# A Systematic Review of Cybersecurity Risks in Higher Education
## 9 Analysis and Discussion of Cyber Risks and Countermeasures in HE
### Risk Analysis
However, technical vulnerabilities often occur due to missing maintenance and patching, and as such, can be connected to the vulnerabilities highlighted in the administrative domain, such as insufficient infosec management combined with missing resources and financing for security work. While a poorly secured system can be exploited in many ways, the results document that HEI assets are frequently exploited in different kinds of _Abuse and Misuse_. \"Social engineering and targeted attacks\" are attacks designed to exploit weaknesses in security awareness and knowledge. However, these attacks are common to most sectors and industries [61; 62; 63; 64]. What stands out in HE, is that social engineering attacks are eased by the openness and information sharing in HEI [55]. Cyber-criminals typically conduct Social engineering attacks for financial gain. Phishing-attacks is a large contributor to account hijacks in HEI [9; 45]. We associate \"Unintended disclosure and errors\" with vulnerabilities such as insufficient security awareness, insufficient security management, and the security culture. Furthermore, inappropriate systems for data handling can also contribute to the problem on a technical level. \"Device or document loss or theft\" is  
Figure 3: Risk analysis combining threat agents, vulnerabilities, events, assets, and consequences, for the “Intrusions, malware, and compromise”-events. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Threat Event/Incident** & **Description** & **Freq.** & **\%** \\ \hline Intrusion, malware, and compromise & Electronic entry by an outside party; data loss via malware, spyware, and hacking. & 864 & 29.0 \\  & Also includes compromised asset. & 852 & 28.6 \\ \hline Vulnerable assets and scanning & \begin{tabular}{l} \\ \end{tabular} & \begin{tabular}{l} Frauds primarily attempted through phishing scans, targeted attacks, and intrusion attempts \\ \end{tabular} & 324 & 10.9 \\ \hline Unintended disclosure and error & \begin{tabular}{l} Sensitive information posted publicly on a website, mishandled, \\ or sent to the wrong party via e-mail, fax, or mail. \\ \end{tabular} & 311 & 10.4 \\ \hline Device or document loss or theft & \begin{tabular}{l} Lost, discarded, or stolen devices (e.g., laptop, PDA, PC, smartphone, portable \\ memory device, CD, hard drive) or stolen non-electronic records such as paper documents. \\ \end{tabular} & 187 & 6.2 \\ \hline Unknown or other & \begin{tabular}{l} Breaches that do not fit into the other categories or where a root cause has not been determined. \\ \end{tabular} & 165 & 5.5 \\ \hline Account hijack/Comromised user & \begin{tabular}{l} A compromised user is when the username and password of an account get compromised. \\ \end{tabular} & 142 & 4.8 \\ \hline Abuse and misuse & \
\begin{tabular}{l} Law or policy violations through abuse and misuse of Infrastructure \\ for copyright infringement, illegal hosting, cryptomining, etc. \\ \end{tabular} & 117 & 3.9 \\ \hline Insider attacks &
\begin{tabular}{l} Intentional breach of information by someone with legitimate access. \\ \end{tabular} & 17 & 0.6 \\ \hline DoS/DDoS & Denial of service (DoS) occurs when a service or asset becomes unavailable. & 6 & 0.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Categorized and merged threat events from the findings in [6; 9; 53; 61; 62; 63; 64;  
typically associated with physical security violations or poor security routines, where equipment is left unattended or unsecured. [PERSON] et al. [45] researched the root causes of 72 compromised users at a Norwegian university, and found that users re-using their university password caused 42% of the reviewed incidents. Other common causes were weak passwords (25%), malware infections (19%), and successful phishing attacks (10%); these causes are typically associated with security awareness and password security routines. \"Abuse and misuse\" make out 3.9% of the incidents, and happens when employees and students exploit University resources for personal gain or amusement.