# A Systematic Review of Cybersecurity Risks in Higher Education
## 6 Cyber Threat Events in HE
### Publications on Data Breaches and Threat Events
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Type** & **2005** & **2006** & **2007** & **2008** & **2009** & **TOTAL** \\ \hline
**Stolen** & 9 & 15 & 16 & 21 & 12 & **73** \\ \hline
**Hacker** & 38 & 20 & 16 & 14 & 22 & **110** \\ \hline
**Insider** & 1 & 1 & 0 & 3 & 1 & **6** \\ \hline
**Exposed** & 5 & 13 & 25 & 28 & 12 & **83** \\ \hline
**Missing** & 1 & 5 & 6 & 6 & 0 & **18** \\ \hline
**Total** & **54** & **54** & **63** & **72** & **47** & **290** \\ \hline \end{tabular}
\end{table} 
Table 7: Table from [PERSON] and [PERSON] [2] (p. 33), of the number of incidents per year. Table 9 shows that _\"Hacking\"_ is again the most frequent data breach action, closely followed up by the _\"Social\"_ and _\"Errors\"_ categories. The least frequent action relating to data breaches in the educational industry is _\"Physical\"_ action, which had only one case in 2019, according to [63]. The 2019 edition also proposed a taxonomy of _patterns_ associated with the incidents in HE. The _pattern_ can be viewed as a cause of incident, and the two major causes are _Miscellaneous errors_ on 35% and _Web application attacks_ 24%. The former is defined as _\"Incidents in which unintentional actions directly compromised a security attribute of an asset\"_ (p. 25), and the latter _\"Any incident in which a web application was the vector of attack.\"_ (p. 25). However, _Privileged misuse_, _Cyber-espionage_, _Lost and Stolen assets_, and _Crimeware_ together make up 20% of breaches. A major category, _\"Everything else\"_, caused 20% of incidents, of which a 28% were estimated to have been caused by phishing attacks. Similar patterns were also present at the top of the 2017 and 2018 edition. We have compiled the Hackmageddon 2018-2019 statistics [65; 66] for the \"Education\" category in Table 10, \(n=202\). The histogram is sorted on 11 different threat events with frequencies. The results show _\"Malware/PoS Malware\"_ is the most frequent cyber-attack in the educational industry. Other frequent attacks were _\"Account Hijacking\"_ and _\"Unknown\"_. The least frequent threat events were _\"Brute-Force\"_, _\"Vulnerability\"_, _\"Malicious Script Injection\"_, and _\"SQL injection\"_. However, Hackmageddon.com (Visited 28 January 2021) usually relies on _attack submission_. Classification of attacks can therefore be subjective, and the amount of work regarding follow-ups and fact-checking is unknown. When comparing the \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Incident** & **Description** & **Grama [60]** & **Mello [53]** \\ \hline Payment Card Fraud (CARD) & \begin{tabular}{l} Fraud involving debit and credit cards \\ that is not accomplished via hacking \\ \end{tabular} & 0\% & 0\% \\ \hline Unintended disclosure (DISC) & \begin{tabular}{l} Sensitive information posted publicly on a website, \\ mishandled, or sent to the wrong party via e-mail or other. \\ \end{tabular} & 30\% & 29\% \\ \hline Hacking or malware (HACK) & \begin{tabular}{l} Electronic entry by an outside party; data \\ loss via malware and spyware. \\ \end{tabular} & 36\% & 39\% \\ \hline Insider (INSD) & \begin{tabular}{l} Intentional breach of information by someone \\ with legitimate access (e.g., an employee or contractor) \\ \end{tabular} & 3\% & 3\% \\ \hline Physical loss (PHYS) & \begin{tabular}{l} Lost, discarded, or stolen non electronic records, \\ such as paper documents. \\ \end{tabular} & 5\% & 5\% \\ \hline Portable device (PORT) & \begin{tabular}{l} Lost, discarded, or stolen portable devices (e.g., laptop, \\ PDA, smartphone, portable memory device, CD) \\ \end{tabular} & 17\% & 16\% \\ \hline Stationary device (STAT) & \
\begin{tabular}{l} Lost, discarded, or stolen stationary electronic device \\ such as a computer or server not designed for mobility. \\ \end{tabular} & 7\% & 6\% \\ \hline Unknown or other (UNKN) &
\begin{tabular}{l} Breaches that do not fit into the above categories \\ or where a root cause has not been determined. \\ \end{tabular} & 1\% & 1\% \\ \hline \hline \end{tabular}
\end{table}