recruited into networks used for malicious purposes, including distributed denial of service (DDoS) attacks.
4. Compromised Accounts: A stolen login lets an outsider act as an insider, which is why unusual activity on a legitimate account matters.

Detecting Attacks

1. Email Security: Filter and analyse email for phishing attempts and malicious attachments or links.
2. Network Analysis: Look for unusual traffic patterns that may indicate an attack or unauthorised access.
3. Endpoint Protection: Keep university-managed devices protected against malware.

Behavioural Anomalies

1. Unusual Activity: Unexpected data transfers or sign-ins on an account can indicate it has been compromised.
2. Sign-in Patterns: Watch for brute-force attempts, impossible travel and shared credentials.

Incident Response

1. Timely Detection: Early detection is crucial for minimising damage, so alerts need to reach someone who can act quickly.
2. Investigation: Logs help establish an attack’s origin and scope.

Education and Prevention

1. Cybersecurity Training: Teach the whole university community to recognise and report phishing and to keep devices and software up to date.
2. Patching: Regularly update and patch systems to protect against known vulnerabilities.

Collaboration with Cybersecurity Experts

1. External Expertise: Universities can work with external cybersecurity specialists to assess and improve their security posture and incident response.

Legal and Regulatory Compliance

1. Data Protection Laws: Comply with the privacy and data protection laws that apply, such as the Privacy Act 1988 in Australia or the GDPR for European data.

The Role of Visibility into Sensitive Data

Understanding how sensitive data moves is a critical part of protecting a university against insider risk. Done well, it focuses on data and behaviour, applies equally to everyone, and respects privacy and academic freedom.

Spotting Unusual Activity

• Data Movement: Sensitive research or personal data being downloaded in bulk, shared externally or sent to personal accounts can signal a problem, most often an honest mistake.
  • Access Patterns: Access that departs from a person’s normal role or project is worth a closer look by someone who understands the context.

Knowing Your Data

• Where Sensitive Data Lives: Many universities don’t know where all their sensitive research and personal data is stored, or who can reach it. Discovering and classifying it is the foundation for everything else.
  • Early Intervention: Fixing overshared files and outdated permissions removes risk before anyone misuses it.

Incident Response

• Evidence: If an incident occurs, records of who accessed what and when are critical for determining its scope and responding appropriately.

Privacy and Ethical Considerations

• Proportionality: Focus on how sensitive data moves, not on people’s private communications or personal lives.
  • Transparency: Tell staff and students what is reviewed and why. Transparency builds trust and encourages responsible behaviour.
  • Fairness: Apply the same controls to everyone. Never treat people as a risk because of their nationality, ethnicity, visa or student status.

Education and Awareness

• Security Awareness Programs: Help everyone understand insider risk and their part in protecting the university’s research and data.

Legal and Regulatory Compliance

• Compliance Requirements: Knowing where sensitive data is and how it moves helps universities meet their obligations under privacy and data protection law.

In Summary

Universities thrive on openness, international collaboration and a diverse community of staff and students. Protecting that openness means protecting the research and data it produces. By following the Guidelines to Counter Foreign Interference, governing who can reach sensitive data, understanding how that data moves, and fostering a culture of security awareness that treats everyone fairly, universities can strike a balance between openness and security, safeguarding their research, data and reputation while ensuring a safe and inclusive environment for all.

Christopher McNaughton

CEO & Co-Founder, ShadowSight

Who is Christopher McNaughton

Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.

Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.