Why cybersecurity needs to be a priority for the education sector
Adrian Jones, CEO at Swivel Secure Education institutions need to make cybersecurity a priority. Despite the sector facing major challenges such as a lack of staffing and a lack of funding and resources, cyber attacks are no less frequent or less severe in education. In fact, they seem to be gaining ground in prevalence year-on-year as instances of breaches in schools and higher education are widely reported. In recent years we’ve seen news of ransom attacks causing financial damage – like that on the University of Calgary where the institution allegedly handed over $20k to cybercriminals, and malware attacks causing mass disruption – similar to the disruption which, apparently, caused the Minnesota School District to shut down for a day while IT professionals rebuilt the system. The more worrying breaches are where student safety is compromised. Educational institutions are entrusted to safeguard their students, many of whom are minors, but a weak cybersecurity infrastructure can put them at risk. This was made all too clear when the CCTV in several schools in Blackpool was allegedly breached, and the footage reportedly live-streamed on the internet. It’s an unfortunate fact that, while cybersecurity in education is necessary to protect against financial loss and prevent disruption, it’s also crucial to protect students from harm. Which is why the sector needs to do everything it can to ensure their applications and systems are protected, and work to overcome any challenges. In this article, we’ll look at the current state of cybersecurity in education. We’ll discuss the most common reasons for attack, the highest threats and the main challenges facing the sector to help you understand why cybersecurity needs to be a priority, and how you can make it a priority for your educational institute. Why education is a target for cybercrime There are four key reasons why Education is a target for cybercriminals. With Education venues varying in size, purpose, and stature, the motives for attack can vary too. For example, what might be a common threat for world-renowned Universities/Colleges might not be an issue for schools or school districts. So, institutions need to evaluate the risk and understand what data is vulnerable to unauthorised access. DDoS attacks – Distributed Denial of Service, or DDoS attacks are a common type of attack on all levels of Education venue. This is where the attacker’s motive is to cause widespread disruption to the institute’s network, having a negative effect on productivity. This can be a relatively easy attack for amateur cybercriminals to carry out, especially if the target network is poorly protected. There have been instances of students or teachers successfully carrying out a DDoS attack, with motives ranging from simply wanting a day off, to protesting the way a complaint was handled. Data theft – This is another attack affecting all levels of education because all institutions hold student and staff data, including sensitive details like names and addresses. This type of information can be valuable to cybercriminals for several reasons, whether they plan to sell the information to a third party or use it as a bargaining tool and extort money. The concerning aspect of this type of attack is that hackers can go unnoticed for long periods of time. As was the case at Berkeley, where at least 160,000 medical records were allegedly stolen from University computers over a number of months. Financial gain – Another motive for hackers carrying out an attack on an education institution is for financial gain. This might not be as high a risk for public schools, but with private institutions and Universities/Colleges handling a large number of student fees, they’re a prime target for cybercriminals. Today, it’s usual for students or parents to pay fees via an online portal, often transferring large sums of money to cover a whole term or year of tuition. Without proper protection or preparation on the part of education institutions, this presents a weak spot for cybercriminals to intercept. Espionage – The fourth reason why education is a target for cybercrime is espionage. In the case of higher education institutes like Universities/Colleges, they’re often centres for research and hold valuable intellectual property. Universities/Colleges need to be suitably protected, as it’s thought that scientific, engineering and medical research by UK Universities has been previously compromised by hackers, and with plenty of time and money to fund them professionals are often at the helm of these attacks. With these four motives in mind, the way in which hackers carry out an attack on Education networks can further help us understand how to protect them. How education is targeted JISC’s 2018 Cybersecurity Posture Survey questioned IT professionals within further and higher education. They were asked to name the top cyber threats facing their institutions, and the top three answers give us insight into the most common ways Education networks are breached. Phishing – Phishing scams often take the form of an email or instant message and are designed to trick the user into trusting the source in a fraudulent attempt to access their credentials – whether that’s sensitive student data or confidential research. This type of attack is highlighted as the top threat facing higher education venues, suggesting hackers regularly target the sector using the method. Ransomware/Malware – Also in the top three cyber threats highlighted by the report, ransomware and malware attacks prevent users from accessing the network or files and cause disruption. More advanced forms of this threat can see attackers hold files to ransom. Ransomware or malware typically infects devices using a trojan, a file or attachment disguised to look legitimate. However, some ransomware (like the WannaCry attack) have been shown to travel between devices without user interaction. Lack of awareness – The third threat listed by professionals in both further and higher education is a lack of awareness or accidents. This could be on the part of staff or students who aren’t sufficiently trained to practice good cyber hygiene or accidentally compromise the network. Despite taking on different appearances,
Tackling staff absence in schools, academies and colleges
A total of 2.16 million days were lost due to teacher sickness absence in 2015/16 according to the latest statistics from the Department of Education[i]. Other figures from the Liberal Democrats[ii] this year revealed that one in 83 teachers is now on long-term leave of one month or more for stress and mental health issues in 2016/17 – up 5% on the previous year. Adrian Lewis, director at Activ Absence says that sickness absence not only costs schools money, it can also impact staff morale and recruitment and retention, which can affect the pupils’ education. Lewis says, “Tackling absence is essential given schools operate on tight budgets and are workplaces where absences will be immediately noticed. If a teacher is frequently off sick it will either add to supply teaching costs or the workload of other teachers and affect teaching standards. “To address this situation, a growing number of educational establishments including primaries, academies and colleges are looking to drive efficiencies and reduce absenteeism levels by investing in absence management software to better manage their sickness absence. “A good absence management system will let teachers log on to alert school managers they are sick, making it easier to plan the day and sort out cover in time for lessons. It can help reduce key skills shortages as well as support the return to work process. “Having a system where you can see clearly who is off and when, whether this is for meetings, sick leave or holiday leave all in one place that is simple and easy to use, with zero training needed can be hugely beneficial. “This software can also help uncover the root causes of sickness absence and pick up trends such as someone often off ill on a Monday which could indicate stress, a growing problem in British schools,” adds Mr Lewis. A NASUWT union survey[iii] last year highlighted that one in ten teachers are taking anti-depressants to cope with work stresses – with heavy workloads and staff shortages being blamed. Having staff off sick is only adding to this problem. “By gaining insight into absence trends managers can spot patterns of sickness which can bring mental health issues, such as stress and anxiety, to light more quickly. This enables managers to offer support and help teachers who may be struggling,” adds Mr Lewis. Schools like the John Port Spencer Academy in Derbyshire are already getting the benefits of using this technology. Jeannette Topham, HR Officer says, “We started using Activ Absence in October 2017. We were looking for a system that streamlined requests for planned absence and one that also helped us to manage the sickness absence process. Staff have adapted to the new system really well and the online forms and email prompts are really useful for keeping everyone informed about what they need to do. “The system keeps the School Leadership Team informed about staffing and the cover supervisor knows what requests are being made in advance to help anticipate any cover needs.” Louise Varner, HR Administrator at Bootham School in York finds the system simple to use, highly intuitive with information easily accessed and clearly displayed. She says, “Reports can be customised to deliver management information as and when required and scheduled to run automatically. “I have set up various alerts within the system which trigger e-mails to me, the HR manager and line manager if certain criterion is met. We use this information to inform positive interventions, as line managers are able to discuss any issues with their staff as soon as a pattern of absence emerges. This has had a positive impact in reducing absence and reflects the supportive ethos of the school. “The online return to work form gives a coherent structure for line managers to follow when conducting interviews with staff and prompts them to fully explore any adjustments that may be needed to facilitate a phased return. The system also sends a reminder if the return to work has not been completed which is invaluable in ensuring that records are up to date and that we, as an organisation, are looking after the wellbeing of our staff.” Mr Lewis concludes, “For schools, academies, colleges and universities thinking ahead to the new academic year and planning IT budgets now, investing in technology could be a game changer for reducing and managing staff absence effectively. Absence management software can bring efficiencies and savings, as well as help schools look after the wellbeing of staff their staff.” For more information visit: www.activabsence.co.uk
RANDSTAD STUDENT SUPPORT PUTS SHROPSHIRE STUDENTS IN POLE POSITION
Randstad Student Support, a leading provider of learning support staff, has taken a group of 15 budding Formula 1 racing engineers to the Williams Martini Racing F1 Factory for a day of innovation, excitement and engineering insight. The lucky group from North Shropshire College included 14 students who fought off tough competition to win the trip, managing to take home the trophy in a competition hosted by Randstad Student Support at the Association of Colleges conference held in November. Randstad Student Support worked with 65 further education colleges and 93 universities around the UK last year, providing vital support for 28,000 students, helping them to achieve their potential. All the students on the tour are currently studying either engineering or mechanics at the college and were given a glimpse into the inner working of the Williams garages. Also attending from Randstad was Victoria Short, Managing Director, Sadie Besley, Operations Director and Karen Guthrie, Further Education Development Manager. Students visited the advanced engineering section of the factory, learning how engineers at Williams use their high-tech, scientific knowledge to solve everyday problems. For example, students discovered that Williams’ pioneering work in cooling down race car engines had been transferred to reducing energy bills in the frozen aisles of supermarkets – creating vast energy savings. This revealed the wide range of professional options available to the students and the versatility of engineering as a career choice. With 431 engineering jobs currently available on Randstad’s website there’s high hopes the visit will have inspired a new generation of expertise.[1] Students also got the chance to prove their racing credentials and try to beat the best of F1 drivers on a BATAK reaction machine. Unfortunately the chequered flag was out of reach – with most posting scores half those of professional drivers. And the final pit stop was to the Williams museum, to check out the trophy collection and see F1 mementos up close. Sadie Besley, Operations Director, Randstad Student Support comments: “This competition was all about inspiring innovation in students – and giving them a glimpse into a potential career in engineering. F1 is the pinnacle of professional racing – and we want North Shropshire students to be at the top of their game. It was fantastic to see the students engage with the experience and fully embrace all the elements that create a successful F1 team. A practical and hands-on opportunity can give students the motivation to further their careers and something to aim for in the future. The skills picked up on the tour are highly applicable and will act as a real motivator for these budding engineers.” A real highlight of the trip was a chance to speak to Williams engineers and learn more about their career paths. Students had the opportunity to ask questions and find out more about future career prospects on offer at Williams. There are a wide variety of ways for students to improve their skills, with many apprenticeships on offer throughout the industry. Sadie Besley, Operations Director, Randstad Student Support concludes: “The best way to get ahead and give yourself the best career opportunities in the engineering sector is to get some hands-on experience. It doesn’t have to be paid work, any time that can be spent learning on the job, gaining practical skills and boosting your experience can give you a great advantage as a candidate. It’s hard to find the right person for the right job and experience and enthusiasm are key for outpacing other applicants. “For further education colleges looking to encourage students to pursue their interests in engineering and technology, the best way is to provide opportunities to see engineers in action. This doesn’t have to be a grand trip to a F1 Factory, it can simply be arranging for engineers to visit and speak to students. Practical advice is particularly important. And nothing is as inspiring as seeing a true professional in action.” https://www.randstad.co.uk/employers/areas-of-expertise/student-support/