IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Every leading UK university is compromising on email security, researchers say

Proofpoint said none of the top ten universities in the UK have implemented the recommended email security policies, leaving institutions open to cyber attacks

Leading universities in the UK, US, and Australia have been criticised over ‘less than adequate’ cyber security practices by experts. 

Researchers at security company Proofpoint said every one of the top ten universities in the UK is failing to take “appropriate measures” to secure against email-based cyber attacks.

Looking at the top ten universities in the UK, US, and Australia together, the company concluded that 97% were failing to implement adequate security controls, leaving staff and students vulnerable to attacks.

The research focused on the universities’ implementation of the domain-based message authentication, reporting, and conformance (DMARC) protocol used to prevent domain spoofing.

DMARC offers three degrees of protection depending on the implementation and Proofpoint said none of the UK’s top universities have implemented the most secure method, the one that’s recommended.

The researchers said this opens up university staff and students to become victims of email fraud since the establishments don’t actively block fraudulent emails from reaching their targets.

Proofpoint said DMARC can either monitor, quarantine, or reject suspicious emails, with ‘reject’ offering the greatest protection since it prevents emails from appearing in targets’ inboxes.

It said ‘monitor’ allows emails to enter the inbox and ‘quarantine’ sees suspicious emails sent to spam folders. This is a weaker form of security but one that’s common so the suspicious nature is flagged to the user but can be corrected if it was deemed to be a false-positive detection.

The majority of universities (75%) only have the ‘monitoring’ policy in place meaning potentially malicious emails can make their way into inboxes freely.

Other companies suggest there are other ways to implement DMARC. Agari suggests if an email service is set up for quarantine, it means suspicious emails can be flagged to the administrator for further review. They will then determine whether or not to forward the email to the intended recipient.

This, according to Agari, differs from delivering to a spam folder, which can be a different implementation entirely.

Universities are often the targets of cyber attacks and numerous UK-based establishments have become high-profile victims in recent years, such as the University of Sunderland, the University of Northampton and the University of Hertfordshire.

Students are often seen as easy targets to a university’s systems given their relative inexperience in navigating large computer environments and cyber security practices, in addition to using personal devices on the network.

Related Resource

Storage's role in addressing the challenges of ensuring cyber resilience

Understanding the role of data storage in cyber resiliency

Whitepaper cover with title over a grey rectangle with header graphic and ESG logoFree Download

Universities are also high-profile targets for state-sponsored hacking groups given the high-value nature of the work stored at the institution.

Leading universities that are working on cutting-edge research are especially vulnerable to attacks from hostile forces looking to steal information and secrets, potentially related to national security.

“Higher education institutions are highly attractive targets for cyber criminals as they hold masses of sensitive personal and financial data,” said Adenike Cosgrove, cyber security strategist at Proofpoint. “The COVID-19 pandemic caused a rapid shift to remote learning which led to heightened cyber security challenges for education institutions opening them up to significant risks from malicious email-based cyber attacks, such as phishing.” 

“Email remains the most common vector for security compromises across all industries. In recent years, the frequency, sophistication, and cost of cyber attacks against universities have increased. It is the combination of these factors that make it especially concerning that none of UK top ten universities is fully DMARC-compliant.”

As universities prepare to welcome a fresh intake of students for the coming academic year, Proofpoint said the new students’ inexperience with cyber security could provide ample opportunity for cyber criminals to exploit email-based attacks on universities.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Most Popular

The top 12 password-cracking techniques used by hackers

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
cyber crime

Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation

25 Nov 2022