Why the education sector needs to do the homework on cybersecurity as attacks soar

Keiron Holyome, VP UKI & Emerging Markets at BlackBerry, explains why the threat environment for educational institutions is rapidly expanding in 2024. He offers advice on the steps the sector can take to defend itself, particularly as AI continues to reshape the cybersecurity landscape. 

2024 has seen reports of ransomware and cyber intrusion across the education sector become disturbingly more routine. In April, a government report found that 86% of further education colleges in the UK identified a breach or attack in the past year. For higher education institutions with especially sensitive data, the threat was shown to be even greater – with 97% identifying an attack in the last 12 months.

Education is an especially high-risk sector as universities and schools often present hackers with an easy target. IT support is often limited, budgets are tight, and many use standard software provided to the sector. If a vulnerability is found in that software, it won’t take long for the criminals to find it and exploit it.

The risk is also higher post-pandemic given that the threat environment for most universities has rapidly expanded over recent years to embrace remote learning. Students now utilise apps, mobile devices, and a host of other connected learning technologies. More connections with often-unsecured devices owned by students themselves dramatically expand the surface area for attack. As these threats increase in scale and sophistication, educators will need take a proactive approach to securing their data to maintain a bright future for the nation’s academic community.

The more sensitive the data, the higher the risk of attack

Universities are gathering and preserving huge volumes of sensitive data in 2024. From financial transactions to exam results to personal student information and health records, the implications of a breach could be incredibly detrimental if leaked.

Malicious actors might not only benefit from a ransomware payment to restore access to IT operations. They can also sell identity and financial information to the highest bidders on the dark web, extort further money through blackmail of individuals and their families, or threaten to expose suppliers’ data. And unfortunately, educational institutions such as schools and universities are all too often an unprotected ‘soft target’.

High value data and poor IT infrastructure create the perfect storm for hackers

Across the education sector, IT support is often limited due to financial constraints, with the same standardised software being utilised across multiple sites. Criminals only need to identify one weakness in that software, and they have an entire IT ecosystem, as well as reams of data across multiple locations, at their mercy.

Schools and universities are already prime targets for hackers but have become even more appealing in 2024, with threat environments across most institutions continuing to expand. With many students now preferring to utilise their own personal tablets, laptops, and other devices to complete coursework, there are more connections across unsecured devices than ever before.

But the main reason that schools are a soft target boils down to culture. Other industries, such as finance, healthcare, or retail, that also deal with people and their personal information, are heavily regulated when it comes to privacy and data protection. They invest in their technology backbone as a competitive advantage and know their reputation is directly linked to their ability to keep private information safe.

Schools don’t necessarily want to embrace such stringent measures. They don’t want web filters to block research or surveillance to curtail creativity. They want the freedom to move files around departments and establishments to provide a collaborative learning environment for continued education that also supports and is supported by external services.

Educating students about sophisticated phishing scams

The widespread adoption of Generative AI is also making common indicators of phishing scams such as spelling errors and poor English a thing of the past. Clues are increasingly difficult for students to spot, especially with the advent of deepfake video recordings, flawless emails, and personalised offers. In an organisation, employees may be the weakest link in an enterprise’s cybersecurity chain but are typically subject to rigorous training. This isn’t as easy to impose among students, who are traditionally more susceptible to attractive phishing lures.

With the value of the data high and the walls paper thin, hackers have all the incentive they need to mount an attack. And, more often than not, schools are willing to pay the ransom.

In 2024, AI-enabled cybersecurity will become a ‘must-have’, not a ‘nice-to-have’

AIis already – and will continue – reshaping the way that cybercriminals develop more specialised skills, more successful phishing attacks, and create more effective malware. As the maturity of generative technologies and the hackers’ experience of putting them to use progress, it will get more and more difficult for educational institutions to raise cybersecurity defences without deploying technology that uses AI in the fight against AI. Schools and universities can no longer cross their fingers and hope that they won’t be targeted.

Creating and implementing a new cybersecurity strategy might seem daunting, but educational institutions don’t need to figure everything out on their own. Schools and universities can deploy a Managed Security Service Provider to deploy endpoint protection solutions or subscribe to a 24/7 externally monitored service called XDR (Extended Detection and Response). Such technologies enable educational institutions to access enterprise-grade solutions as well as advice from cyber experts that are available 24/7, while keeping costs to a minimum. Automated, AI powered cybersecurity solutions can also be a huge help in addressing the challenge of tight budgets and limited resources.

Safeguarding learning in the future

It’s clear that compromises to education software hit at the very heart of communities. When vital services go offline, valuable learning time is wasted, and sensitive details are exposed for criminal use. But if schools and universities do the homework now, they can start to power defence with AI and secure out-of-band communications to ensure threat actors aren’t able to create the disruption they seek.

By Keiron Holyome, VP UKI & Emerging Markets, BlackBerry Cybersecurity