VIEWS & OPINION Protecting schools against cyber attacks Comment by MARK ROBERTSON, CRO of Acumen Cyber
The education sector is under attack. It’s only a few weeks since term began and it’s already been reported that at least two schools in the UK have suffered cyber attacks, which have delayed their start dates and left their pupils’ education in limbo.
Ransomware attacks are rife today and cost UK organisations billions every year. The attacks plunge organisations into a standstill, where they can no longer access their critical data which brings their operations to a halt.
The UK government has recently pledged to never pay the demands set out by ransomware criminals, seeing payments as fuelling the industry. This means it’s highly unlikely any schools will pay any of the ransoms set by adversaries, but this doesn’t make the education sector any less of a target.
Understanding the threat to schools
A recent UK government breaches survey revealed that 71% of secondary schools have identified a security breach or attack in the last year. The reason for this surge in attacks is largely because of a lack of budgets to adequately defend their architecture and because of the size of their environments, which often must facilitate access for hundreds of pupils. While in higher education institutions, like universities, Chief Information Security Officers (CISOs), will be appointed to manage security, in most primary and secondary schools the IT team is designated the job of securing the digital estate.
However, these teams are often small, under-resourced, under-skilled to deal with today’s sophisticated attacks, and security is only one part of their remit. This can add pressure to IT teams and can also result in them missing key alerts, which can then escalate into full scale attacks. Furthermore, because pupils need to access school networks, it’s difficult to implement tools like Multi-Factor Authentication (MFA). MFA is a security solution which limits a criminal’s ability to compromise systems via a single
password, as users need to authenticate themselves via two devices, such as a mobile phone. But, within school settings not all pupils have mobiles, which makes the feature difficult to adopt. This also means a single compromised password can provide criminals with full access to school networks, significantly heightening risks.
Schools hold vast amounts of confidential information on pupils, which can seriously impact their safety and privacy when it falls into the hands of malicious adversaries. There have also been cases in private schools where criminals obtained sensitive data relating to high-profile parents and used it to con them out of money.
Bolstering cyber resilience in the education sector Cyber crime is no longer a minor technical issue that impacts computers and software. Today, its ramifications are far-reaching and it must be viewed as a credible and likely threat that is continually tracked and defended against. However, given that very few schools have the resources to do this internally, partnering with a security service provider is the clear solution.
The best way to boost cyber security within the education sector is to work with Managed Security Service Providers (MSSPs) who are experts in cyber defence.
These partners can alleviate the burden cyber places on internal teams, while offering expertise and 24/7 protection. They can monitor the school digital estate for potential malicious activity, and ensure all systems, applications and assets are configured correctly to enhance security. This is far more cost-effective than employing multiple full-time members of staff to run security internally, and because MSSPs defend the architecture of multiple organisations, they have a much closer understanding of threat trends and attack techniques. Through forming partnerships, schools can rely on the expertise of security service providers to bolster cyber resilience. Not only does this cut costs, but it also makes it much harder for criminals to compromise their infrastructure and cause damage to both school data and pupils.
Small steps, big difference Comment by SAL McKEOWN, journalist and editor
Playtime gives children a chance to let off steam, talk to their friends and be sociable but the pupils who need it the most often miss out. They are kept in for bad behaviour, to finish work or even for extra revision in the run up to SATS.
I recently interviewed Ian Holmes. He is Director of Move & Learn CIC and was the lead for Creating Active Schools at the University of Bradford. Many of the ideas for these initiatives came from his time as a headteacher at Thorner Church of England Primary School, a job he left in 2020. He explained: “I asked the children what they did outside school when they played. That uncovered a whole heap of things. At the age of five, some of these children had never been to a playground.” A school governor who worked for the Health and Safety Executive helped Thorner Church of England Primary School to make better decisions about more adventurous activities. The school started allowing children to climb specific trees. They created a forest area for them to explore with supervision, and let children scoot others around in suitcases. They provided a sandpit for older children because when Year 6 pupils went down to early years they loved the sand and water play. Ian also put more break times into the school day, “because we realised children needed shorter, sharper lessons” while staff looked at ways to make lessons more active. Some moved away from talk- pair -share where children stick to friendship groups. Instead, children would walk around and then when the teacher called ‘Stop’ they shared ideas with the nearest person. This meant they were on their feet and getting to know different children.
October 2024
Ideas to adapt • Watch what happens in the playground. Does one group dominate the area with a game of football while others just stand and chat?
• Make playtimes more engaging with a wider range of activities e.g. skipping and dance
• Talk to children about what they do outside school • Look for low cost activities that will be easy for staff to implement • Make changes to school uniform so it is more suitable for physical activity during the school day
• Involve everybody – teachers, governors, lunchtime supervisors, parents • Don’t work in isolation; learn from other schools • Include physical activity in your Breakfast Club so it is not just a time for sitting and eating
• Look at your carpet time. Can you get children on their feet walking and talking?
• Add local woods and adventure playgrounds to your list of places to visit
These approaches lead to better engagement and an improvement in behaviour and pupil achievement. One teacher involved in a Move and Learn programme told Ian: “I was really struggling with the whole burden of teaching. It’s still hard, but this has brought some joy back into what I do.”
Watch Creating Active Schools for more ideas:
www.youtube.com/ watch?v=Au80eQFfRWo
For more information about Move and Learn, visit:
www.moveandlearn.
co.uk
www.education-today.co.uk 25
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44
