Creating a Cybersecurity Culture Framework in Higher Education

Abstract

[...]higher education institutions can build a culture that prioritises cybersecurity and fosters safe behaviour among all participants while adhering to the principles presented in this paper. According to Conte (2022), some of the reasons why cybercriminals succeed with their attacks within institutions of higher learning include: * The number of legacy systems and processes still being used. * Lack of appropriate specialists and engineers that can support systems security. * The number of employees, academics, and students working online and remotely since the COVID-19 pandemic. e Lack of cybersecurity awareness and culture within higher education leaves them more vulnerable to threats. e Higher education institutions often struggle to prioritise cybersecurity, similar to the general public, where it is not always taken seriously. According to new research from Malwarebytes Threat Down analysts, 2023 was the "worst year on record" for education, with a 105% increase in known ransomware attacks targeting the global education sector and a 70% increase in ransomware targeting higher education specifically - with nearly half targeting academic institutions in the United States (ThreatDown, 2024). Methodology This paper used a literature review as the primary methodology to investigate the primary components and constituents of a framework for a cybersecurity culture in higher education combined with the extensive experience in cyberculture development of two of the authors.