Why now is the time for education to focus on cybersecurity

Schools and colleges do a great job of protecting their students, staff and facilities with appropriate physical security. But the recent — and rapid — transformation to remote teaching and learning have delivered a cybersecurity wake-up call for many schools.

It’s been a challenging time for schools and colleges as pandemic-related measures forced them to pivot to remote teaching and learning. In the past, schools generally knew exactly who was connecting to their network. They were in control of the relatively small number of users who were authorised to connect and could easily recognise unauthorised attempts.

But the swift transition to home-based operations meant that hundreds or thousands of remote users suddenly needed to connect to a school’s network to access teaching and learning resources. Unless schools provided laptops or other devices or had a mature ‘bring your own device’ policy, they found themselves supporting users connecting from a variety of unknown devices running different operating systems with varying patch levels.

What’s more, most users were connecting from home networks. A home network typically supports multiple household users and a myriad of devices; and will often be relatively insecure. So, there is always the risk of malware entering a home network and moving to the school network.

Of course, cyber attackers are always ready to take advantage of any new or chaotic situation, and many will have seen schools as easy targets during this time. Individuals unused to working digitally may have unwittingly fallen prey to phishing attacks that can lead to credential misuse or ransomware attacks.

Teachers may have adopted free software or services that could introduce malware or put the school at risk of theft or unauthorised disclosure of student records and other sensitive information. And tech-savvy students may even have been tempted to try their hand at hacking.

8 tips for securing your network

Schools and colleges that had already secured their networks, or moved quickly to do so, were well placed to guard against cyber threats — and protect their staff and students, their sensitive information and, by extension, their reputation.

Best-practice approaches to school network security include:

1. Standard controls. Make sure you have a basic framework in place with capabilities such as intrusion detection and prevention, application firewalls, content filtering, email security, antivirus, and data loss prevention.
2. Network and data monitoring tools. Have your in-house tech team or a service provider use these tools to identify malicious activity.
3. Vulnerability scanning. Do this regularly to prevent exploits on documented vulnerabilities.
4. Network segmentation. You could, for example, create separate network segments for students, staff, and critical and sensitive data. This helps ensure that, in the event of a cyberattack affecting one network segment, the others remain untouched.
5. Security awareness training. This should include educating staff (and students) to recognise phishing techniques and avoid clicking on links and attachments in emails from unknown senders.
6. Least privilege policy. Ensuring no-one has more access privileges than they need to perform their role helps prevent privilege escalation that allows an attacker to move through the network and cause damage or steal data.
7. Password management. A single sign-on or similar solution will help users maintain unique and complex passwords for logging in to an increasing number of apps and services.
8. Vendor management. If you use third-party software or online platforms, make sure you understand the vendors’ security posture. This includes their processes around incident response and data breaches, data encryption practices, uptime SLAs, and how recently they’ve undergone a security audit.

Heading into the ‘new normal’

Even as schools and colleges have reopened and staff and students are back in the physical classroom, investing in network security will help you avoid the high price of a privacy violation or loss of confidential data. And given that we’re still living through uncertain times, it pays to be ready to support a return to safe, secure remote teaching and learning at any moment.

David Copping, Schools Team Manager at Konica Minolta Business Solutions (UK)