# A Systematic Review of Cybersecurity Risks in Higher Education
## 4 Description of Included Literature
### Included Academic Literature
Security awareness and knowledge is a reoccurring theme: [PERSON] and [PERSON] [43] conducted a study of cybersecurity knowledge and awareness in the Middle East's educational environment. The study involved a questionnaire with 760 participants, including personnel from academic staff, researchers, undergraduate students, and employees within HE environments. [PERSON] et al. [44] conducted a study to investigate the association and cause of lack of awareness and other human factors regarding threats to computer security in HE. The study included 103 employees, namely teachers, administrators and working post-graduate students from the academic society in Athens, Greece. [PERSON] and [PERSON] [46] conducted an interpretive case-study to unveil the infosec awareness in HE in a developing country, mainly in the United Arabic Emirates. [PERSON] and [PERSON] [47] conducted a content analysis and case study to cover the development process of infosec policy in HE in Malaysia. The study uncovered several causes of infosec vulnerabilities in HEI in Malaysia. Of the broader approaches to vulnerability, we found [PERSON] et al. [45], which combined a root cause and socio-technical analysis the determine the causes of compromised passwords at a Norwegian University. The study utilized technical analysis combined with an online questionnaire targeting respondents who had their accounts compromised (\(n=72\)) to determine the probable root causes. [PERSON] and [PERSON] [4] conducted a comparative analysis of the infosec effort at six universities in Turkey, based on infrastructure, operation, application, information, policy and human-based infosec. The authors use the risk term liberally, but the research scope is limited to vulnerability and compliance analysis at these universities. [PERSON] [48] discuss the possible causes of data leaks in HE, focusing specifically on the human aspect vulnerabilities. The authors also propose controls to address said vulnerabilities. [PERSON] [49] surveyed infosec security awareness and attitudes of 85 undergraduate students in a U.S. college. The author found that the majority in the sample had a decent understanding of infosec topics. Our literature search revealed few papers specifically on risk in HE--the paper by [PERSON] [9] proposes a method to categorize, quantify, and risk analyze an infosec incident register. The article includes a case study data analysis of 550 cybersecurity incidents from a Norwegian University's Security Operations Center between November 2016 and October 2017. [PERSON] discusses assets, threats, and vulnerabilities at the University as a part of the risk analysis. Another paper specifically on HE's risks is the paper by [PERSON] and [PERSON] [50], which discusses risks and potential cybersecurity management measures in HE. However, the article is not based on a dataset and is lacking adequate sourcing and citations. [PERSON] and [PERSON] [51] is an inquiry into the information systems security in a Ghanaian University. The authors use a survey to poll 180 respondents regarding typical security issues faced by the University. [PERSON] et al. [52] present a case study of an infosec management system (ISMS) implementation at a Jordanian University. The paper centers on the ISMS process and on the key findings within the predefined risk categories with treatments. The analysis has a high level of technical granularity. It mainly focuses on servers and sites, while the remainder is a description of which best-practice security measures from the ISO/IEC 27001 and 27002 should be implemented. In her thesis, [PERSON] [53] survey data breach records from universities in all of the U.S. states. She investigates the hypotheses whether larger universities are more susceptible to data breaches and if universities with more financial resources are more vulnerable to a data breach. The study includes breach records for U.S.