A recent cyberattack that disrupted the University of T&T’s (UTT) online operations and forced the postponement of examinations has renewed concerns about the country’s growing dependence on cloud-based education platforms.
Cybersecurity expert Daren Dhoray yesterday said the incident, while deeply frustrating for students and staff, highlights a global vulnerability rather than an isolated failure by UTT.
He said the disruption stemmed from an attack affecting Canvas Learning Management System (CLMS), a popular cloud-based learning management system used by universities worldwide.
“Hundreds of universities across the globe were actually impacted and it shows that the reliance on these cloud infrastructures. We need to have backup strategies so that we don’t encounter situations where, during exam times, students are put under unnecessary stress to delay their exams. So it’s a rather unfortunate situation,” Dhoray said, adding that such situations place unnecessary stress on students.
He added that major cloud service providers are frequent targets for cybercriminals due to their size and reach.
“Once you have these reliance on these cloud providers, especially very popular ones, which tend to be high targets for cybercrime and cyber-related incidents, you always have to put in these types of mitigation strategies to deal with it if in the event that it hits home like it did,” Dhoray said.
He advised that UTT use the incident as a learning opportunity, not just from a cybersecurity standpoint, but from a business continuity perspective.
Teaching and learning, he noted, are UTT’s core services, and relying entirely on an external vendor for those services places the institution “at the behest” of that provider.
One practical step he recommended is conducting tabletop exercises, where senior leadership simulates a system outage and decides in real time how to respond.
“If your systems are down, what do you do? Who communicates with students? How do exams continue? These questions should already be answered before an incident occurs,” Dhoray said.
Looking more broadly, he warned that businesses and public institutions across the country face similar risks.
Since the pandemic, many organisations have rapidly moved operations to the cloud without fully planning for failures or cyberattacks.
“I think now is a good time for us to bring that back home and understand that maybe we probably need to look still at some of these offline methods. Good old paper strategy might still work in the case where you want to continue running your business, especially for a small business that might be relying on a cloud accounting software or even e-commerce,” Dhoray explained.
In 2023, several state agencies were the victims of cyberattacks, including the Telecommunications Services of Trinidad and Tobago, the National Insurance Board and the Office of the Attorney General and Ministry of Legal Affairs.
On Friday, UTT’s principal Professor Rean Maharaj told Guardian Media that, as it stands, the university believes only the students’ university-assigned email addresses were leaked.
He also confirmed the CLMS was back online.
