You haven't specified a jurisdiction. I will talk about Australia because that's what I'm familiar with.
In Australia the most relevant area of law would be tort, specifically negligence. The university would be liable to pay damages if a court found that it owed a duty of care to your friend, that it breached that duty, and that your friend suffered injury ('injury' including loss of property as well as mental suffering) as a result of that breach.
Also potentially relevant would be contract law, if your friend and the university had entered into some kind of agreement relating to his security, or equity, if the university had somehow acted to lead your friend to rely, to his detriment, on the university protecting him (promissory estoppel: Walton Stores v Maher). However, I think this is unlikely unless, for some reason, the university had put up signs saying 'Please come onto our land and we will be responsible for your security'.
You have stated that 'it is their responsibility to make sure all students are safe on campus.' It is not clear whether you mean to state that as a fact or whether you are suggesting it as a possible hypothetical basis of liability. I am not aware of a case that establishes the proposition that universities do have such a duty.
The judgments in Modbury Triangle Shopping Centre v Anzil (2000) 205 CLR 254 discuss the liability of the occupier of land (such as the university in your example) for injuries inflicted by criminals upon people present on land (such as your friend in your example). In that case, the defendant ran a shopping centre. The plaintiff worked at a shop in the shopping centre. At the end of the plaintiff's shift at 10.30pm, it was dark outside because the shopping centre switched the lights in the car park off at 10pm. The plaintiff was mugged in the shopping centre car park on his way out to his car.
The key question there was whether the defendant shopping centre was under a duty to keep the lights on for workers leaving work (along with the question of how the failure to illuminate the area led to the attack i.e. whether the plaintiff still have been mugged if the lights were on). Therefore the question that we are presently interested in, about an occupier's responsibility to protect visitors, is only dealt with as a side issue in that case.
But the principle is pretty well-established that, generally, you are not responsible to protect another person from the criminal acts of a third person. The common law has a strong presumption against imposing liability for 'omissions' as distinct from acts, which is another way of saying that the courts don't want people being liable to run out into the street and help people. See paragraphs 27 and 28 and thereabouts in Modbury Triangle.
Particular relationships may exist which create such a duty. One is in relation to school children; the school is responsible for taking such care of the child as a parent would. The relevant features of this the school-child relationship include the child's vulnerability as a child and the way the school controls their movements and enviroment during the school day.
I presume that your friend is not a child and the university does not control his or her movements. Therefore a court is likely to be looking at the general principle that the university is not responsible for protecting people from the criminal acts of strangers, and then looking (and probably not finding) any special feature of the relationship between your friend and the university that creates an aspect of vulnerability, reliance or control that makes it reasonable to impose a duty of care.
Some people think that there is a general principle that if something bad happens to them, some identifiable person with cash must be responsible for paying compensation, whether that is an insurer, the government or a nearby corporation. The common law has not picked up that principle. The common law would slate the responsibility home primarily to the mugger. Sue them. What does the university have to do with it? Conceivably the university might also be liable along with the mugger, but the fact that an injury occurred and nobody else can in practice be held responsible does not in itself make the university liable.
As mentioned by Pat W., there may be some other feature that creates a duty, such as if the university had made some change to the environment that allowed made the attack to occur when it wouldn't otherwise have e.g. moving your friend's dormitory so that the only entrance was through a dark alley, or if the attack occurred inside a university building where the university controlled entry (even then not sure that would get your friend over the line).