In an era where technology plays a central role in education, the sector continues to face an on-going threat - cyberattacks. These attacks are not only a breach of data security, but also a threat to the smooth functioning of our schools. With the return to school in September, news reports indicate a sudden flurry of attacks. In this article, we will discuss some recent cyberattacks impacting schools and outline essential steps for school leaders to protect their establishments in preparation for cyber security month.
The Growing Threat
Recent years have seen growth in cyberattacks targeting schools across the UK. These attacks vary in nature, from ransomware attacks crippling critical systems to data breaches compromising sensitive student and staff information. The National Center for Cyber Security (NCSC) highlighted the growth of ransomware attacks in 2021. This was followed by a further warning from the Department for Education (DfE) and the subsequent release of the Cyber security standards for schools and colleges by the DfE. The motive behind these attacks can range from financial gain to malicious intent, but the impact on educational institutions is consistently disruptive. It’s important to recognise that education establishments have large databases of sensitive and personal data that is highly attractive to criminals. Unfortunately, the risks of cyber-attacks are not going away, and we have to understand that attackers will only need to succeed once. The first step in protecting your establishment is recognising that this is necessary and finding the resources to prioritise this.
Understanding the Risks
- Ransomware Attacks: Cybercriminals often deploy ransomware to encrypt essential data, demanding a ransom in exchange for the decryption key. Paying the ransom is not recommended as it funds criminal activities and doesn't guarantee data recovery.
- Phishing: Phishing emails, often disguised as legitimate communication, aim to trick staff or students into revealing sensitive information or downloading malware. Education professionals should be educated about identifying and reporting phishing attempts.
- Data Breaches: The exposure of personal data can lead to identity theft and other serious consequences. Schools must implement strong data protection measures, including encryption and access controls.
Recent Incidents
In September 2023 reports emerged of a string of attacks affecting a number of schools. Here’s what we know about the attacks:
Some of the incidents suggested that computer facilities went offline, ransomware impacted daily functions, email systems and phone lines were attacked, police were notified, and letters were sent home to parents. In some cases there was no evidence of data being lost, but in other cases recovery is expected to take weeks. Either way, attacks had a significant impact on the schools in question.
Protecting Your School
- Invest in Cybersecurity: Allocate resources for robust cybersecurity infrastructure, including firewalls, antivirus software, and intrusion detection systems.
- Regular Updates and Patch Management: Ensure that all software and systems are regularly updated with the latest security patches.
- Employee Training: Conduct cybersecurity awareness training for staff and students to recognise and respond to threats effectively. Verify the training is effective by running simulations or table top exercises.
- Backup Data: Regularly back up critical data to secure offsite locations to protect against data loss in the event of a ransomware attack.
- Incident Response Plan: Develop a clear incident response plan that outlines steps to take in case of a cyberattack. Ensure all staff members are aware of this plan.
- Collaboration: Collaborate with other schools and law enforcement agencies to stay informed about the latest threats and share best practices.
Cyberattacks on schools in the UK are a growing concern, but with proactive measures and a commitment to cybersecurity, school leaders can protect their establishments and the personal data of students and staff. By staying informed, investing in robust defences, and fostering a culture of cybersecurity awareness, schools can minimise the risk and impact of cyber threats.
It's time to take action to secure the future of education in the digital age, and with the right support and approach we know that schools can do this.
To find a variety of effective support and guidance please visit our Information Security & Data Protection page.
