Tips for the campus community on how to stay safe as vulnerabilities emerge
Northwestern IT and technology teams across the University have recently responded to several critical vulnerabilities requiring rapid action. iStock image by Moor Studio
- Campus Safety
- University News
Cyberattacks on universities are happening faster, and they are getting harder to prevent and contain. Recent incidents across the country show that higher education remains an attractive target because of the valuable information we hold and our open, collaborative nature. Attackers are increasingly using artificial intelligence (AI) to operate at greater speed and scale, while major technology companies are announcing software vulnerabilities more often than ever.
“Protecting Northwestern depends on both our technology teams and every member of the community,” said Sean Reynolds, vice president for information technology and chief information officer. “While the incidents at other institutions differ, they point to challenges universities everywhere, including Northwestern, are confronting. We are not immune to the techniques these attackers use, nor the attacks themselves.”
A shrinking window to respond
Northwestern IT and technology teams across the University have recently responded to several critical vulnerabilities requiring rapid action.
“The biggest change we’re seeing isn’t simply the number of threats. It’s how quickly they can develop and how little time organizations have to respond,” Reynolds said. “Protecting Northwestern increasingly requires us to act quickly when vulnerabilities emerge, and new and sophisticated attacks require everyone in our community to remain alert and report something that doesn’t look right.”
In October, newly disclosed vulnerabilities in PHP, technology used by many websites and online applications, required teams to quickly identify, patch or temporarily take impacted applications offline. The vulnerabilities affected both vendor-provided and custom-built Northwestern applications, including the Faculty Recruiting System, Northwestern Now and the Student Opportunity Application Portal.
At the same time, technology teams were addressing critical vulnerabilities affecting enterprise systems across campus, including myHR, NUFinancials and CAESAR. They were also responding to a security breach at a certificate authority widely used throughout higher education. Certificate authorities issue the digital credentials websites use to verify their legitimacy.
These incidents underscore an important change in cybersecurity: The time between the discovery of a vulnerability and attempts to exploit it keeps shrinking. Technology teams may have only hours, or sometimes no window at all, to protect systems before attackers start looking for vulnerable ones. The average time it takes to move from one compromised system to another has fallen to an all-time low of 29 minutes, according to CrowdStrike, a global cybersecurity and endpoint protection company. In the recent PHP example, attackers were exploiting the vulnerabilities worldwide within hours of their disclosure.
“Responding quickly may sometimes require immediate security updates, temporary service interruptions or changes to access requirements,” Reynolds said. “While disruptive, these measures are necessary to protect University systems and information.”
AI is changing the equation
AI adds another dimension to the challenge. While it can help defenders analyze activity and identify threats, it can also help attackers work faster and at greater scale.
AI does not necessarily create entirely new types of attacks. Instead, it can make familiar tactics easier to create, personalize and distribute. Phishing messages can be more convincing, fraudulent websites more realistic, and attempts to steal credentials or find vulnerable systems easier to scale. Stolen or misused accounts, including those used by software rather than people, were at the core of 89% of the incidents investigated, according to cybersecurity company Palo Alto Networks.
Here’s what you can do
While Northwestern continually works to strengthen the University’s technology environment, technology alone cannot eliminate every risk.
Here are several things that students, faculty and staff can do to help:
- Ensure all University-owned devices and systems are managed by an IT group and protected by CrowdStrike.This security software can detect and stop breaches before they grow. If you are unsure whether your device is covered, contact your local IT support. All devices and systems should also meet the University’s Endpoint Security Standard.
- Be cautious with unexpected messages, links, attachments and requests. AI can make fraudulent communications look polished and legitimate.
- Pause before approving an unexpected Duo or other authentication request. Approve only the authentication requests you initiated.
- Keep devices and applications updated. Security updates frequently address vulnerabilities attackers can exploit. Ask your IT group or Northwestern IT about vulnerability scanning for University-owned assets.
- Use strong, unique passwords or passphrases and passkeys where available. If you manage shared accounts or technical credentials, such as service accounts and API keys, protect them the same way. Northwestern supports 1Password to help you create and store passwords securely.
- Never copy and paste commands from a website into your computer. Northwestern has recently warned about fake Verify You’re Human prompts that ask users to open tools such as Run, Terminal or PowerShell and paste commands that can install malware.
- Report suspicious activity quickly.Unexpected authentication requests, unusual account behavior, suspicious emails or other concerning activity should be reported to the Information Security Office at security@northwestern.edu.
Security in a changing environment
Emerging threats may require Northwestern to take precautionary action before all the answers are known, including temporarily restricting access to an application, requiring an emergency security update or changing access to a service with little notice.
The University’s Status of University IT Services page remains the official maintenance
In a rapidly changing security environment, quick action matters. A suspicious message or unexpected prompt that seems minor to one person can be an early indication of a broader attack. If something looks wrong, please report it to security@northwestern.edu. You also can learn more about how Northwestern helps keep institutional and personal information secure.
