# A Systematic Review of Cybersecurity Risks in Higher Education
## 9 Analysis and Discussion of Cyber Risks and Countermeasures in HE
### Risk Analysis  
We have synthesized the data presented in Table 11 for further analysis. However, we left out the data from [PERSON] because he did not provide the distribution numbers. Besides, we assume that the events recorded in Ncube and Garrison [2] and Grama [60] are subsets of the 604 events analyzed in Mello [53]. Furthermore, the distribution was also missing for the threat events ranked 4-8 in UNIT [6], the remaining 10% in UNIT was categorized as _Other_. Since the threat event categorization is distinct for all the included sources [6; 9; 53; 61; 62; 63; 64; 65; 66], we grouped together similar threat events together with a description. The compiled dataset consists of 2984 threat events, Table 15. Although not included in the Table, the results from [PERSON] [8] shows the most frequent events as malware infections, copyright violations, compromise, and DoS-attacks (Table 11), which means that \"Intrusion, malware, and compromise\" is likely the most frequent threat event in HE. Furthermore, according to the Chapman-data, both the \"Abuse and misuse\" and the \"DoS/DDoS\" categories likely occurs with higher frequency in an HEI than depicted in the Table 15.  
An event cause comprises of a threat agent exploiting a vulnerability, and an incident can occur in several ways. Taking the most frequent threat event, \"Intrusions, malware, and compromise\" (29%), as an example--We start by identifying motivated threat agents (Table 13) and vulnerabilities (Table 14) together with the attack vectors for exploitation. _Missing best-practice security controls_, poor _Password security_, and _Technical and network complexity_ all present ways to compromise a network through different attack vectors. _Cybercrime_ is the most frequent threat facing HE, and once inside the network, the threat agent will act on their financial motives, for example, by stealing easily marketable information, such as PII, research data, and credential harvesting (Table 5). Another option for the \begin{table}
\begin{tabular}{l l l} \hline \hline
**Classification** & **Description** & **Citations** \\ \hline Administrative & Insufficient Security Awareness and knowledge & [4; 6; 7; 8; 9; 10; 43; 6; 50; 52; 61; 62; 63; 64] \\  & Insufficient information security management & [4; 6; 8; 9; 52; 58] \\  & Insufficient risk management and communication & [4; 6; 52; 4; 6; 5] \\  & Missing management support, resources, and finance & [5; 42; 47; 56; 57] \\  & Openness, Attitude and culture & [5; 10; 45; 55] \\  & Password Security & [4; 9; 10; 45; 50; 58; 61; 62; 63; 64] \\ \hline Technical & Bring your own device (BYOD) & [5; 50] \\  & Data acquisition, storage, processing, and transfer & [4; 6; 58] \\  & Missing best practice security controls & [4; 6; 5; 6; 64; 6; 6; 65; 66; 67; 68; 69; 70; 71; 72; 73; 74; 75; 76; 77; 78; 79; 80; 72; 79; 90; 73; 75; 77; 78; 79; 91; 74; 76; 77; 79; 92; 78; 79; 93; 94; 95; 96; 97; 98; 99; 100; 101; 102; 103; 104; 105; 106; 107; 108; 109; 107; 109; 111; 112; 113; 114; 115; 116; 117; 118; 119; 120; 121; 122; 123; 124; 125; 126; 127; 128; 129; 130; 131; 132; 133; 134; 135; 136; 137; 138; 139; 140; 141; 142; 143; 144; 145; 146; 147; 148; 149; 150; 151; 152; 153; 154; 155; 156; 157; 158; 159; 160; 161; 162; 163; 164] \\ \hline Physical & Physical security in HE & [5; 58] \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Summary over vulnerability classifications, descriptions, and citations. criminal is to encrypt data with ransomware. The former leads to data leakage and the latter to data and availability loss, as illustrated in Figure 3.  
Table 16 proposes a generic connection between threat events, vulnerabilities, threat agents, assets, and consequences for all the threat events. The second most frequent event is \"Vulnerable assets and scanning\" with 28.6% of incidents. This threat event is directly connected to technical vulnerabilities, such as missing best practice controls and complexity.