universities are sitting cybersecurity ducks