# A Systematic Review of Cybersecurity Risks in Higher Education
## 2 Background and Previous Work
### Previous Work on Information Security in HE  
Our literature review identified several research papers within infosec at HE, but not relevant for our Comprehensive Literature Review (CLR). This section provides the reader with examples of such papers. In 2003, [PERSON] and [PERSON] [7] studied security in online learning and discuss the trade-off between security and availability. The authors were maybe the first to have an in-depth discussion on the security culture of (North American) academia and tensions with the traditional security departments. An inspiration for our paper was conducted by [PERSON] and [PERSON] in 2016 [19] who mapped cybersecurity threat agents, events, and risks for generic industry.  
We did not discover any previous literature reviews of cybersecurity risks in HE. The closest we found was a literature review of infosec management present in HE by [PERSON] [1], which presented literature regarding risk management frameworks and standards, infosec policies, sociotechnical holistic approaches, technical solutions, cyberbehaviors, culture and awareness, and governance. Another review paper authored by [PERSON] and [PERSON] [20] surveys security risks and protection mechanisms posed to online learning. The findings primarily consist of technical attacks and mitigating controls.  
[PERSON] [21; 22] discusses the legal implications of data breach in HE when storing student data and cybersecurity regulation under state and federal law. [PERSON] et al. [23] specifically considers the risks among online social networking in HE in Malaysia, focusing on cybersecurity risk towards lecturers. A similar study focuses on cybersecurity risks facing academic libraries [24].  
There has also been conducted multiple phishing and social engineering studies of students and faculty in HE, for example, [PERSON] et al. [25] and [PERSON] et al. [26], both documenting a high level of susceptibility to phishing attacks in academia. Related to phishing-attacks, [PERSON] [27] reviews cyber-attacks in scholarly publishing, such as the fraudulent call for papers, and reviews attackers strategies employed to fool scholars. Additionally, [PERSON] [28] researched the issues and costs of spam emails in academia. [PERSON] et al. conducted a root cause analysis of physical security issues in a University College [29]. [PERSON] [30] provides a case study of a data leak incident occurring on a Japanese University. The author offers an insight into how the incident occurred and the possible countermeasures to implement. [PERSON] et al. [31; 32] investigates the correlation between IT Centralization, outsourcing and cybersecurity breaches in U.S.  
The authors find that both centralized IT and outsourcing are associated with fewer security breaches.  
[PERSON] [33] outlines and discuss key infosec challenges within HE. He proposes a framework for managing them for ensuring sustainability, growth, and development. Similarly, in their book, [PERSON] and [PERSON] [34] outlines key challenges and solutions for computer and network security in HE. In his 2010 book chapter, [PERSON] [35] also provides an extensive theoretical analysis of the infosec threats, data assets, and the risks in HE with challenges and solutions. While [PERSON] cites some incident statistics for HE, the cited online source is no longer available and verifiable, and not included in the review.