The shift to remote learning and hybrid work was already becoming common before the COVID-19 pandemic completely changed how schools operate. When students are learning from home or school staff is working out of the office, technology is crucial to maintaining day-to-day routines. Unfortunately, just as schools have learned to adapt and use technology to handle this new normal, so have cybercriminals.
TechTarget partners with SearchSecurity to educate people on security industry knowledge. Their purpose is to explore topics and best practices on issues like data security and strategies, threat detection, network security, and web security tools. TechTarget recently published an article about the increasing amount of cybersecurity threats and attacks schools are experiencing. Here are some of the key takeaways:
Cybersecurity Threats Behind the Increase
The article states that there are three main types of cybersecurity threats:
- Ransomware
- Zoombombing
- Phishing
Being aware of these common cybersecurity threats allows your school to prioritize technical and non-technical defenses, like security awareness training for students, teachers, school administrators, staff, and parents. Let’s take a closer look at these common threats.
Ransomware
Ransomware attacks are becoming more common because there is an increase of software availability. These attacks occur when cyber criminals take control of a school’s software until a ransom is paid. During this time, the criminals can take any information, including student and parent financial data. The longer the ransom takes to be resolved, the more information the cybercriminal obtains.
The article cites an example of a citywide ransom attack that forced Hartford Public Schools to postpone their first day of classes when a software system responsible for delivering real-time information on bus routes was impacted. The Hartford mayor said that over 200 of their 300 computer servers were affected. This is only one of the many ransomware attacks targeting schools throughout the country.
Zoombombing
Zoombombing is when an unwanted internet troll or hacker gets into a private video conference call. This type of attack causes disruption and damage. Luckily, according to Check Point security engineer Maya Levine, schools can take steps to avoid this.
“Zoombombing is one type of attack we’ll likely see but it can be avoided pretty easily if teachers take advantage of and utilize the security features offered by the platform,” she says. She warns schools, however, that other cybersecurity threats can pose serious problems to entire districts. “Denial of service attacks will be incredibly disruptive to schools, like the one recently in the Rialto district,” she explains.
Phishing
Phishing, as defined by the Federal Trade Commission, is when scammers use text messages or emails to trick an individual into giving out their personal information. For example, a hacker could send out an email to school employees that looks like the actual emails they receive from their school. An employee may quickly open and respond to the phishing email without knowing how much harm they are doing. Phishing affects countless people throughout the country on a daily basis, with the FBI’s Internet Crime Complaint Center reporting that people lost $57 million to phishing schemes in one year.
Security Recommendations
The TechTarget article suggests a few basis steps for schools to reduce the threat of cyberattacks. These include:
- Security training for school administrators and staff to prevent phishing attacks
- Implementing better access control for remote learning tools and platforms
- Giving parents the ability to freeze their children’s credit to prevent identity theft
- Educating students about online safety, including not clicking on free item offers, accessing online games safely, and not filling out forms with their personal information and/or school credentials
The entire school community can serve as the first line of defense for school data and should be trained accordingly to recognize, avoid, and report any situation that can affect the safety of the school’s information. Security training should be provided periodically throughout the year to continually reinforce cybersecurity awareness. Schools can take additional steps to help support training and awareness by putting posters throughout the school, creating printed handbooks for quick reference, or creating online learning lessons via an LMS.
For information about various types of cybersecurity threats, download our Glossary of School Cybersecurity Terms.
