Proofpoint, Inc., a leading cybersecurity and compliance company, today released new research which found that the top universities in the United States, the United Kingdom and Australia are lagging on basic cybersecurity measures, subjecting students, staff and stakeholders to higher risks of email-based impersonation attacks.

Proofpoint’s research found that 97% of the top ten universities [1] across each country are not taking appropriate measures to proactively block attackers from spoofing their email domains, increasing the risk of email fraud. According to the analysis, universities in the United States are most at risk with the poorest levels of protection, followed by the United Kingdom, then Australia. 

These findings are based on Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of the top ten universities in each country. DMARC [2] is an email validation protocol designed to protect domain names from being misused by cybercriminals. It authenticates the sender's identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine and reject, [3] with reject being the most secure for preventing suspicious emails from reaching the inbox.   

The full findings of Proofpoint's DMARC analysis show:

• None of the top U.S. and U.K. universities had a Reject policy in place, which actively blocks fraudulent emails from reaching their intended targets, meaning all are leaving students open to email fraud.
• Five of the top ten U.S. universities do not publish any level of DMARC record.
• 65% of the top U.S. and U.K. universities had a base level of DMARC protection (Monitor and Quarantine) in place.
• 17 (57%) of all surveyed universities implemented a Monitor policy, while only four (13%) of the 30 universities implemented a Quarantine policy.

Ryan Kalember, EVP, Cybersecurity Strategy at Proofpoint said, “Higher education institutions hold masses of sensitive personal and financial data, perhaps more so than any industry outside healthcare. This, unfortunately, makes these institutions a highly attractive target for cyber criminals. The pandemic and rapid shift to remote learning has further heightened the cybersecurity challenges for tertiary education institutions and opened them up to significant risks from malicious email-based cyber attacks, such as phishing.

“Notably, Proofpoint’s recent Voice of the CISO report found Chief Information Security Officers (CISOs) in the education sector felt the least backed by their organisation. In line with these findings, the World Economic Forum reports that 95% of cybersecurity issues are traced to human error, highlighting that many CISOs still significantly underestimate the risk posed by users. With this, only 47% of education sector CISOs believe users to be their most significant risk.

“Email remains the most common vector for security compromises across all industries. In recent years, the frequency, sophistication, and cost of cyber attacks against universities has increased. It’s the combination of these factors that make it especially concerning that the premier universities in the U.S. are currently the most vulnerable to attack.”

With the shift to remote learning and now hybrid learning, these figures will continue to climb. The lack of protection against email fraud is commonplace across the tertiary education sector, exposing countless parties to impostor emails, also referred to as business email compromise (BEC).

BECs are a form of social engineering designed to trick victims into thinking they have received a legitimate email from an organisation or institution. Cyber criminals use this technique to extract personal information from students and staff by using luring techniques and disguising emails as messages from the university IT department, administration, a campus group, often directing users to fake landing pages to harvest credentials.

“Email authentication protocols like DMARC are the best way to shore up email fraud defenses and protect students, staff, and alumni from malicious attacks. As holders of vast amounts of sensitive and critical data, we advise universities across the U.S. to ensure that they have the strictest level of DMARC protocol in place to protect those within their networks.

“People are a critical line of defense against email fraud but remain one of the biggest vulnerabilities for organizations. DMARC remains the only technology capable of not only defending against but eliminating domain spoofing or the risk of being impersonated. When fully compliant with DMARC, a malicious email can't reach your inbox, removing the risk of human interference,” concluded Kalember.

This analysis was conducted in May 2022 using data from QS Top Universities.

###

About Proofpoint, Inc.

Proofpoint, Inc. is a leading cybersecurity and compliance company that protects organizations’ greatest assets and biggest risks: their people. With an integrated suite of cloud-based solutions, Proofpoint helps companies around the world stop targeted threats, safeguard their data, and make their users more resilient against cyber attacks. Leading organizations of all sizes, including 75 percent of the Fortune 100, rely on Proofpoint for people-centric security and compliance solutions that mitigate their most critical risks across email, the cloud, social media, and the web. More information is available at www.proofpoint.com.

Connect with Proofpoint: Twitter | LinkedIn | Facebook | YouTube

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.

[1] https://www.topuniversities.com/

[2] What is DMARC?

[3] Monitor (allows unqualified emails to go to the recipient's inbox or other folders), Quarantine (directs unqualified emails to go to the junk or spam folder) and Reject, the highest level of protection, (blocks unqualified emails from getting to the recipient).