The need for preventive action arose from a disruption to the usual update process, explains Roland van Rijswijk-Deij, professor of Data-Driven Internet Security. ‘Normally, these updates go smoothly, following a strict procedure. This time, too, the PHP developers were already working on a so-called patch, an update designed to fix the vulnerability. The problem was that one of the parties involved made the news about the vulnerability public on Tuesday, before the update was ready. To prevent malicious actors from exploiting it in the meantime, many organisations, including UT, decided to restrict access as a precaution.’
Swift response
Henk Swaters, Chief Information Security Officer, describes how LISA responded to the news. ‘The news broke on Tuesday evening, 20 October. At six o'clock on Wednesday morning, we assessed the situation and immediately escalated our response. By nine o'clock, a crisis team had assembled to determine which systems were at risk, and at eleven we implemented preventive measures and informed everyone.’
Studenten Net Twente (SNT) acted even earlier. The organisation manages 125 websites belonging to UT's study and student associations. Chair Eli Saado explains: ‘For us, it was a matter of pressing a button. By ten o'clock, all the websites had been locked down on the back end. They could still be accessed via eduroam and eduVPN, but administrators temporarily couldn't make changes, because the vulnerability was believed to be in the upload functionality. We informed everyone involved in good time. That's the advantage of being students: we're not tied to nine-to-five working hours. It's good that UT gives us that autonomy.’
Part of UT's swift response involved identifying which websites and platforms used by the university run on PHP. ‘Because we can't build and maintain everything ourselves, we use a lot of third-party software,’ says Van Rijswijk-Deij. ‘To prevent those parties from exposing us to risks, we make clear agreements in advance about what we expect from them in situations like these.’
Exams cancelled
As a result of the measures, several UT-related websites were only accessible via eduVPN. As agreed, the supplier of the digital assessment platform Remindo decided to take the service offline as a precaution. This led to the cancellation of three exams. ‘That's inconvenient, but the impact was relatively small,’ says Van Rijswijk-Deij. ‘It doesn't compare to the damage a potential hack could cause.’
According to him, problems like these are also difficult to prevent. ‘To put it somewhat cryptically: you don't know what you don't know, so you can't prepare for it either. What matters is how you respond.’
He explains that the foundation responsible for maintaining the PHP programming language is currently being overwhelmed by reports of vulnerabilities discovered using AI. ‘That's not because the software is poor, but because AI identifies all sorts of theoretically possible problems. They have to investigate every single one.’
According to SNT's Saado, the website administrators reacted calmly. ‘They understood. Some even made the best of the situation. When the patch became available, several association website administrators arranged to meet at the Vestingbar to install the updates together over a beer.’
Not the last time
Swaters says this is unlikely to be the last cyber crisis. ‘New vulnerabilities with a major impact keep emerging. That's because applications are built using many reused components. Both security researchers and malicious actors are increasingly using AI to search them for weaknesses.’
According to Saado, staff turnover among website administrators poses a potential problem for student associations. ‘Sometimes a system administrator at an association develops some impressive custom extensions for the website. But when that person graduates and leaves, they leave something behind that the current association members can't do anything with, or don't even know is still there. That can potentially cause problems.’
Van Rijswijk-Deij stresses the importance of a robust crisis response structure. ‘You can't patch a vulnerability before you know about it, but you can make sure your procedures are ready. That's why we hold the OZON exercise, short for Oefening Zonder Officiële Naam (Exercise Without an Official Name), every two years. Together with all higher education institutions, we test how well crisis teams and IT services work together during crises like these.’
According to Swaters, LISA does more than simply install updates. It also closely monitors systems to gain a better understanding of them and their interdependencies. ‘That allows us to identify more quickly which systems are affected and what measures are needed.’
Staying in control
Whether systems are hacked or taken offline as a precaution, isn't the result the same for users: no access? Not according to Van Rijswijk-Deij. ‘If a malicious actor gains access and collects data or holds information to ransom, you're in much deeper trouble. You take systems offline as a precaution when you know a solution is close at hand.’ Saado agrees that the precaution was justified. ‘People were already actively searching for vulnerabilities on our websites.’
Van Rijswijk-Deij concludes: ‘Resilience isn't about being online one hundred per cent of the time. It's about making the right decisions in situations like these. As far as I'm concerned, UT handled this exceptionally well.’
