Schools have always had a battle on their hands when it comes to cyber security; then Covid-19 stepped on to the scene. The Covid-19 pandemic has resulted in significant cyber security uncertainty on a global level. Carefully tailored spear phishing, ransomware attacks and contact-tracing scams have already created widespread fear. Now the stakes have become higher than ever regarding cyber threats and attacks targeted towards schools and the education sector.
Schools have significant cybersecurity shortfalls when dealing with cyber threats
Funding concerns for cyber security systems, regulatory complexity and a clear lack of skilled staff and resources to identify security risks will never help improve a school’s overall security posture. Schools as a result are far more likely to make basic configuration errors in system setup or leave known vulnerabilities unpatched – effectively leaving the door wide open for hackers and other opportunist cyber criminals.
“A severe lack of funding for cyber security hasn’t made it any easier to keep data secure – and that issue became even more apparent when classes moved to an online environment. With this digital transformation schools now need to look way beyond industry data to find gaps in their security.”
Mark Oakton
Security Director – Infosec Partners
THE REAL IMPACTS OF A SUCCESSFUL BREACH ARE CLEAR
- Disruption to classes & education
- Exposure to identity theft
- Compromised equipment
- Data loss
- Resultant costs, liabilities and regulatory fines
In this article we will be looking at the key cyber security threats that schools are currently facing and how these security gaps can be closed with maximum effect.
The Biggest Cyber Threats to Schools Include:
Data Loss & Data Breach
A data breach is the release of secure confidential information and is a big cyber threat to schools.
Educational establishments including schools, colleges and universities all share a culture that promotes sharing of information. However, due to the information they safeguard and control, they face very similar issues as most other businesses when it comes to protecting their data.
With data regarding parents, students, research data, payment information, health records, and other sensitive data, educational establishments must facilitate a secure environment for its students and staff by implementing data loss prevention measures.
- End users should receive training advice on what data they are responsible for protecting and how the information should be handled
- Encryption services should be used for any data that needs to be sent via email.
- Establish processes for what to do if a data breach occurs.
- Consider insurance to cover the cost of mitigating the damage in the case a data reach should occur.
- Security systems should be audited by a 3rd party to ensure compliance
Phishing
Phishing and Spear Phishing are tactics scammers use to trick email recipients into providing confidential information such as usernames, passwords and network credentials. Implementing email security is essential in combating the spread of malicious emails as well as training staff to detect and report suspicious emails can significantly reduce the risk of systems being compromised.
Ransomware
Ransomware attacks are where hackers encrypt data files and systems through malicious software and request a ransom to regain access. The most effective response to regain access to data is to backup data on a server that is not accessible to the rest of the school’s network and therefore is not vulnerable to ransomware encryption agents.
Human factor
One of the biggest cyber security threats to schools is its staff. Most breaches occur from either human caused factors due to poor decision making processes, deliberate sabotage or external financial manipulation. However, poor decision making doesn’t always relate to reckless behaviour of those responsible but more likely is due to poor understanding of cyber security as a process.
BYOD & IoT
Allowing staff and students to use their own devices provides significant cyber security and data protection risks. The WiFi network must be secure. Unless access is effectively managed the BYOD model can introduce new risks into the classroom – particularly to safety and security. IoT devices in schools might include interactive whiteboards, virtual reality, robots, tablets and laptops, 3-D printers devices and other devices that may be student or teacher owned. IoT devices should be isolated to a separate VLAN where they can be monitored and don’t have access to the rest of the school’s network. Also make sure all default passwords are changed on the IOT devices.
Our Solutions To Mitigate Cyber Threats To Schools
We provide a number of tailored cyber security consultancy services and managed security services for the education sector to counter the cyber threats to schools – these include:
Managed Firewall Service
Web security and content filtering helps safeguard digital learning in and out of the classroom by blocking inappropriate content, malware and phishing scams.
Managed Security Information and Event Management (SIEM)
Our managed SIEM service helps limit any disruptions to learning by highlighting anomalies, such as those indicative of insider threats, to increase response time.
Managed Identity and Access Management (IAM)
Our IAM service provides a more secure and streamlined access to online learning resources and provides increased protection of student and faculty data, even if passwords are compromised or stolen.
Managed Network Access Control (NAC)
Our Network Access Control service provides schools with a perfect balance between security and usability by authorising who is allowed network access, when, where and from what devices.
Managed Email Security
Email is one of the top attack vectors for cyber criminals. Infosec Partners can provide comprehensive protection for staff and student email accounts under the school’s control; from spam, malware, phishing and other advanced threats. Our Managed Email service scans inbound and outbound email for viruses, spam and malware to identify suspect messages before they reach your servers.
Managed Backup and Disaster Recovery
Our managed backup and disaster recovery service provides rapid data restoration in the event of a breach and protects against costly ransomware payouts and minimises classroom interruptions.
To arrange a free consultation for your school, please contact Infosec Partners today.
call +44 (0)1256 893 662 or email secureschools@infosecpartners.com
