# A Systematic Review of Cybersecurity Risks in Higher Education
###### Abstract  
The demands for information security in higher education will continue to increase. Serious data breaches have occurred already and are likely to happen again without proper risk management. This paper applies the _Comprehensive Literature Review (CLR) Model_ to synthesize research within cybersecurity risk by reviewing existing literature of known assets, threat events, threat actors, and vulnerabilities in higher education. The review included published studies from the last twelve years and aims to expand our understanding of cybersecurity's critical risk areas. The primary finding was that empirical research on cybersecurity risks in higher education is scarce, and there are large gaps in the literature. Despite this issue, our analysis found a high level of agreement regarding cybersecurity issues among the reviewed sources. This paper synthesizes an overview of mission-critical assets, everyday threat events, proposes a generic threat model, and summarizes common cybersecurity vulnerabilities. This report concludes nine strategic cyber risks with descriptions of frequencies from the compiled dataset and consequence descriptions. The results will serve as input for security practitioners in higher education, and the research contains multiple paths for future work. It will serve as a starting point for security researchers in the sector. c cybersecurity; higher education; university; review; risk; asset; threat; vulnerability +
Footnote †: journal:  
The best practice defines infosec risk management within the scope of assets, threats, vulnerabilities, and events [11; 12]. However, identifying these within an organization can be challenging as information assets are continuously created, processed, and stored. Secondly, cyberspace's threat environment is continually changing, where new methods and tools make it is hard to identify, evaluate, and map harmful attacks to an organization. Finally, changes in organizational structure can unveil novel unaccounted vulnerabilities. Universities and higher educational (HE) institutions are regularly conducting teaching, development and research which greatly benefits society. Companies in both the private and public sector are also investing vast amounts of resources in research and development at the HE institutions (HEI). All of which is worth protecting, and as the topic grows in importance, a study of the sector's cybersecurity risks is timely. Therefore, the purpose of this article is to review the existing literature, generalize knowledge about cybersecurity risks, and study the security trends in HE. This research addresses the following research questions (RQ) for HE:  
1. What are the key information assets and the associated Key Performance Indicators in HE? 2. Which are the most frequent threat events in HE? 3. Who are the common threat agents? 4. What are the most common vulnerabilities? 5. Which are the most common risks? We address these topics using the systematic literature review method. This study does not venture into risks from violating laws and regulations given that these are region and country specific. Neither does this paper discuss or propose risk control and mitigation mechanisms in depth. The key findings of this paper is an overview of assets, threats, and vulnerabilities in HE. The article also discusses the industry's common risks at an organizational level, with generic risk management strategies. The implications are common risks HEI should mitigate, and a call for more research within these areas. The paper is written for both academics researching cybersecurity and practitioners working actively with security in HEI. The remainder of this paper has the following structure:  
* Section 2 presents the study context and provides the reader with the background knowledge, properties of the HEI, and previous work within the field. * Section 3 describes the _Comprehensive Literature Review Model_ approach of this paper. * Section 4 provides a summary of the included and reviewed literature.