A Complete Guide to Cyber Security for Universities, Colleges, and Schools
Like almost every other industry, educational institutions - such as schools, colleges and universities - are increasingly reliant on technology. Everything from class registers to research data is completed and stored digitally.
And that makes them vulnerable to cyber attacks.
In fact, because of the amount of sensitive data that is regularly collected and stored, schools, colleges and universities have some unique areas of risk, as well as more general ones.
According to the Information Commissioner’s Office (ICO), 347 cyber incidents were reported by the education and childcare sector in 2023. That’s an increase of 55% from the previous year.
And government data from early 2024 suggests that 71% of secondary schools, 86% of further education colleges and a massive 97% of higher education institutions identified a breach or attack in the year preceding the research.
So, cyber security for education is vital. Even a minor lapse could have catastrophic consequences.
In this article, we’re going to talk briefly about why cyber security in schools, colleges and universities is so important, and what some of the consequences of sub-par security could be.
Then, we’ll cover some of the most common threats to cyber security in education. We’ll look at some of the standards you might want to investigate, how to build a robust cyber security programme for your institution, and some best practices you should follow.
Why cyber security is important for education
Robust cyber security is vital in every industry, but the education sector has some unique areas of vulnerability.
Every school, college and university holds a vast amount of personal data. You’ll have detailed information on students and staff, but also data for people and businesses your institution works with.
Then there’s the financial and operational data that’s essential to running your institution.
And all of that data is valuable to hackers and cyber criminals. If it’s compromised, the immediate effect could be disastrous. But the reputational damage down the line could be even worse.
Most institutions also use some kind of digital learning platform and cloud services, both for software and for storage.
While the data held on these may be less critical than the personal data you hold internally, a breach here could have a significant impact on your ability to deliver learning.
Can you imagine the damage to students being locked out of their learning systems a month prior to exams? It doesn’t bear thinking about.
What are the most common types of cyber attacks?
So, it’s clear that computer security must be an integral part of your institution’s digital strategy. But what are the specific threats that you’re facing?
Let’s have a look at some of the most common tactics that your institution is facing. Some of these are common across all industries; others are specific to the education sector.
Data breaches
We’ve already mentioned the huge amount of data your institution stores. There’s all the personal data on your students and staff, financial data, things like exam grading documents and even IP and research data, if you’re a university.
All of that data has huge value to a cyber criminal.
Personal and financial data can be bought and sold on the dark web, and used for identity theft. Exam or test data could be sold on or used to cheat. IP and research data could allow unscrupulous competitors to avoid proper research channels.
So it’s vital you keep your institution’s data secure.
Ransomware
Ransomware is when hackers install software on your systems and software to lock it down and make it inaccessible. They’ll then contact you and demand payment to restore functionality.
This kind of attack is becoming increasingly common in education, and hackers often time them at critical times - such as just before exams or tests. This means institutions often have no choice but to pay up.
Even outside of exams and other critical times, a ransomware attack can still cause significant downtime issues and disrupt learning.
Phishing attacks
Phishing attacks are a common way for cyber criminals to get access to people’s personal or login details. This might seem innocuous at first glance, but once an attacker has access to your system they can use it as a platform to launch more severe attacks.
Staff and students can easily be fooled into giving up their details without even realising it. Phishers use tactics like spoofed email addresses and logon pages to harvest details and gain access to your system.
Insider threats
Cyber attacks can start from within your institution.
Often, these are completely accidental. For example a student might accidentally download or bring in some malware (malicious software) on a USB drive, or a staff member might use a weak password that is compromised.
Or, it could be a disgruntled student or employee that either provides a cyber criminal with access to your systems, or plans disruption themselves.
Either way, insider threats can open up your school, college or university to cyber attacks.
Cyber security standards for schools, colleges and universities
The first step in protecting your institution against cyber criminals is to make sure you’re up to date and compliant with all the relevant standards and guidelines.
There are a few different standards to consider.
In the UK, the National Cyber Security Centre (NCSC) is a government-run agency and is extremely highly regarded.
It’s also worth making sure you keep up with the government cyber security guidelines for school and colleges, which are regularly updated to reflect new threats.
What does the NCSC recommend?
The NCSC is set up to promote better cyber security throughout the UK. It has sections on its website dedicated to schools and higher education institutions.
They provide lots of practical resources and advice, so it’s a good place to start when you’re working on your cyber security.
Some key takeaways from the NCSC’s guidelines include:
- Make sure you keep all software up to date
- Limit access to data wherever possible
- Use multi-factor authentication (MFA) everywhere you can
- Back up regularly and back up well
- Have an in-depth and up-to-date incident response plan
Cyber Essentials Certification
As well as providing guidance and practical advice, the NCSC also runs the Cyber Essentials Certification. This is designed to set a basic level of cyber security competence for employees at organisations including schools.
There’s also an enhanced version - Cyber Essentials Plus - available, which includes a more in-depth and hands-on technical verification.
Cyber Essentials is a great way to demonstrate that you’re taking cyber security, and to give key staff a basic level of understanding quickly.
Building a cyber security policy for schools, colleges and universities
The risk of falling foul of a cyber attack is real. Having a clear and up-to-date cyber security policy is key to managing and mitigating that risk.
A good policy outlines, in clear and simple language, exactly how you protect your systems, data and people. It also lays out what you’ll do if something goes wrong.
Understanding what you need to do, and what you’re going to do if the worst happens, is vital. And just going through the process of writing and updating the policy will help you focus on what’s important, and what will work for your organisation.
Here are some things to consider when writing or updating your cyber security policy.
Defining roles and responsibilities
As with any policy, it’s vital to have people in place to manage your cyber security.
You’ll need an IT security officer or team to oversee the policy’s implementation, to make sure it’s kept up to date and to audit it regularly. Cyber security is a constantly evolving field, so it’s not enough to create a policy and leave it.
That same person should also be the first point of contact if an incident occurs. It’s important that they’re visible and easy to contact.
Your IT security officer doesn't necessarily have to be a full time role. If you’re a smaller institution, it could be a part of another role. And if you’re a really big institution, like a university, you may need a whole IT security team.
Training for staff and students
It’s also important that everyone in your organisation understands the basics of cyber security. You need them to know why it’s important, as well as what they can do to help.
You should schedule regular training to make sure it’s always at the forefront of people’s minds, and to make sure that their knowledge is up to date. But, do your best to make it engaging and fun. Remember, they’re not all IT professionals.
This training should focus on the elements of cyber security that directly affect people. So, things like how to avoid phishing emails, how to keep your passwords secure and why MFA is so important.
You should also consider implementing sanctions for cyber security breaches. These could range in severity, depending on the level of the breach.
Managing devices and networks
The level of complexity involved in device management is the perfect example of why your cyber security policy must evolve over time. Not long ago, all you’d need to worry about was a fleet of desktop computers and maybe a few networked printers.
Not any longer.
Your network will be absolutely packed with tablets, phones, laptops, printers, TVs, smart devices and who knows what else. And many of them will be personal devices, too.
So, you need firm rules for managing these devices.
Things like installing network security software and keeping devices up to date should be the bare minimum. You’ll also need safeguards against people installing their own high-risk software and circumventing firewalls. Then, you’ll need to think about the amount of unencrypted data flying around.
And, you’ll need guidelines and protocols in place for reporting lost or stolen devices - both personal and corporate.
Data protection
Data protection is a bit of a buzzword at the moment. Since the introduction of GDPR (General Data Protection Regulations) in 2018, there’s been an onus on organisations to protect personal data.
Your organisation should be compliant with GDPR already. But, data protection goes beyond what is laid out in the GDPR.
Any data with value to hackers should be protected.
So, you should only keep data you need, and delete it when it’s no longer needed. Anything you do store should be kept securely, using strong encryption. And you should make sure that only people who need it have access.
This should help to limit the opportunity for data theft.
Best practices for cyber security in education
As well as implementing a robust, regularly updated cyber security policy, there are several steps you should be taking to make sure your systems are secure.
These are by no means exhaustive, but they’re a great starting point for a more secure organisation.
Network segmentation
The idea behind network segmentation is that you split your network into discrete zones to help prevent unauthorised access to sensitive material.
So, at the most basic level, you could have a student network and a staff network.
Of course, you can take it much further than this, with segregated areas for different year groups, or for sensitive areas of the staff network like finance or student data. Just bear in mind that the more complex your segmentation, the more difficult it will be to manage.
There are a few benefits to segmenting your network in this way.
It boosts network security and significantly reduces the risk of an outside cyber attack affecting the whole institution, as the attacker should only have access to a single segment.
It also makes it much trickier for attacks using phishing or insider attacks to gain access to the higher security areas of the network.
Using Multi-Factor Authentication (MFA)
We mentioned MFA above, but it’s worth reiterating. It’s a great way to boost device security.
MFA means that a user needs to complete two or more different methods of authentication to access their software or data. You’ve probably come across this when signing in to your bank on a computer, for example. You’ll be prompted to enter your password, then you’ll have to enter a code sent to your mobile device (which is already set up in the system).
The great thing about MFA is that it means cyber attackers now have to break two points of security to get access to data. So even if a password is compromised, the mobile verification step should catch the hacker out.
It’s not an infallible system, but it does add a significant layer of security over passwords alone.
Encrypting sensitive data
In an ideal world, all your data should be encrypted, both when stored and during transmission. This makes it much harder for hackers to use the data even if they do manage to intercept it.
But, like with everything, you’ll need to find a balance. Encrypting everything on your network - especially for bigger organisations - might not be practical.
So, focus on the high-risk data. Any personal or financial data should be encrypted at all times.
Make sure you’re using high-end, difficult-to-break encryption too. Encryption techniques are always improving, but so are hackers.
Conducting regular audits
We mentioned this when we were talking about policies, but it’s worth mentioning again.
Cyber threats are constantly changing and evolving - probably quicker than any other threat you’re likely to face. So you need to evolve too.
That’s why you need someone in your organisation to keep up with what’s happening in the cyber security world, and make sure that all of your policies and procedures are updated regularly.
Regularly auditing your policies and security measures will help you identify weaknesses and address them before they can be exploited.
Securing cloud services
Cloud services are great. They add a level of convenience that users have come to expect. They can also be a significant security risk.
So, audit any cloud providers - either software or storage - that your organisation uses. Make sure they have robust security measures in place to protect your data. Things like end-to-end encryption and secure MFA login processes are a great start.
Conclusion
It’s next to impossible to run a modern school, college or university without technology. Staff, students and parents all expect it.
But being online opens your institution up to attack and exploitation. So, it’s vital to be sure your cyber security is up to scratch.
Following the guidelines in this article is a great start to securing your institution, but you’re going to have to invest a significant amount of time and money into making sure you’re cyber secure - and you stay cyber secure.
If you want to take your educational institute’s security to the next level - and save yourself a whole lot of time in the process - Stone, A Converge Company can help. We’re cyber security experts, and we work with a number of high-profile clients in the education sector.
Get in touch if you’d like to find out more about what we can do.
