Education system under threat

Securing students, staff, and schooling to avoid data losses by Kev Eley, VP Sales Europe at LogRhythm

The education sector is a top target for threat actors. The high volume of personal information and research data stored by education institutions, coupled with limited security budgets and resources, makes this industry a prime target for cybercrime.

In the last year, 62% of higher education institutions reported experiencing security breaches or attacks at least weekly and 88% have been negatively impacted. After the recent attack on 14 schools across the UK which saw confidential information including student passport scans and SEN information leaked, schools cannot remain passive.

To safeguard sensitive information and avoid critical data exposures, education providers need to take proactive measures to build a strong cybersecurity defense. With ransomware attacks growing in sophistication and the education sector standing as an attractive target for threat actors, prioritizing cybersecurity efforts is imperative. The likelihood of an attack is a case of ‘when’ not ‘if’.

Hackers Hitting the High Marks

Cyberattacks against educational institutions are a threat because of the diverse and valuable data stored in educational networks. Threat actors have the choice of compromising a multitude of critical assets, including:

• Student information – Students’ registration details mean educational institutions are storing a great deal of personal data, such as name, date of birth and diversity information. This gives cybercriminals a wealth of information for identity theft.

• Financial information – Whether it belongs to students, staff or the institution, educational organizations store banking and credit information. Compromising this information could allow criminals to transfer funds, take over bank accounts or commit credit fraud.

• Research – Educational institutions are at risk of losing research accumulated over years in a cyberattack. In addition to damaging the organizations reputation, lost data can lead to legal action, the withdrawal of research funding, and loss of security clearances for sensitive material.

• Email access – Gaining access to an institution’s email servers offers cybercriminals a vector for further attacks on the network.

• Disruption – Distributed denial-ofservice (DDoS) attacks can disrupt or crash an organization’s servers by overwhelming them with more data than they can handle.

Under the best of circumstances, these challenges would be daunting, but educational organizations often face tight budgets and limited headcount, requiring them to do more with resources that don’t keep pace with demand.

With more education institutes exploring remote learning, the need to protect, defend, and respond to threats — regardless of where the user, data, systems, and applications sit — is more apparent than ever. They need to deploy an automation, cost efficient cybersecurity solution to overcome critical risks.

Putting Your Cybersecurity Strategy to The Test

In an era where no industry is safe from cyberattacks, educational institutions need to be putting the safety of student, staff, and school data first.

Without a clear, system-wide picture of network activity, a compromise can go undetected for weeks, months, or even longer.

Working harder isn’t the solution to the cybersecurity challenge in education. Too many security teams, often understaffed, suffer from alarm fatigue with event data flooding in from multiple sources on different interfaces.

By deploying a security information and event management (SIEM) solution, education institutes can monitor their environment to detect malicious activity and enable a rapid response. It can also deliver additional insights for other performance issues, such as remote access connection failures or missed scheduled software updates.

In addition to providing a holistic view of the network, SIEM simplifies and accelerates an organization’s ability to meet compliance goals and reduces the time needed to conduct audits. Reports can be generated in minutes, rather than days or weeks — freeing staff for other tasks. Network monitoring can even be deployed as a managed service, providing aroundthe-clock experts without the need for additional internal IT staff. This can help educational organizations where cybersecurity isn’t the primary budget focus and recruiting and retaining security professionals remains challenging.

SIEM solutions with added network detection and response (NDR) capabilities provide visibility across networks and notify users immediately when suspicious activity occurs. The best NDR solutions provide hybrid analytics that combine machine learning, rules-based detection, and threat intelligence to analyze network, user, and host activity for greater visibility into emerging threats.

External threats are not the only causes of data breaches. Whether it is an accidental data breach or a deliberate theft by an insider, user, and entity behavior analytics (UEBA) can be applied to staff to baseline patterns of normal network behavior, enabling quicker and more accurate responses to anomalous activity. An embedded UEBA solution provides deep visibility into user activity, helping detect insider threats, compromised accounts, privileged account abuse, and other user-based threats.

Beyond the deployment of comprehensive security tools, educational institutions can also arm themselves against threats by practicing and encouraging good cyber hygiene for both staff and students. One of the top risks that they should be educating online users on is phishing attacks. To check for this, users need to look for inconsistencies in the sender’s email address, spelling and grammar, abnormal file types, and any other signs that the email is unusual from those usually received.

Another aspect of good cyber hygiene is following best practice advice on generating and protecting passwords. Where possible, users should use a different password for each account, activate two factor authentication (2FA) on sensitive accounts, and use a password generator. Following these practices reduces the risk of accounts being compromised and data being stolen.

As the threat landscape grows more complex, the education sector must be ready to be proactive in detecting and mitigating risks. With the right tools and training in place, it can arm itself with the capabilities to level up its security posture with an intelligent approach.

The Lesson Learned

The cybersecurity challenges facing education institutions continue to increase and the cost of solving them can be daunting, however the potential financial and reputational risks that come with inadequate defense will cause an even bigger blow.

The education sector will find that effective cybersecurity solutions ultimately pay for themselves over the long term and enable institutions to focus on what matters – providing a safe and secure learning environment.

For further information please visit https://logrhythm.com