# A Systematic Review of Cybersecurity Risks in Higher Education
## 6 Cyber Threat Events in HE
### University SOC Statistics  
We found one peer reviewed data source describing statistics collected directly from the University SOC [9]; a technical report from the UK sector SOC [8] and the Norwegian [6] HE sector CERTs. The data set provided by Wangen [9] contains an analysis of 550 infosec incidents from a Norwegian University SOC in 2016-2017. The incident analysis contains a correlation of incident causes and outcomes. As seen in Figure 2, there are 12 major cause classifications, but the majority of incidents are caused by \"Social engineering\" attacks, \begin{table}
\begin{tabular}{l l} \hline \hline
**Academic Processes** & **KPI** \\ \hline Research performance indicators & Number of research publications \\  & Number of research projects \\  & Number of patents \\  & Number of monographs \\  & Number of spin-offs from main research stream \\  & Number of patents addressing local needs \\  & \% of faculty winning academic grants \\  & Number of technology projects \\  & Number of research projects addressing local needs \\  & \% of faculty attending conferences and seminars \\  & Research impact \\ \hline Teaching performance indicators & Students and other stakeholder satisfaction \\  & Employer satisfaction with graduates skills \\  & Number of students completing the program \\  & Student progression rate \\  & Dropout rate (Number of dropouts/No. of students enrolled) \\  & Median score of students \\  & \% of students with a particular GPA \\  & Course rating – median evaluation of the course by students \\  & Graduates employment rate \\ \hline Service performance indicators & Number of academic programs designed \\ (university, profession, and & Participation in curriculum development \\ community) & Participation in academic committees \\  & Students counseling \\  & Community service \\ \hline Financial performance & _Revenues_ \\  & Income generated from research projects \\  & Income generated from consultancies \\  & Income generated from spin-offs/patents \\  & Sponsorship’s/endowments \\  & Income generated from tuition \\  & _Expenses_ \\  & Total teaching and research cost \\  & \% of budget allocated to the research \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Key performance indicators (KPI) in higher education (HE) from [PERSON] and [PERSON] [41] (p. 993). \"Compromised Asset\", and \"Compromised Users\". Furthermore, \"Vulnerable assets\" and \"Policy violations\" also represent more than 50 each of the 550 incidents. In the analysis the author finds that 99 of the social engineering attacks against the University have negligible consequences. [PERSON] [8] writes that the UK Jisc SOC handled approximately 6100 incidents or queries in 2018. The incident classification is available on a timeline in the Policy Note, and although the authors do not apply the same incident classification, the statistics are comparable to those in Figure 2. Considering the incidents from Jisc SOC, it seems that there was a wave of \"Compromise\" in January and February 2018 as the primary cause of incidents, but this becomes a minor contributor to incidents for the remaining year. \"Malware\" and \"Copyright\" are two significant contributors all throughout the year. Furthermore, [PERSON] comments on the statistics that students and other users are continuously committing Denial of Service (DoS) attacks towards each other on the network. Furthermore, the UNIT technical report [6] contains statistics from the Norwegian University Network (UNINETT) CERT, which has a similar role to the Jisc SOC in the UK. The statistics contain 965 incidents, where 682 is caused by \"Vulnerable assets\", followed by the categories \"Compromised asset\" and \"Scanning\" both of which have caused 95 incidents. While not written explicitly, the statistics also show DoS attacks as a consistent cause of incidents. Neither Jisc SOC or UNINETT CERT provides the numbers for their statistics. The three SOC statistics included in our paper were all collected between 2016-2018 but are quite different using various classifications.