Schools Facing Severe Level Of Cybersecurity Risk
What makes education institutions around the world the perfect target for cybercrime and how can they defend themselves? In this three-part series, we explore the threats, analyze why they exist, and offer advice on practical measures for protecting against them.
It’s a cliché that if you want to solve a computer problem, ask a kid. But as with most clichés there’s some truth to it. The young are proving particularly adept at mastering, and innovating in, information and communications technologies.
Now imagine a sector populated by the young and you can see one reason why universities and colleges are proving particularly vulnerable to data breaches. In fact, education is the third most breached sector after healthcare and business services accounting for 10 percent of all data breaches, according to cyber security company Symantec’s 2016 Internet Security Threat Report.
Around half of breaches are ranked as low risk, mainly cases of data being accidentally exposed—e.g. inadvertently sharing information with the wrong person. Once these lower-risk cases are stripped out, however, education still comes in as the fifth most breached sector in Symantec’s report.
These remaining high-risk cases are instances where data is deliberately compromised either through malevolent insiders or by hackers. The damage they cause has various levels of severity from disruption or vandalism through deletion or falsification of records to extortion or espionage.
According to research published in March by cloud infrastructure provider VMware, UK universities in particular are facing a severe and growing level of cybersecurity risk. In a survey conducted by the company of IT decision makers at fifty academic institutions, more than a third said that they face at least one cyber attack each hour and 83 percent said that they think the situation is worsening, both in terms of frequency and sophistication.
Furthermore, a quarter of these IT decision makers admitted to having had critical intellectual property infiltrated, including highly confidential and valuable data about national defense, social, economic, and medical research. And two in five confirmed that they have had student work infiltrated, including dissertation materials and exam results.
One type of cyber attack which is rising at a particularly fast pace in education, is that of ransomware.
According to endpoint security company SentinelOne, at least two thirds of British universities were victims of ransomware demands in the year to July 2016. One school, Bournemouth University, was the victim of no fewer than 21 ransomware attacks.
And of course, it’s not just a problem for British universities.
Universities are usually very guarded about releasing information about ransom payments but both Queen’s University in Belfast and the University of Calgary have admitted to making such payments, ranging from a few hundred dollars in the case of the Irish university to over $15,000 at the Canadian one.
So, who are perpetrating these acts?
Perhaps not so surprisingly, many threats to educational institutions are internal, with more than six in 10 surveyed by VMware claiming their own students pose a threat to data. There have been a number of reports of students hacking registrar databases to change their grades. But they are not the only threat nor the greatest.
All of the respondents to the SentinelOne survey reporting they had suffered from a ransomware attack, also indicated that they were using up-to-date antivirus software. And nearly two thirds of the respondents to the VMware survey said they do not believe that their existing IT infrastructure will be sufficient in protecting against cyber attacks in next 12 to18 months.
The education sector has arrived at a critical point in terms of needing to address its cybersecurity concerns. All involved agree, something needs to be done and soon.
In the next installment of this three-part series, we will look at what makes the educational sector particularly vulnerable to cyberattacks, and in the final instalment we will look at what measures universities and other academic institutions can take to better protect themselves.
All Posts In This Series