Wednesday 13th July 2022

BLOG: Why Cybersecurity Needs To Be A Priority For The Education Sector

Despite the development of many cyber security measures that can aid in protecting the educational sector, the threat seems more prevalent than ever. Cybercrime has always had a powerful impact on the UK threat landscape and also worldwide. The annual damage to Britain’s economy is estimated to be £27 billion and this goes as far back as 2011 according to government figures, last year FE News placed the average cost of a cyber attack against educational sector at £620,000.

Educational institutions need to make cybersecurity a priority, especially with the prevalence of cyber-attacks year on year as instances of breaches in schools and higher education are widely reported.

In recent years we’ve seen news of ransom attacks causing financial damage like that on the University of Calgary where the institution allegedly handed over $20,000 to cybercriminals, and malware attacks causing mass disruption.

Last year The Harris Federation, which runs 50 primary and secondary academies in and around London. Data on the systems has been encrypted and hidden by cyber attackers. Ransomware gang REvil was thought to be responsible for the cyber-attack and it appears that the REvil group is in possession of the trust’s personal information, including financial records, and has made this information available on the dark web.

There was also the recent discovery that saw about 10,000 Deakin University students have been embroiled in a cyber attack after a hacker gained access to the institution’s internal systems and targeted individuals with scam text messages and additionally.

Deakin University said on Sunday 10 July was when they were aware of the incident. The nefarious character downloaded the contact details of 46,980 current and past students including their names, student IDs, mobile numbers, Deakin email addresses and even recent unit results. The method of the cybercriminal was using SMS.

These texts were sent to 9,997 students and came about after a staff member’s username and password were obtained by a hacker and used to access information held by a third-party provider engaged by Deakin to forward messages prepared by the University to students by SMS.

Deakin University stated that anyone who clicked on the link was then taken to a form which asked for additional information, including credit card details. The university took immediate action to stop any further SMS messages being sent to students and immediately launched an investigation into the data breach. Deakin continues to investigate the incident and is working with a third-party provider to ensure security protocols are enhanced to prevent any recurrence of this breach.

The more worrying breaches are where student safety is compromised. Educational institutions are entrusted to safeguard their students, many of whom are minors, but a weak cybersecurity infrastructure can put them at risk.

There are numerous reasons why the educational sector is a target for cybercriminals. Education varies in size, purpose, and stature and this means the motives for cyber-attacks can vary also. For example, what might be a common threat for world-renowned Universities/Colleges might not be an issue for primary schools or secondary schools. So, institutions need to evaluate the risk and understand what data is vulnerable to unauthorized access.

DDoS attacks can be relatively easy cyberattack for amateur cyber criminals to carry out, especially if the target network is poorly protected. They are a common type of attack on all levels of Education venues. This is where the attacker’s motive is to cause widespread disruption to the institute’s network, having a negative effect on productivity. There have been instances of students or teachers successfully carrying out a DDoS attack.

Data theft is another attack affecting all levels of education because all institutions hold student and staff data, including sensitive details like names and addresses. This type of information can be valuable to cybercriminals for several reasons, whether they plan to sell the information to a third party or use it as a bargaining tool and extort money. The concerning aspect of this type of attack is that hackers can go unnoticed for long periods of time.

Financial gain is a common motive for all threat actors carrying out cyber-attacks, whether in education or any of sector. The risk may not be as greater for public schools, but with private institutions and University type institutions that are handling many student fees, finance or tuition tend to be prime targets. Without proper protection or preparation on the part of educational institutions, this presents a weak spot for cybercriminals to intercept.

Espionage is rarely a reason as to why the educational institute is a target for cybercrime, but it is not unheard of nor is it safe to completely rule it out as a reason. Espionage would most likely happen in higher education institutes like Universities or Colleges as they are often centres for research and hold valuable intellectual property. The educational sector needs to be suitably protected.

With the increasing frequency and potential severity of cyberattacks posed to the Education sector, it is important that the education sector should focus its efforts on minimising the risk of a cyberattack, rather than a reactive attitude after one has happened.

To understand how Orpheus Cyber can protect your network, click here.

Get our latest cyber intelligence insights straight into your inbox

Fill out the short form below to subscribe to our newsletter so that you never miss out on our cyber intelligence insights and news.