Security Market Segment LS
Tuesday, 02 August 2022 11:16

Top universities put students, staff, stakeholders at risk of impersonation by cybercriminals: Proofpoint Featured

By Staff Writer
Steve Moros, Proofpoint Senior Director, Advanced Technology Group, Asia Pacific and Japan Steve Moros, Proofpoint Senior Director, Advanced Technology Group, Asia Pacific and Japan

The top universities in Australia, the United States and the United Kingdom are lagging on basic cybersecurity measures, subjecting students, staff and stakeholders to higher risks of email-based impersonation attacks, according to new research by security firm Proofpoint.

Proofpoint’s research found that 97% of the top ten universities across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud.

Proofpoint says that according to the analysis, universities in the United States are most at risk with the poorest levels of protection, followed by the United Kingdom, then Australia.

The full findings of Proofpoint's DMARC analysis show:

  • Only one institution (in Australia) out of 30 universities implemented a Reject policy to block unqualified emails.
  • 17 (57%) of the surveyed universities implemented a Monitor policy, while only four (13%) of the 30 universities implemented a Quarantine policy.
  • Eight out of the 30 universities (27%) do not publish any level of DMARC record, five of these being in the United States.
  • In Australia one university had no DMARC record; two universities implemented Quarantine measures; six Monitor while only one university implements a Reject policy.
  • While 80% of the UK’s top universities implemented some level of DMARC protection, no UK university implemented DMARC’s highest level of protection, Reject policy, with the same findings uncovered for the US.

Proofpoint says the research findings are based on Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of the top ten universities in each country. DMARC is an email validation protocol designed to protect domain names from being misused by cybercriminals.

DMARC authenticates the sender's identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine and reject, with reject being the most secure for preventing suspicious emails from reaching the inbox.

Steve Moros, Senior Director, Advanced Technology Group, Asia Pacific and Japan at Proofpoint said, “Higher education institutions hold masses of sensitive personal and financial data, perhaps more so than any industry outside healthcare. This, unfortunately, makes these institutions a highly attractive target for cyber criminals. The pandemic and rapid shift to remote learning has further heightened the cybersecurity challenges for tertiary education institutions and opened them up to significant risks from malicious email-based cyber attacks, such as phishing.

“Notably, Proofpoint’s recent Voice of the CISO  report found Chief Information Security Officers (CISOs) in the education sector felt the least backed by their organisation. In line with these findings, the World Economic Forum reports that 95% of cybersecurity issues are traced to human error, highlighting that many CISOs still significantly underestimate the risk posed by users. With this, only 47% of education sector CISOs believe users to be their most significant risk.

“Email remains the most common vector for security compromises across all industries. In recent years, the frequency, sophistication, and cost of cyber attacks against universities has increased. It’s the combination of these factors that make it especially concerning that only one of Australia’s top ten universities is fully DMARC compliant.”

Proofpoint warns that with the shift to remote learning and now hybrid learning, these figures will continue to climb - noting that the lack of protection against email fraud is commonplace across the tertiary education sector, exposing countless parties to impostor emails, also referred to as business email compromise (BEC).

Proofpoint explains that BECs are a form of social engineering designed to trick victims into thinking they have received a legitimate email from an organisation or institution - and cyber criminals use this technique to extract personal information from students and staff by using luring techniques and disguising emails as messages from the university IT department, administration, a campus group, often directing users to fake landing pages to harvest credentials.

“Email authentication protocols like DMARC are the best way to shore up email fraud defences and protect students, staff, and alumni from malicious attacks. As holders of vast amounts of sensitive and critical data, we advise universities across Australia to ensure that they have the strictest level of DMARC protocol in place to protect those within their networks,” Moros said,

“People are the last line of defence against email fraud but remain one of the biggest vulnerabilities for organisations. DMARC remains the only technology capable of not only defending against but eliminating domain spoofing or the risk of being impersonated. When fully compliant with DMARC, a malicious email can't reach your inbox, removing the risk of human interference,” concluded Moros.

The analysis by Proofpoint was conducted in May 2022 using data from  QS Top Universities


Read 933 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


Hybrid cloud promises to bring together the best of both worlds enabling businesses to combine the scalability and cost-effectiveness of the cloud with the performance and control that you can get from your on-premise infrastructure.

Reducing WAN latency is one of the biggest issues with hybrid cloud performance. Taking advantage of compression and data deduplication can reduce your network latency.

Research firm, Markets and Markets, predicted that the hybrid cloud market size is expected to grow from US$38.27 billion in 2017 to US$97.64 billion by 2023.

Colocation facilities provide many of the benefits of having your servers in the cloud while still maintaining physical control of your systems.

Cloud adjacency provided by colocation facilities can enable you to leverage their low latency high bandwidth connections to the cloud as well as providing a solid connection back to your on-premises corporate network.

Download this white paper to find out what you need to know about enabling the hybrid cloud in your organisation.



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News