Why cybersecurity needs to be a priority for the education sector
Adrian Jones, CEO at Swivel Secure Education institutions need to make cybersecurity a priority. Despite the sector facing major challenges such as a lack of staffing and a lack of funding and resources, cyber attacks are no less frequent or less severe in education. In fact, they seem to be gaining ground in prevalence year-on-year as instances of breaches in schools and higher education are widely reported. In recent years we’ve seen news of ransom attacks causing financial damage – like that on the University of Calgary where the institution allegedly handed over $20k to cybercriminals, and malware attacks causing mass disruption – similar to the disruption which, apparently, caused the Minnesota School District to shut down for a day while IT professionals rebuilt the system. The more worrying breaches are where student safety is compromised. Educational institutions are entrusted to safeguard their students, many of whom are minors, but a weak cybersecurity infrastructure can put them at risk. This was made all too clear when the CCTV in several schools in Blackpool was allegedly breached, and the footage reportedly live-streamed on the internet. It’s an unfortunate fact that, while cybersecurity in education is necessary to protect against financial loss and prevent disruption, it’s also crucial to protect students from harm. Which is why the sector needs to do everything it can to ensure their applications and systems are protected, and work to overcome any challenges. In this article, we’ll look at the current state of cybersecurity in education. We’ll discuss the most common reasons for attack, the highest threats and the main challenges facing the sector to help you understand why cybersecurity needs to be a priority, and how you can make it a priority for your educational institute. Why education is a target for cybercrime There are four key reasons why Education is a target for cybercriminals. With Education venues varying in size, purpose, and stature, the motives for attack can vary too. For example, what might be a common threat for world-renowned Universities/Colleges might not be an issue for schools or school districts. So, institutions need to evaluate the risk and understand what data is vulnerable to unauthorised access. DDoS attacks – Distributed Denial of Service, or DDoS attacks are a common type of attack on all levels of Education venue. This is where the attacker’s motive is to cause widespread disruption to the institute’s network, having a negative effect on productivity. This can be a relatively easy attack for amateur cybercriminals to carry out, especially if the target network is poorly protected. There have been instances of students or teachers successfully carrying out a DDoS attack, with motives ranging from simply wanting a day off, to protesting the way a complaint was handled. Data theft – This is another attack affecting all levels of education because all institutions hold student and staff data, including sensitive details like names and addresses. This type of information can be valuable to cybercriminals for several reasons, whether they plan to sell the information to a third party or use it as a bargaining tool and extort money. The concerning aspect of this type of attack is that hackers can go unnoticed for long periods of time. As was the case at Berkeley, where at least 160,000 medical records were allegedly stolen from University computers over a number of months. Financial gain – Another motive for hackers carrying out an attack on an education institution is for financial gain. This might not be as high a risk for public schools, but with private institutions and Universities/Colleges handling a large number of student fees, they’re a prime target for cybercriminals. Today, it’s usual for students or parents to pay fees via an online portal, often transferring large sums of money to cover a whole term or year of tuition. Without proper protection or preparation on the part of education institutions, this presents a weak spot for cybercriminals to intercept. Espionage – The fourth reason why education is a target for cybercrime is espionage. In the case of higher education institutes like Universities/Colleges, they’re often centres for research and hold valuable intellectual property. Universities/Colleges need to be suitably protected, as it’s thought that scientific, engineering and medical research by UK Universities has been previously compromised by hackers, and with plenty of time and money to fund them professionals are often at the helm of these attacks. With these four motives in mind, the way in which hackers carry out an attack on Education networks can further help us understand how to protect them. How education is targeted JISC’s 2018 Cybersecurity Posture Survey questioned IT professionals within further and higher education. They were asked to name the top cyber threats facing their institutions, and the top three answers give us insight into the most common ways Education networks are breached. Phishing – Phishing scams often take the form of an email or instant message and are designed to trick the user into trusting the source in a fraudulent attempt to access their credentials – whether that’s sensitive student data or confidential research. This type of attack is highlighted as the top threat facing higher education venues, suggesting hackers regularly target the sector using the method. Ransomware/Malware – Also in the top three cyber threats highlighted by the report, ransomware and malware attacks prevent users from accessing the network or files and cause disruption. More advanced forms of this threat can see attackers hold files to ransom. Ransomware or malware typically infects devices using a trojan, a file or attachment disguised to look legitimate. However, some ransomware (like the WannaCry attack) have been shown to travel between devices without user interaction. Lack of awareness – The third threat listed by professionals in both further and higher education is a lack of awareness or accidents. This could be on the part of staff or students who aren’t sufficiently trained to practice good cyber hygiene or accidentally compromise the network. Despite taking on different appearances,
Protecting Universities from Cyber Attacks
Cyber security is rated as one of the top concerns for organisations worldwide. As a global leader in the security technology industry, Gallagher is working with Universities all over the world to help them mitigate risk and secure their systems against potential attacks. In looking at the cyber risks that relate to Universities, there are three main areas of concern: protecting Intellectual Property (IP), protecting personal data, and protecting facilities and infrastructure. “A vulnerability in any of these areas is serious business for our University customers” says Richard Huison, Gallagher Regional Manager for UK & Europe. “A cyber attack that steals IP, particularly with regards to unproven and unpublished research, could have significant impact on a University’s bottom-line by preventing them from commercialising their findings later down the track” says Huison. Similarly, IP relating to teaching material and course work must also be protected against cyber-attacks. The introduction of online teaching means that students are no longer required on campus to learn, and material is therefore accessible by more people in more places than ever before. In order to continue to deliver their core service and maintain competitive edge, it’s important for Universities to protect their academic IP with strong cyber security measures. Universities hold massive amounts of personal data on current and past students and staff. That data encompasses a lot of personal information, including residential addresses, next of kin information, performance results/grades, and – in the case of students living on campus – medical notes which could involve details such as a mental healthcare plan. “A huge concern for Universities is the risk of personal data being accessed by unauthorised parties” says Huison. “It’s vital that staff and students feel their privacy is being managed and protected by their chosen University. We work very closely with our customers to ensure they understand and maintain the most-up-to-date technology and, therefore, have the greatest cyber resilience possible”. Gallagher’s intelligent data management uses industry-leading standards for data protection. End-to-end encryption with secure, encrypted SQL databases and end-to-end authentication are all part of the Gallagher solution. They provide system hardening and configuration advice, and their network of fully trained and certified installers ensure your system is as cyber-secure as possible on installation. In a world where cyber threats evolve daily, so too must our defences. If you would like to talk about your cyber security concerns call us on 02476 641234 or visit security.gallagher.com to find out more.