Cybersecurity Law and Risk Management in Technology Enhanced Learning Factories

Imam Rahmaddani

doi:10.33050/itee.v5i1.1143

Authors

Imam Rahmaddani Islamic University of Syekh Yusuf https://orcid.org/0000-0002-2915-2695

DOI:

https://doi.org/10.33050/itee.v5i1.1143

Keywords:

Cybersecurity Law, Risk Management, Learning Factory, Legal Compliance, Data Protection

Abstract

Higher education institutions increasingly operate technology enhanced learning factories that connect instructional platforms to real or simulated production equipment. This arrangement enlarges the attack surface of academic networks and introduces legal obligations that conventional campus policies do not cover. This study investigates cybersecurity exposure in higher education and the legal and risk management obligations of institutions that operate such facilities, with Indonesia as the primary jurisdiction. A qualitative literature review and a doctrinal analysis of Indonesian statutes were combined with a secondary analysis of the Verizon Data Breach Investigations Report 2024, the Sophos State of Ransomware in Education 2024 survey, and reports of the National Cyber and Crypto Agency (Badan Siber dan Sandi Negara, BSSN) for 2021 to 2024. The data show 1,537 confirmed breaches among 1,780 education incidents in 2024, an increase in ransomware encryption in higher education from 73 percent to 77 percent, and a mean recovery cost of USD 4.02 million. On this basis, the study proposes a four layer awareness framework and a Legal Risk Governance model that treats legal duties as risk acceptance criteria and favors controls that preserve experimental learning. Both proposals are aligned with Sustainable Development Goals 4, 9, and 16 and with Indonesian regulation. The findings provide institutions with a structured basis for governing open learning environments without leaving unlawful residual risk.

References

[1] L. Vogt, F. Pelzer, A. Klose, V. Khaydarov, H. Lange, I. Viedt, J. M¨ader, and L. Urbas, “A scalable learn- ing factory concept for interdisciplinary engineering education: Insights from a case implementation,” Education Sciences, vol. 15, no. 12, p. 1574, 2025.

[2] Y. S. Fadillah, I. Yusnita, A. A. Kamal, A. Aprillia, and S. Millah, “Designing an educational informa- tion system to enhance learning factory management in higher education,” International Transactions on Education Technology, vol. 4, no. 1, pp. 66–82, Nov. 2025.

[3] Verizon Business, “2024 data breach investigations report,” Verizon, Tech. Rep., 2024. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/

[4] Sophos, “The state of ransomware in education 2024,” Sophos Ltd., Tech. Rep., 2024. [Online]. Available: https://www.sophos.com/en-us/content/state-of-ransomware

[5] BSSN, “Indonesia cybersecurity landscape 2023,” National Cyber and Crypto Agency, Tech. Rep., 2024.

[6] National Cyber and Crypto Agency, “Ransomware attack on temporary national data center,” 2024, offi- cial Press Release.

[7] D. Wibowo and A. Elfina, “Studi kasus serangan ransomware brain cipher pada pusat data nasional se- mentara indonesia,” Jurnal Mahasiswa Ilmu Komputer, 2024.

[8] EDUCAUSE, “2026 educause top 10: Collaborative cybersecurity,” EDUCAUSE Review, 2025. [Online]. Available: https://er.educause.edu/articles/2025/10/2026-educause-top-10-1-collaborative-cybersecurity

[9] Republic of Indonesia, “Law no. 27 of 2022 concerning personal data protection,” State Gazette of the Republic of Indonesia Year 2022 Number 196, 2022.

[10] M. Mulyati, I. Ilamsyah, A. Aris, I. Gunawan, and M. S. Zahran, “Blockchain technology: Can data secu- rity change higher education much better?” International Journal of Cyber and IT Service Management, vol. 1, no. 1, pp. 121–135, Apr. 2021.

[11] S. Watini, G. Davies, and N. Andersen, “Cybersecurity in learning systems: Data protection and privacy in educational information systems and digital learning environments,” International Transactions on Education Technology, vol. 3, no. 1, pp. 26–35, Nov. 2024.

[12] V. Mullet, P. Sondi, and ´E. Ramat, “A review of cybersecurity guidelines for manufacturing factories in industry 4.0,” IEEE Access, vol. 9, pp. 23 235–23 263, 2021.

[13] BSSN, “National cybersecurity awareness survey 2024,” National Cyber and Crypto Agency, Tech. Rep., 2024.

[14] M. Murod, S. Anhar, D. Andayani, A. Fitriani, and G. Khanna, “Blockchain based intellectual property management enhancing security and transparency in digital entrepreneurship,” Aptisi Transactions on Technopreneurship, vol. 7, no. 1, Mar. 2025.

[15] R. Indrawan, A. Ratih, H. Agustian, and R. Evans, “Governance models for blockchain integrated IoT ecosystems,” Blockchain Frontier Technology, vol. 5, no. 2, pp. 219–229, Jan. 2026.

[16] D. Bhamare, M. Zolanvari, A. Erbad, R. Jain, K. Khan, and N. Meskin, “Cybersecurity for industrial control systems: A survey,” Computers & Security, vol. 89, p. 101677, 2021.

[17] U. H. Yulianti, Y. I. Tanjung, U. Rahardja, N. Lutfiani, and A. Valerry, “Integration of IoT and blockchain for business data security,” Blockchain Frontier Technology, vol. 6, no. 1, pp. 62–73, May 2026.

[18] A. Kristian, A. R. Az-Zahra, F. Hidayat, A. Y. Fauzi, and E. Kallas, “Enhancing cybersecurity risk management strategies in financial institutions: A comprehensive analysis of threats and mitigation ap- proaches,” Journal of Computer Science and Technology Application, vol. 1, no. 2, pp. 96–103, Aug. 2024.

[19] U. Rahardja, P. A. Sunarya, Q. Aini, S. Millah, and S. Maulana, “Technopreneurship in healthcare: Eval- uating user satisfaction and trust in AI-driven safe entry stations,” Aptisi Transactions on Technopreneur- ship, vol. 6, no. 3, Sep. 2024.

[20] R. Widayanti, A. B. Mutiara, and A. Tarigan, “Data governance in blockchain-based systems for intern- ship grade conversion,” Aptisi Transactions on Technopreneurship, vol. 6, no. 3, Nov. 2024.

[21] A. Manawar, “An innovative and secure platform for leveraging the blockchain approach for online ex- ams,” Aptisi Transactions on Technopreneurship, vol. 5, no. 1, pp. 99–108, Mar. 2023.

[22] Amitkumar, M. I. Sanni, and D. Apriliasari, “Blockchain technology application: Authentication system in digital education,” Aptisi Transactions on Technopreneurship, vol. 3, no. 2, pp. 151–163, Sep. 2021.

[23] M. Akhyar, T. M. Fadla Yoga, and E. Sukmawati, “Blockchain-based ubiquitous learning method towards higher education security,” Blockchain Frontier Technology, vol. 1, no. 2, pp. 44–54, Jan. 2022.

[24] Republic of Indonesia, “Law no. 1 of 2024 concerning the second amendment to law no. 11 of 2008 on electronic information and transactions,” State Gazette of the Republic of Indonesia Year 2024 Number 1, 2024.

[25] Indonesia Government, “Presidential regulation no. 82 of 2022 on vital information infrastructure protec- tion,” 2022.

[26] ISO/IEC 27005:2022 Information security, cybersecurity and privacy protection, Guidance on managing information security risks, ISO/IEC, Geneva, Switzerland, 2022.

[27] ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection, Information security management systems, Requirements, ISO/IEC, Geneva, Switzerland, 2022.

[28] D. Alsmadi and D. Alshdaifat, “Multi-factor authentication adoption and organisational cyber resilience,” International Journal of Information Security, 2022.

[29] National Institute of Standards and Technology, “The nist cybersecurity framework (csf) 2.0,” NIST, NIST CSWP 29, Feb. 2024.

[30] A. N. Savitri, M. Hardini, G. Yao, and G. Yao, “Risk management model for compliance and security in blockchain powered payment platforms,” Aptisi Transactions on Management, vol. 9, no. 2, pp. 186–196, May 2025.

[31] F. Yusuf, R. Widayanti, S. R. Putri, and A. Wellington, “A comprehensive framework for enhancing blockchain security and privacy,” Blockchain Frontier Technology, vol. 4, no. 2, pp. 171–182, Feb. 2025.

[32] T. Ramayah, “Factors influencing the effectiveness of information system governance in higher education institutions (HEIs) through a partial least squares structural equation modeling (PLS-SEM) approach,” IAIC Transactions on Sustainable Digital Innovation, vol. 5, no. 2, pp. 100–107, Apr. 2024.

[33] H. Hamdan, U. Rahardja, M. Muhtarom, and A. Valerry, “Transforming education management with orange servant leadership and happiness practices,” Aptisi Transactions on Technopreneurship, vol. 8, no. 2, Jun. 2026.

[34] B. Reinheimer, L. Aldag, P. Mayer, M. Mossano, R. D¨uzg¨un, B. Lofthouse, T. von Landesberger, and M. Volkamer, “An investigation of phishing awareness and education over time: When and how to best remind users,” Computers & Security, 2022.

[35] A. Georgiadou, S. Mouzakitis, and D. Askounis, “Assessing MITRE ATT&CK risk using a cyber-security culture framework,” Sensors, vol. 21, no. 9, p. 3267, 2021.

[36] A. Prasetyo and P. W. Handayani, “Cybersecurity awareness among indonesian university students: Reli- ability and validity of a self-report instrument,” Journal of Information Systems, 2022.