Harvard Can't Fully Prevent Future Cyber Attacks, Experts Say

Harvard officials discovered that its Faculty and central administrative networks suffered a cyber attack late last month, a blow that prompted administrators to request that thousands of students and employees change their passwords.

And according to experts in cyber security, there may be nothing that Harvard and institutions like it can do to fully protect themselves from future attacks.

Harvard has long been a target for assaults on its information technology systems. Christian Hamer, Harvard's chief information security officer, said in 2013 that the University’s servers see tens of thousands of cyber attacks a day.

The most recent incident, which officials said they discovered on June 19, marks the highest profile cyber security breach at Harvard since the University’s official website was hacked by the Syrian Electronic Army to display images of Syrian president Bashar al-Assad in 2011. The website of the Institute of Politics was also hacked in April, allegedly by a pro-Palestinian group.

But the problem is not unique to Harvard, according to experts. Cyber attacks have hit institutions for years, but they have significantly increased in profile recently, according to Ryan Ellis, a postdoctoral research fellow at Harvard’s Belfer Center for Science and International Affairs. And since the creation of the internet, they have been steadily on the rise as more and more people surf the Web and use electronic devices each day, said Tad J. Oelstrom, the director of the National Security Program at the Kennedy School of Government.

An institution like Harvard is especially attractive to hackers, Oelstrom added, because the information stored in the network is “marketable.” James Burns, a technical consultant at Information Risk Management, said information stored on Harvard’s network could reach into corporate, government, and potentially military realms, which could spark the interest of hackers recruited by countries to advance their national goals.

The sources of cyber security breaches vary: “There are so many ways to get into systems nowadays,” Oelstrom said. But one possible source of the recent breach at Harvard, he said, is a corrupted email, in which a user clicks on a specific link and allows access to Harvard’s network.

Burns suggested that regardless of the method of the breach, it was likely a less sophisticated one. “[Hackers] have exploited old, common, or human weaknesses to gain access,” Burns said.

Oelstrom said changing and strengthening passwords can help prevent phishing, a type of email fraud used to gather a user’s private information. But both Burns and Oelstrom emphasized that Harvard, and other institutions, will never be fully immune to cyber security incidents like this one.

“It will nearly always be possible to trick someone into visiting a malicious website or opening a malicious attachment,” Burns said.

Oelstrom said he does not expect Harvard to release a report about the hack, as it would likely inform future perpetrators of preventative measures within Harvard’s networks.

—Staff writer Jalin P. Cunningham can be reached at jalin.cunningham@thecrimson.com. Follow her on Twitter @JalinCunningham.