Attacks on the education sector are surging: How can cyber-defenders respond?

Data from ESET reveals that sophisticated APT groups are increasingly targeting educational institutions worldwide. Between April and September 2024, the sector ranked as one of the three most frequently attacked areas by China-aligned APT groups, and the leading target for North Korean actors.

Academic institutions attract cybercriminals due to their distinct vulnerabilities. However, implementing universal cybersecurity best practices can mitigate these risks effectively.

Why Are Schools and Colleges Prime Targets for Cyber Attacks?

In the UK, a concerning 71% of secondary schools and 97% of universities reported serious security breaches within the past year, compared to only 50% of businesses, as per government statistics. In the U.S., the K12 Security Information Exchange (SIX) reports that from 2016 to 2022, more than one cyber-incident per school day was recorded.

Several factors contribute to the prevalence of cyberattacks on educational institutions:

• Budget Constraints: Educational institutions often struggle with limited budgets, making it difficult to hire skilled cybersecurity personnel or invest in robust security tools. As a result, these deficiencies expose them to increased cyber threats.
• BYOD Policies: Many schools have Bring Your Own Device (BYOD) policies. This trend can create vulnerabilities if personal devices connecting to school networks lack proper security measures.
• Human Element: The sheer number of students and staff makes educational environments rich targets for phishing and social engineering attacks. Training staff and students on security awareness is crucial; however, in the UK, only 5% of universities mandate such training for students.
• Open Culture: The culture of openness in educational institutions can compromise security protocols. While collaboration is essential, it invites risks that require tighter controls, particularly regarding email communications and interactions with external parties.
• Expanded Attack Surface: The growing use of virtual learning and remote work has broadened the attack surface for educational institutions. Cybercriminals often exploit legacy systems that may be unpatched and vulnerable.
• Attractive Data: Educational institutions hold vast amounts of personally identifiable information (PII) and sensitive research data. This information is appealing to cybercriminals seeking financial gain or state-sponsored espionage.

The Growing Cyber Threat Landscape

The dangers posed to educational systems are significant and escalating. K12 SIX has recorded 1,331 publicly disclosed cyber incidents in U.S. school districts since 2016, while the EU’s ENISA reported over 300 incidents in the education sector from July 2023 to June 2024. The incidents often lead to catastrophic outcomes for universities, including substantial financial losses and reputational damage.

Common Tactics Employed by Cybercriminals in the Education Sector

Cyberattack tactics employed by threat actors vary based on their objectives. Highly sophisticated state-backed actors, such as the Iranian group Ballistic Bobcat (also known as APT35), utilize methods like injecting malicious code into legitimate processes to evade detection.

In the UK, ransomware is considered the top cyber threat to the education sector. Similarly, the U.S. Department of Homeland Security identifies K-12 districts as frequent ransomware targets, primarily due to their financial constraints and lack of dedicated cybersecurity resources.

The significant attack surface, characterized by a plethora of devices and users, poses challenges for maintaining security. Notably, Microsoft has highlighted an alarming rise in QR code-based phishing campaigns—malicious codes embedded in emails and official communications that can trick users into providing sensitive data.

Essential Strategies for Mitigating Cyber Risks

While several factors make educational institutions attractive targets for cybercriminals, the methods they employ are not novel. Therefore, implementing tried-and-true cybersecurity strategies is essential. Consider these effective measures:

• Use strong, unique passwords, and enforce multi-factor authentication (MFA) for account protection.
• Practice good cyber hygiene through timely software updates, regular backups, and robust data encryption.
• Establish and routinely test a comprehensive incident response plan to swiftly address breaches and minimize damage.
• Educate staff and students about cybersecurity best practices, including identifying phishing attempts.
• Provide clear BYOD policies to students outlining necessary security measures for personal devices connecting to school networks.
• Collaborate with a trusted cybersecurity vendor to safeguard endpoints, data, and intellectual property.
• Implement managed detection and response (MDR) services for 24/7 monitoring of potential threats.

Ignoring the cyber threat landscape can lead to catastrophic repercussions for educational institutions, from severe financial losses to irreparable reputational damage. In an age where cybersecurity is as critical as ever, institutions must prioritize these strategies to ensure they can offer an uninterrupted quality education.

Read the original article