Educational institutions have become attractive targets for cyberattacks. In September, the FBI warned that hackers are increasingly targeting education technology (EdTech) in attempts to steal student data. Additionally, Kaspersky Lab recently reported a spike in distributed denial of service attacks aimed at schools, while the Department of Education has warned of an increase in ransomware attacks targeting schools.
Analysts say education is now the third most hacked sector, behind healthcare and retail. Schools are compelling targets due to the large amount of personally identifiable information stored in their computer systems. This includes Social Security numbers, addresses, medical information and financial information.
Another reason for the spike is that is that K-12 school districts are notoriously behind the curve when it comes to cybersecurity. Technology is evolving at a rapid pace, as are security threats. With school budgets already stretched, most districts lack the funding, manpower and expertise to make continual improvements to network security.
The education industry scored a dismal grade of D in overall security posture, according to the 2017 Global Cybersecurity Assurance Report Card compiled each year by Tenable Network Security. With a grade of 64, the sector scored lower than all other sectors other than government.
These security weaknesses are being exacerbated with the increased use of EdTech connected to networked devices, according to the FBI. Improperly secured take-home devices such as tablets and laptops and networked school security devices such as surveillance cameras are particularly vulnerable.
The FBI says cyber threat actors hacked into multiple school district servers across the U.S. in late 2017, accessing student contact information, education plans, homework assignments, medical records and counselor reports. Often, that information was used to contact, extort, and threaten students with physical violence and release of their personal information.
While budget issues make network security a challenge in most schools, the threat of ransomware attacks and data breaches can’t be ignored. The Department of Education recommends that school districts take the following steps the mitigate risk:
Develop policies on responsible use of school networks and systems, and regularly educate students, teachers and staff about those policies. IT staff should also be aware of all local, state and federal regulations about security, privacy and the storage of personally identifiable information.
Implement strong data protection practices to ensure data privacy and compliance with the Family Educational Rights and Privacy Act (FERPA). Particular attention should be paid to the use of cloud-based services and applications that could expose personal data.
Use firewalls and identity management tools to manage user credentials and control access to IT resources. The best of these tools further enhance security by bundling user provisioning, password management, strong authentication, single sign-on and other technologies into a comprehensive platform.
Monitor networks continually to collect data and report on security systems such as firewalls and virus scanners. This will help schools recognize and quickly remediate problems with security resources.
IT staff should also make sure they are taking other basic security precautions such as making sure browsers are updated and malware-blocking controls are activated. Beyond that, getting a third-party security assessment from a reputable service provider can be an extremely cost-effective measure. Security experts at IPC can work with your IT team to identify vulnerabilities, update systems and plug security holes.