THAISE: A Web Security Assessment Framework and Empirical Study of 126 Thai Higher Education Institutions

Abstract

The security of university websites is a vital but often overlooked issue, especially in developing countries. This work introduces THAISE (Thai Higher Education Institutions Security Evaluator), a system created to measure and score the web security levels of Thai universities. THAISE assesses seven key areas, including TLS configuration, certificate validity, and security headers such as HTTP Strict Transport Security (HSTS) and Content Security Policy (CSP). These factors are combined into a single Web Security Score (WSS). We used this framework to evaluate all 126 institutions under the Ministry of Higher Education, Science, Research and Innovation (MHESI). Our findings established a national baseline with an average score of 55.9. To ensure accuracy, we compared our results with industry tools like SecurityHeaders.com and Qualys SSL Labs, which showed consistent alignment. The results highlighted that Content Security Policy (CSP) is the most significant weakness, as 92.1% of universities failed to use it. Interestingly, exploratory analysis did not identify statistically significant associations between WSS and institutional budget per student, enrolment size, international ranking status, or Reinventing University group classification in the analyzed dataset. These findings suggest that web security posture may depend less on institutional resources or prestige than on deliberate configuration practices, though further research is needed to confirm this interpretation. These insights offer important directions for national cybersecurity policies in Thai higher education.