# A Systematic Review of Cybersecurity Risks in Higher Education
## 8 Vulnerabilities in HE
### Administrative and Cultural Vulnerabilities in HE
#### 8.1.1 Information Security Awareness and Knowledge  
The constant influx of students each year makes it challenging to uphold infosec awareness in higher education. Security awareness in HE was a well-covered area of literature. 33% of all cyber breaches in 2018 utilized social engineering attacks according to Verizon Verizon Verizon (2018), closely followed by \"Miscellaneous errors\". [PERSON] and [PERSON] [PERSON] and [PERSON] (2018) also document a lack of infosec knowledge and awareness within the educational environment in the Middle East. The study conducted at TEI in Athens had similar findings [PERSON] and [PERSON] (2018): The root cause of low infosec awareness in higher education correlated to lack of motivation to follow security procedures. A lack of general knowledge about attacks, users' risky belief, users' risky behavior, and inadequate use of technology, all correlated with a lack of awareness in higher education.  
For the Turkish universities, the authors concluded that _\"the human factor directly affects every stage\"_ of infosec work at HEI [PERSON] and [PERSON] (2018). Furthermore, the findings underpinned infosec awareness as needing to be present within the top-level management, and for adapting the ISO/IEC 27001 framework. To support these findings, the study from UAE concluded that the low levels of security awareness have a direct relationship with how the faculty views and values the University's information system assets [PERSON] and [PERSON] (2018). Finally, the study by [PERSON] et al. concludes that one of two primary vulnerabilities is inadequate infosec security awareness for the organization personnel Verizon (2018). Besides, this issue leads to a misalignment between the information system goals and the institution's strategic mission and objectives.  
Furthermore, [PERSON] et al. [PERSON] et al. (2018) found that 60% of the respondents participating in the survey did not know how to report a security incident at the Norwegian University.  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Threat** & **Motivation** & **Intention** & **Threat events** & **Citations** \\ \hline \multirow{2}{*}{Cyber-crime} & \multirow{2}{*}{Financial} & Unauthorized access, Deny Access & Malware, Hacking, Social & \\  & & Infrastructure hijack & engineering, Abuse, Botnets, & [2, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48,  
Additionally, the study documented a low awareness of infosec issues. Supporting this finding, the root cause analysis conducted at the same University identified low awareness as one of the primary root causes of account compromise [45]. Additionally, low information availability and insufficient security training were both highlighted as key contributors to the problem.  
One of the key findings from the UNIT report was the lack of infosec awareness and knowledge [6]. A lack of practical competencies relating to infosec was a reoccurring topic in the report with frequent violations of infosec policies. While [PERSON] and [PERSON] [50] provide a well-known argument that cyber-security managers focus more on technical solutions rather than focusing on the absence of cyber-security awareness among end-users. Furthermore, the authors make the point that cyber-security awareness at HEI in developing countries are more absent than in developed countries.  
Vulnerability to social engineering attacks is tightly coupled with security awareness and knowledge, and social engineering attacks represent one of the most frequent attack vectors towards HE [8; 9; 10]. [PERSON] et al. [58] found that the University averaged one security incident per day caused by social engineering. 48% of the survey participants had experienced tailored attacks, and 22% knew about cases where they or their co-workers had fallen victim to such attacks.