Safeguarding sensitive data in education

As cyber-attacks become more prominent, so too do the risks faced by the educational institutions. Whilst not a cash-rich target, education facilities hold a treasure trove of individuals’ personal and financial data. Over the past year alone there have been numerous crippling disruptions and closures of schools and universities attributed to malicious attacks on digital infrastructure. The University of Nottingham fell victim recently and used the resulting exposure to highlight the growing pressure on the education sector.

“The university highlighted that cyber attacks on its institutions are becoming increasingly common “as criminals target educational establishments with no regard to the disruption to teaching and learning such attacks cause.” University of Northampton hit by cyber attack, ITPro

It’s now clearer than ever that proactive measures must be taken within education to secure our systems against further disruption or worse, but squeezed budgets are making it difficult. We explore the 4 steps the education sector can take:

#1 Create a secure environment

Organisations must create a secure environment to protect against any cyber-attack. This includes having effective access control systems in place to prevent malicious actors from accessing sensitive data or networks. This can be hindered by the security weaknesses in EdTech providers’ products and systems.

The education sector must make best use of the security built into technology. This also means that the technology and digital services need to be set up and managed correctly. Making sure patches are updated is just a small thing but can often be overlooked. Regardless of the iinherent weaknesses, tech supplied must be frequently updated, and patches to vulnerabilities need to be implemented as quickly as possible. There should be better processes for reporting vulnerabilities and patches released timely, with strong communication as and when they are available.

Whilst not in the education sector, one famous lesson to learn from is the 2017 NHS attack. Outdated software from 2015 allowed hackers to access the system resulting in 19,500 medical appointments being cancelled, 600 GP surgeries computers being locked and five hospitals diverting ambulances elsewhere. Media reported that it “could have avoided the crippling effects of the “relatively unsophisticated” WannaCry ransomware outbreak in May with “basic IT security”, according to an independent investigation into the cyber-attack.”

#2 Keeping up to date with the threat landscape

The Government strategy clearly stresses the obligation individual organizations have to understand the risks they face. Without a thorough understanding, it’s tough to strategically use the resources available to maximize security and safety. But with this proactive approach, organisations can identify malicious activity before it causes irrevocable damage.

Individual education institutions need to be able to prove they understand the current threat landscape. This not only includes monitoring the threats but also having an appropriate response to them.

Sparing the resource for this amid a skill shortage can be tough. When budget and manpower are short, there is a cost-effective alternative: partner with a cyber security vendor that has built-in cyber intelligence monitoring and sharing mechanisms.

For example, Censornet ASE comes pre-integrated with multiple world-class industry-leading threat intelligence feeds. ASE is updated 24×7 to automatically protect against new threat actors, without analyst or SecOps involvement.

#3 Prioritise data security

The educations sector, just like any organisation, has a “responsibility to protect data” and needs to ensure that “data protection and security is at the heart of its approach”. And if they don’t, the consequences can be tough, even with the potential of a reduced fine.

When the Department for Education (DfE) escaped a monetary penalty for its school pupils’ learning records used by gambling companies to conduct age-verification checks that would normally result in a £10m fine, there were still major reputational consequences. More often than not, a education breach is not only a reputational issue, but can cause real issues in the ability of organisations to deliver crucial frontline services.

But protecting data is especially tough in a hybrid working environment. It complicates data protection even further. A recent report from Gartner sets out the five steps to preventing data loss with remote workers:

1. Create or evolve existing remote working policies to give yourself a solid foundation
2. Set your employees up for success by providing Security Awareness Training
3. Don’t forget about securing physical environments
4. Evaluate workstation setup for things like USBs and BYOB (bring your own device)
5. Make the most of Data Loss Prevention tools

These five steps are important whether your workers are remote, hybrid or office based. Making data security a priority is no longer an option. Every organisation needs to protect their data – and the public sector is no exception.

#4 Harness emerging technologies

Whilst the tools used by cyber-criminals are evolving, so too are the technologies organisations can use to protect themselves.

There is a big difference between AI and automation. Automated security products that mechanically perform simple jobs fail to identify and detect unknown threats. For an effective, proactive security posture, products must be able to respond to the unknown. This is where autonomous security excels, responding to unknown threats without the need for human intervention,

By having a platform which tightly integrates AI protection across the major attack surface, businesses are also protected against multi-channel attacks: those that start in one channel (for example, an email phishing attack), but spread to either web or cloud applications.

Gartner estimates that by 2025, 80% of enterprises will have adopted a strategy to unify web, cloud services and private application access from a single vendor’s security platform. Not only is this more cost-effective than paying for multiple security products and staff, but it enables organisations to ensure hackers don’t slip through the cracks in their defences and support the well-being of security teams.

Preventing cyber attacks

The education sector is by no means immune to cyber-attacks and must take proactive steps to protect itself. By leveraging emerging technologies such as AI, automated security platforms, threat intelligence sharing and data loss prevention tools, organisations can stay ahead of the curve and respond quickly to new threats whilst still working within tight budgets. Prioritising data security, investing in the right technology and partnering with a cyber security vendor that has built-in cyber intelligence monitoring capabilities can help educational institutions remain secure against today’s increasingly sophisticated attackers.