Brown Under Cyberattack: Some Systems Shut Down, University Calls Incident “Utmost Priority”

Thursday, April 01, 2021

 

View Larger +

Brown University is facing a cyberattack that has forced the school to shut some systems down — in an event that Brown is calling an “utmost priority.” 

Jack Wrenn, a fifth-year doctoral candidate, said that official information was still “frustratingly scant” as of Wednesday night. 

Wrenn provided a timeline as to what he understood transpired, and when the university community was notified. 

GET THE LATEST BREAKING NEWS HERE -- SIGN UP FOR GOLOCAL FREE DAILY EBLAST

“Systems appear to have gone down at 7:19 a.m. [on Tuesday],” said Wrenn. “At 7:24 a.m., Computing & Information Services (CIS) announced that they were 'experiencing a major outage of services running in the Brown datacenter.'"

“At [around] 11 a.m., ‘Oscar,’ Brown's supercomputing cluster, was announced to be offline. For a little while, WiFi wasn't working (apparently because the authentication servers were down), too,” said Wrenn. “At 2:57 p.m., Brown's CIO/CTO Bill Thirsk [posted a letter to the community]."

“Brown's listservs are down, so a lot of the usual communication channels are unusable. Many Brown websites are down, so many students are unable to access essential course materials,” said Wrenn on Wednesday night. “A lot of work has ground to a halt.”

Brown's Initial Communications

On Tuesday afternoon, Thirsk, Brown’s Chief Digital Officer and Chief Information Officer, made the community aware of the threat — and as of Wednesday, the university was still addressing the incident. 

“I’m writing to share that [this morning] Brown’s IT security team became aware of a cybersecurity threat to the University’s Microsoft Windows-based technology infrastructure. Staff in Computing & Information Services took immediate steps to mitigate the threat, launched an investigation and began to develop a full response plan,” said Thirsk Tuesday afternoon. 

“Given the nature of the threat, CIS has taken a number of aggressive steps to protect the University’s digital resources, including shutting down connections to our central data center and systems within it,” he added. “While many of our cloud-based systems — including Canvas, Zoom and Workday — remain up and running, other systems are temporarily disabled. Among the most commonly accessed resources that are temporarily unavailable are Banner, VPN, RemoteApps and some websites hosted on Brown.edu. We are working with colleagues across the University and are committed to getting systems back online as quickly as possible.”

Brown Officials Ask Community to Change Behavior

Thirsk made an ask of the university community to change their online behavior. 

“Because the security threat most directly affects the Microsoft Windows operating system, it is essential that we have as few Windows-based computers running on campus as possible as we work to mitigate this issue. For that reason, we ask that faculty and staff who are on Brown’s physical campus or who logged in via VPN using a Windows-based computer, temporarily halt use of those machines, relying instead on smartphones, tablets or computers that run on other operating systems,” said Thirsk.

“In addition, employees can contact their IT Support Consultant (ITSC) or Departmental Computing Coordinator (DCC) to determine if their Windows machine has 'known-clean' status, in which case it can again be used. We recognize the disruption this will cause and appreciate the patience of the community as we continue to address this challenge,” he added. “At this point, we are unable to predict the precise timeline for disruption to systems and the request of faculty and staff to temporarily halt use of campus-based Windows machines or Windows machines that connected to the VPN until they can be verified as safe.”

University on Record

“Brown recently learned of a security incident that impacted the availability of certain systems within the University’s computer network,” said Brown spokesperson Brian Clark on Wednesday night. 

“Upon learning of this incident, we promptly secured digital assets within our computer network and commenced an internal investigation,” he added. “We are approaching this incident with the utmost priority and are focused on securely restoring the involved systems as quickly and as safely as possible.”

This story was first published 3/31/21 9:02 PM

 
 

Enjoy this post? Share it with others.

 
 

Sign Up for the Daily Eblast

I want to follow on Twitter

I want to Like on Facebook