Three ways schools can protect against cyber-attacks

With the percentage of schools reporting cyber breaches having risen by double-digits in 2022, it is more important than ever that they implement strategies to protect their students’ data. Experts from management consultancy BIP have highlighted three ways in which educational institutions can guard against cyber-attacks in the years ahead.

With the pandemic having forced schools and colleges to rapidly expand their digital offerings, helping students access lessons and materials remotely, the risk of cyber breaches has also increased. Hackers are increasingly targeting schools in the hope of finding weaknesses in their hastily-rolled-out digital services; illustrated by a 20% rise in cyber-attacks, year on year.

In 2022, 70% of secondary schools said they had been the victim of cyber breaches and attacks – leaping from 58% in 2021. Incidents involving ransomware can lead to the loss of school finance records, coursework and other personal data.

David Royal, partner and co-lead of BIP’s Public Sector practice, commented, “The shift to online learning following the pandemic has been critical in UK schools and colleges further embracing technology. The move to digital means better information sharing, remote access to crucial information, and improved engagement from students, but it has also made schools more vulnerable. 

But this is not the only way in which school systems are vulnerable to breaches. Recently, John Taylor High School in Barton under Needwood, Staffordshire made headlines when it mistakenly shared the A-level results of all its students in an email. The breach of students’ data was followed by another email from the schools headteacher shortly after, urging recipients to delete the earlier release.

After a sustained period of cuts to funding, many schools have limited resources making access to expertise for IT and cyber security hard to come by. In turn, this makes them more vulnerable to the infiltration of networks, or even accidental leaks. So what can they do to better secure their data? According to BIP, there are three key areas that schools need to focus. 

Identify relevant prevention measures

As the popular truism would have it, prevention is always better than a cure. A growing body of evidence suggests that cyber-attacks are now an inevitable reality of life for any group which is connected to the internet – and there are very few organisations which can afford not to be. Indeed, schools increasingly rely on digital means to distribute materials, and this has led the broader education sector to experience a 44% increase in cyber-attacks last year, with an average of 2,297 attacks against organisations every week, according to data from research firm Check Point.  

BIP’s experts suggest that the move to cloud storage has left some schools especially vulnerable, as they must update unsupported software and regularly enhance their security systems as protection measures. As such, they need to start the ball rolling on preventative plans sooner rather than later. This includes “implementing multi-authentication firewalls, patching data, introducing admin credential vaulting, and backing up critical data can effectively reinforce defence lines”, while also performing maturity assessments to reveal weaknesses within systems and help prioritise areas of concern.

Have a plan of action 

Every school has a fire drill; a thought-out plan of action to safely evacuate the building in the event of an emergency. In the digital age, where a few seconds can be the difference between a minor inconvenience and disaster, they must now also have a planned and rehearsed response in preparation for a breach. While the extent they can do this depends on the budget available, this can be done through cyber handbooks and regular cyber awareness training for staff to reduce the risk of an attack. It’s also important to practice using a combination of monitoring tools, such as Managed Detection and Response (MDR) and Extended Detection and Response (XDR) systems, so they can be swiftly implemented in the event of a breach.

BIP further explained, “When an organisation is infiltrated, groups often target emails to take down communication and freeze business activity for maximum disruption. To safeguard against this, schools must maintain a backup system for communication and ensure that email security practices are implemented. For instance, a social media channel or a siloed alert system can be used to continue services where possible.”

Ensure an effective recovery strategy

 Cyber-attacks affect every organisation differently. Therefore, schools and colleges cannot rely on a one-size-fits-all recovery plan from another institution when they get attacked. Instead, they should tailor a cyber incident response plan, which assigns responsibilities to teams and clearly outline the steps each individual must take to recover as painlessly as possible. The plan should include having secure backup systems, and alternatives to critical processes that would otherwise be compromised in the event of an attack so that operations can continue as normal.

The consultants also noted, “Schools must also install a cyber recovery system in order to rebuild the sensitive data they may have lost and should enlist an expert to help rebuild it if necessary. Once the immediate impacts have been addressed, identifying the reasons for the attack can be established via official investigations and a data recovery service. A third-party organisation can help establish the root cause, pinpoint the lessons learned, and establish a plan to address this going forward.”

Further support

Founded in 2003 BIP is one of the fastest growing consultancies in the world, with 5,000+ people across Italy, Great Britain, Spain, Turkey, Brazil, Belgium, Switzerland, Austria, the United States, United Arab Emirates, Chile, and Colombia. Operating at the intersection of business and technology, the firm designs, develops, and delivers innovative transformations at pace and scale, creating greater value for customers, employees, shareholders, and society for the long term. 

Royal added, “2023 has already seen a huge number of high-profile cyberattacks; clearly, schools are not immune either. Greater collaboration is needed between the government, the education sector, and third-party experts to ensure schools have the tools, knowledge and funding required to protect their organisations and the students they support.”