A Systematic Review of Cybersecurity Risks in Higher Education

1

(It would have been great if the authors could highlight more on the countermeasures part. )
This reviewer is interested to see if the authors some discussion on the following topics

Add discussion on countermeasures in to section 9, Cyberrisks in HE

9

We have added some discussion of cybersecurity awareness issues in the cyberrisk and future work sections.

2

1. The role of security awareness towards the resiliency against HE cyber attacks.

Discuss security awareness

9

We have added some superficial discussion of countermeasures.

3

2. How to enhance security awareness to mitigate the issue?

Enhancing security awareness

9

4

3. And, What are the possible strategies?

Possible approaches

9

We have added some suggestions in the future work and limitations discussion.

1

In this paper, a review on the cybersecurity risks in higher education is presented. The paper adopts a literature review model to summarize the research on assets, threat, vulnerabilities, and cybersecurity risk. Overall, the idea of the paper is very interesting. However, the organization of the paper needs improvement.

We have worked on the organization of the paper

Have re-written the asset and threat agent parts of the paper to improve the readability. Hopefully, this change will clarify the answers to the research questions.

1

In this paper, a review on the cybersecurity risks in higher education is presented. The paper adopts a literature review model to summarize the research on assets, threat, vulnerabilities, and cybersecurity risk. Overall, the idea of the paper is very interesting. However, the organization of the paper needs improvement.

We have worked on the organization of the paper

Have re-written the asset and threat agent parts of the paper to improve the readability. Hopefully, this change will clarify the answers to the research questions.

2

The authors proposed to systematically analyze the cybersecurity risks, however, there is a lot of discussions on assets, threats which are not closely related to cybersecurity risks. It is suggested to improve the organization of the paper to better serve the topic.

Tighten the discussion on assets and threats and make it more relevant to the topic

5 and 6

Have tightened this discussion.

3

The answers to the five research questions needs more thorough discussion by incorporating your investigation results. For example, two research questions are answered by Table 7, and Figure 3. However, Table 3 are the results from Verizon, and Figure 3 is data from a website Hackmageddon.com.

We should clarify that the summarized results of this research question is in Table 8.

We have clarified these results throughout the paper. We experimented with an additional discussion of the findings, but the paper is already overly long.

4

Section 3, Method. It is suggested to add a diagram or table showing the relations between seven steps and three main phases. It is not very clear to the readers.

Add a table of the CLR seven step model is added

3

Table added.

5

Section 4, line 183, you mentioned you reviewed 82 different literature. I suggest you should cite them in your paper. The total number of references is only 42, which is too little for a typical survey paper. You should increase the number of references.

While we agree with this sentiment, that there are few references for this review article, this is also one of our key findings. We will go throught the literature again to see if anything can be added.

4

All reviewed articles are included in a new previous work section 2.3

6

Section 4, line 184, you mentioned that you include 19 MODES. In Table 1, there are only 14 MODES. Please check this.

There is a total of 19 MODES citations, but only 14 unique MODES.

Added clarification and updated to source according to the review comments

7

Section 5, Assets in HE. It is suggested that authors should only discuss the higher education assets which are the target of the cybersecurity attacks. The section 5.1.1 should be expanded, and other sections are related to the focus of this paper.

Make the section more related to cybersecurity risk.

We have re-written the assets-part of the paper and clarified the contribution

8

Figure 3 only list the data in two years which is not sufficient to answer the research question “which are the most frequent threat events in HE?” The source of the data is from a website. Why do you choose this website? Does any other website provide similar data?

This figure is not meant to answer the research question 2, it is a presentation of the data source hackmageddon. A summary and comparison of the findings are in Table 8 (of the submitted draft) "The rank of the threat events present in the educational industry according to literature". We assume that this is connected to the fact that our findings are poorly communicated.

Updated the threat events sections and improved the tables 7 and 9. Table 9 summarizes the results

9

The primary finding of this research is not clear to me. The authors claimed in the abstract that the primary finding is “empirical research on cybersecurity risk in higher education is scarce and there are large gaps in the literature”, which does not advance the current research and shows very limited novelty and societal impact.

re-address abstract and conclusion

Abstract and conclusion

Edited the abstract and conclusion to clarify the contribution

10

Several typos below:
Page 1, Line 1, “The demands for secure …” -> “The demands for securing…”
Page 2, Line 67, “The findings of this also article require” -> “The findings of this article also require”
Page 3, Line 115, “with the purpose of explore ….” -> “With the purpose of exploring…”
Page 4, Line 138-139, “we also chose to reviewed ….”-> “ we also chose to review..”
Page 4, Line 155, “ studies published before year 2000” -> “studies published after year 2000”
Page 6, Line 239-240 “on a dataset and is lacking lacks…” -> “on a dataset and is lacking…”

Done

All recommended changes has been made.

1

The article is a review of the literature and threats in the area of cybersecurity in higher education. At
the beginning of the article, the authors ask 5 questions that the article is to answer based on the
available literature. Below are my comments:

2

1. The article shows a very weak relationship between the topic of the article and the Key
Performance Indicators. Authors should clearly emphasize the relationship between KPIs and
the analyzed security area.

Tighten the discussion on assets and KPIs and make it more relevant to the topic

Have conducted a major revision on the assets and KPI parts.

3

2. The article should indicate how the HE systems differs from classical Enterprise IT systems.
What makes this environment unique? Why is it important to analyze it as a separate class of
systems. Such features are indicated in the work, for example: Openness, attitude and
culture. However, these features should be collected and summarized in the introduction to
emphasize the distinctiveness of HE IT systems.

Add a section about how HE systems differ from enterprise IT systems to the background-chapter.

Added section 2.2

New section 2.2 "What separates HE from classic industry?"

4

3. The article is difficult to read. In my opinion, the work should contain more graphic and
tables (lists, comparisons, etc.) that will improve the readability of the article. Some chapters
have graphical summaries, others do not, e.g. only table 11 is given in the chapter
Vulnerabilities in HE. It seems to me that the article would become more readable if graphics
were added to this chapters that would show the vulnerability classification (their
percentage, "importance", etc.)

Readability and summarization of results.

We have added some more tables and figures, merged findings, and tried to improve the readability. Especially the assets and threat agents sections have been revised. We have tried to improve the readability of the whole paper. We did not have any metrics on importance beyond tha no of citations, so we did not go into this issue.

5

4 The cyberscurity area is developing very dynamically. However, the authors present very old
data, e.g. figure 2 (page 14. ). The figure below shows the distribution of publications in the
article in relation to the date of their publication

We have tightened the research years from 20 to 12 years to remove the obvious gap that you point to in your graph.

6

Nice summary of the included data.

7

5. For example, the 2003 publication is about "Security and Online Learning: To Protect and
Prohibit." Isn't it worth using newer publications, e.g.
- https://ieeexplore.ieee.org/document/6360592 (2012)
- https://ieeexplore.ieee.org/document/9011971 (2019)
- https://www.mdpi.com/2076-3417/10/21/7730/htm (2020)

Add and review suggested litterature

We have added over 30 new citations: New previous work section 2.3. Two new sources in the review and one removed.

8

6. I suggest including more publication databases than those listed on lines 122 to 124, for
example https://ieeexplore.ieee.org

Add suggested databases, conduct additional searches, and add findings

See above answer

9

7. On line 917, the authors say: The amount of empirical studies featuring information assets
in higher education was quite limited. It should be taken into account that HE systems (HES)
are part of Enterprise class systems (ECS). A large group of asset, cyber threat, vulnerabilities,
risk in HES and ECS is similar and in this context the scope of the analyzed literature can be
expanded.

Consider the comparison to enterprise systems and expand.

Added to as suggestion for future work

10

8. The authors very often use the term risk management (eg line 144-145). I would suggest
adding information about the definition of risk management they use. I understand this in
the context of ISO 31000 or https://www.axelos.com/best-practice-solutions/mor. Please
define precisely the used term because its use in the article may raise doubts

Add definition of risk management in the background

2.1

Added definition of risk management in section 2.1

11

In conclusion, the authors have done a lot of work, which is an attempt to systematize knowledge
about cybersecurity in HE systems. The selected review method (Comprehensive Literature Review
model) is very good. Adding graphical (quantitative) summaries for selected chapters and referring to
newer literature items (e.g. in the context of enterprise-class systems) will, in my opinion, improve
the quality and readability of the article. In my opinion, such a revised article will be a valuable
source of knowledge for IT of HE departments and for scientists dealing with security of information
systems.