For years, we’ve watched on as news broke of data breaches and cyberattacks, often targeting (and sometimes, crippling) big businesses and government agencies. Fast-forward to now, and it’s not just the big players that are facing these threats, but just about everyone – including the education sector.
K-12 public and private schools alike are considered ‘soft targets’ by cyber hackers because of their basic cybersecurity strategies, and internal IT teams using limited resources. In fact, education is among the top three most breached sectors in Australia. Cyber threats against schools have grown so rapidly they have attracted the attention of the Australian government as it explores ways to combat the issue.
According to a 2020 IBM Education survey, nearly half of all K-12 and college educators reported they have not received basic cybersecurity training. With more than three-quarters of Australian teachers reporting they frequently or always permit students to use information and communications technology in the classroom, this is problematic.
Top cybersecurity threats facing educators
Cybersecurity threats come in many forms. Some of the cyber threats most detrimental to public education include:
Phishing
Phishing is a process used by hackers to try to obtain sensitive information by impersonating trustworthy entities in digital communications. It is popular amongst hackers and data thieves when targeting schools because it is so easy to pull off. There are three types of phishing scams focused on schools:
- Deceptive phishing scams use emails sent by what appears to be a legitimate source. The email may prompt a staff member or student to verify account information or take some other action that seems perfectly appropriate. Oftentimes, these emails are delivered with a sense of urgency, including warnings that failure to act will suspend access to a necessary account or service used for everyday learning purposes.
- Spear phishing is similar, only it tends to be more sophisticated. Emails sent as part of a spear phishing attempt may have some personal information, including name, position, and other professional credentials that lead educators to believe they are authentic.
- Administrator fraud is when an email is sent by a cyber attacker posing as a school principal or business manager. The emails are very convincing and may come from an email that is so close to the legitimate account that at a quick glance, faculty and staff do not question its legitimacy. They may willingly provide access to confidential information under this ruse.
Ransomware
Ransomware is malicious software that is inadvertently downloaded onto a school’s server that can essentially hold it hostage. Sometimes, cyber attacks deliver ransomware via phishing emails, tricking recipients into clicking on a link that secretly infects their device before moving on to the entire system..
School Devices
School devices and the prevalence of the BYOD (Bring Your Own Device) movement within schools increases vulnerability to cyberattacks. Principals and business managers trying to protect their school IT network face a tough job. They have to consider hundreds or thousands of student devices connecting to their Intranet every day. Security is key to ensuring this is not an added liability.
Why failing to keep things 'clean' could have dire consequences
What is the worst that can happen if you fail to keep your devices and servers ‘clean?’ The possibilities are not pretty. Security breaches that result in lost of corrupted data can easily lead to both above the surface and below the surface impacts.
Above the surface | Below the surface |
School data and student records breaches | Un-forecasted expenditure |
Hefty cyber security investments | Teaching and operational disruptions |
Public relations and crisis communication | Loss of community trust (parents, students, etc) |
Poor execution of rushed IT improvements | Reputational damage |
Vulnerability of school IP |
Implementing cyber ‘hygiene’ strategies to maintain school network and system health
According to Digital Guardian – Cyber hygiene is a reference to the practices and steps that people can take to maintain system health and improve their online security. It sounds a bit strange, but it is essentially the same approach you’d take to physical health.
Every day, you take a shower, brush your teeth and hair, and put on clean clothes before heading off into the world. In fact, we bet you have a regular hygiene routine. Think of cyber hygiene as a sort of personal grooming for your digital devices. Just like you benefit from having a regular hygienic routine, the same is true for computers and other digital devices. Why? Two distinct reasons: maintenance and security.
Maintenance helps keep computers and software running at peak performance. When software is not updated regularly and programs become outdated, schools increase their risk of becoming cyberattack targets. Your system quickly becomes a security liability. Conducting routine maintenance on your systems is the best way to uncover potential vulnerabilities before a cyber hacker exploits them.
Key cyber hygiene steps
Staying safe online is not impossible if you follow several key cyber hygiene practices. While many may think they’re adequately prepared for any cyber threats, it is impossible to implement proper cyber hygiene without the right tools for the job. Here are some of the must-haves for your school’s cyber hygiene toolbox:
- Antivirus/malware software installed and updated regularly
- Network firewalls
- Software updates performed regularly
- Use of multi-factor authentication to prevent unauthorised logins on your system
- Employing device encryption
- Backing up data frequently
- Securing your router
Protect your systems with proactive IT services
It’s much easier (and more cost-effective) to prevent a cyberattack than to deal with the aftermath. It’s one of the reasons proactive IT is so important. A secure and well-maintained system isn’t just going to protect you from the risk of security breaches. It will allow school IT and technology to operate at it’s best every single day.
You might not have IT expertise to ensure all the steps are followed and your systems are being protected. But you now have enough knowledge to talk to your IT provider about whether they’re taking a proactive and security-focused approach to their services.
At Step Fwd IT, we offer a proactive, top-down approach to IT and have worked with a number of schools to shield them against significant cybersecurity risks. We encourage principals and business managers to include cyber hygiene learning in their curriculums and within their awareness training modules for staff, and can work with your teams to create a strategy that is right for you.
Have you had a cyber checkup recently? Step Fwd IT is a preferred IT partner to many private schools in Victoria including Salesian College, Kilbreda and St Josephs. See how our end-to-end solutions can support your school and performance.
Call Us!
We’d love for you to give us a call – whether you just want to have a chat or book a consultation we’re always here to help.
Book a Consultation in our Calendar!
There are a multitude of ways we can arrange a consultation, including Video Meetings and On-site Appointments.
Send us an Email!
Whether it relates to an initial consultation or any of your IT needs, if you need a hand our email inbox will be open.