# A Systematic Review of Cybersecurity Risks in Higher Education
## 2 Background and Previous Work
### Terms and Definitions  
This paper assumes that the reader is familiar with common infosec terminology, furthermore, the terms _infosec_ and _cybersecurity_ are used interchangeably in this paper. Infosec is the preservation of the confidentiality, integrity, and availability of information [13]. This also includes the technology that houses and transfers that information through various protection mechanisms such as policy, training and awareness programs and technology [14] (p. 5). However, infosec is not exclusively limited to these three characteristics; there are also critical characteristics such as processes, including privacy, identification, authentication, authorization, and accountability to consider. When we refer to _risk management_ in this paper, we refer to the full process of managing risks, being more specific, continuously identifying, reviewing, treating and monitoring risks to achieve risk acceptance [11; 12]. A common approach to infosec risk is to divide it into assets, threats, and vulnerability [11; 12], commonly referred to as _the three-factor model_ in risk analysis. There are several ways to conduct an infosec risk assessment (ISRA). Still, the majority share the similarity of first, identifying valuable assets in an organization, before identifying threats that might potentially cause harm to these assets [12]. The final step before risk analysis is identifying and evaluating vulnerabilities present in the organization. Risk is then an event caused by the threat exploiting a vulnerability to harm an asset. This event has an associated consequence and likelihood [11; 12].  
Primary _assets_ are either information or business processes considered valuable by an organization [11], including buildings, equipment, personnel, organization reputation, business documents and other tangible and intangible assets. An asset can be logical, such as a Web site, software information, or data; or an asset can be physical, such as a person, computer system, hardware, or other tangible objects. Information assets, on the other hand, is _\"an asset that collects, stores, processes, or transmits information, or any collection, set, or database of information that is of value to the organization.\"_[14] (p. 320) Related to assets in this paper are Key Performance Indicators (KPI) which is defined as _\"a measurable value which explains the effectiveness of an institution and how it is achieving key objectives\"_[15]. KPIs can be used to track progress on specific business objectives and can aid and evaluate if an organizations business strategy is sufficient. A _threat_ is a _\"potential cause of an unwanted incident, which may result in harm to a system or organization\"_[11]. The terms _threat source_ and _threat_ are commonly used interchangeably, even though the two terms are technically distinct [14]: _threat_ might also describe treat source. While a threat agent is _\"The specific instance or a component of a threat\"_. This paper distinguishes between the threat agent and event.  
A vulnerability is a _\"weakness of an asset or control that can be exploited by one or more threats\"_[11]. Vulnerabilities are instrumental in determining current and residual risk after control measure implementation.  
The results presented in this paper builds on [PERSON]'s master's thesis submitted in 2020 [16], which evaluated risks facing HEI and the Norwegian University of Science and Technology.