Cybersecurity and Education

You've likely heard of cyber attacks and data breaches on major companies like UPS, MGM Resorts, T Mobile, and 23andMe. But with a growing reliance on digital tools in education, learning institutions are increasingly appealing targets for cybercriminals. According to Microsoft’s malware statistics, about 80% of all malicious activities target schools, making the education sector the most affected industry.¹ Additionally, 87% of academic establishments have experienced at least one cyber attack.²

Educational institutions can minimize vulnerability by strengthening their cyber defenses. Read on to discover cybersecurity best practices for school districts and higher education organizations.

Cybercriminals targeting schools can compromise the safety and privacy of staff members and students. Educational institutions are a prime target because they are a large collection of people in one place sharing a large amount of sensitive data. Without robust cybersecurity measures, identity thieves and hackers seeking ransom payouts may gain access to sensitive student and staff details, classified research projects and the financial information of an institution.³

Implementing cybersecurity measures is also crucial because a successful data breach may result in substantial financial loss, disruption of administrative operations and reputational damage.^4,5 Therefore, academic institutions should strive to employ the best strategies for making computer systems resilient to threats and safeguarding confidential information from unauthorized access.

There is a plethora of cybersecurity resources that educational institutions can make available to students and staff members. Aside from having a Below are cybersecurity best practices that academic institutions can use to minimize the risk of breaches and improve students' online safety.

From the very start, every student and staff member should understand that cybersecurity is an important focus for their institution. For example, schools can implement robust user authentication processes, including the use of passwords that are not easy to guess. A password policy can set the password strength by requiring a certain number of characters, as well as stipulations about upper and lowercase letters, numbers or symbols.⁶

A cybersecurity policy for schools can also involve multi-factor authentication (MFA). MFA verifies a person’s identity by requiring more than just a password before granting access to a computer system or an online account. Individuals must provide a password and take at least one extra verification step, such as answering a security question or entering a PIN sent through text message.⁷

In addition to cybersecurity policies, education institutions should have an incident response plan. The plan defines steps academic organizations should follow before, during and after a cyber incident.⁷ This ensures schools are always prepared for a potential cyberattack.

To protect sensitive student details from unauthorized access, educational organizations can use encryption protocols that safeguard data stored in computer systems and protect information being transmitted between servers.⁸ But that’s only one method of ensuring data security and privacy.

According to the National Center for Education Statistics, educational institutions can also protect student data by establishing clear rules regarding who can access, send or receive information about learners.⁹ Schools can achieve this by implementing role-based access permissions in their administration systems. As a result, only authorized personnel will access personally identifiable information about students.

Another way to ensure confidentiality and safeguard student information is by complying with data protection and privacy laws. For example, the Family Educational Rights and Privacy Act (FERPA) dictates which parties schools can disclose student records to and when parental consent is necessary before sharing learners' details.¹⁰

Other federal laws in the U.S. affecting information privacy in academic institutions include the Children’s Online Privacy Protection Act (COPPA) and the National School Lunch Act (NSLA).⁹

Cybersecurity education is critical for preventing cyber attacks on the front end, especially cyber hygiene. Cyber hygiene refers to the precautions people can take to stay safe online and protect sensitive data. Think of it as "staying clean" in cybersecurity and following the rules. Schools can promote cyber hygiene by spreading cybersecurity awareness about common threats, such as:

• Phishing attacks: Attackers target victims using fraudulent emails or messages that appear legitimate. The goal is to trick people into providing sensitive information, such as usernames, passwords or credit card details. Cybercriminals can also use phishing to lure individuals into clicking malicious links that trigger the automatic installation of harmful programs in a victim’s computer¹¹
• Ransomware attacks: Criminal organizations deploy malicious software that encrypts files or devices in a computer system. The encrypted devices and files become inaccessible and unusable until the victim pays a ransom¹²
• Denial-of-service (DoS) attacks: Malicious actors who execute DoS attacks make systems in academic institutions unavailable to students or staff. The criminals overload a school’s network and servers with fake traffic, causing downtime and making computer resources unavailable to legitimate users. This can also include distributed denial-of-service (DDos) attacks.¹³

As frequently as possible, institutions should aim to teach students how to recognize and report suspected malicious activities. Meanwhile, staff should receive cybersecurity training that is relevant to their role. Staff training should cover common cybersecurity threats, best data protection practices and the responsibility of each member in implementing the cyber incident response plan.⁷

Even with heightened cybersecurity awareness, there is no need to completely eliminate digital devices and online learning. Universities and colleges allow students and staff to bring their personal devices into educational environments, making learning more accessible and improving connectivity. Unfortunately, a high prevalence of bring-your-own-device (BYOD) increases cyber attack risks.

For instance, personal devices may contain malicious programs, run outdated software or lack the robust encryption capabilities of institution-owned devices. This may open backdoors for hackers to exploit vulnerabilities in a school’s cyber networks.¹⁴

To solve this problem, a school can segment its network to isolate BYOD devices from the institution’s critical IT resources. This helps contain potential security incidents and limits the damage of a cyber attack.¹⁵

Even if your institute's network and digital learning systems are only available to students, cybercriminals can invade virtual meetings and classes by stealing login credentials or hacking video conferencing software. Once they gain access, they may record classes and private faculty meetings to distribute the content online for their own benefit.⁷

Implementing strong authentication processes, like multi-factor authentication, minimizes the risk of identity theft during online classes and meetings. The extra verification steps in MFA make it more challenging to access accounts using stolen login credentials.⁷

Educational facilities can use cyber threat intelligence software to scan for system vulnerabilities, minimizing exposure to attacks. They can sign up for internet scanning-as-a-service offered by the federal government through the Cybersecurity and Infrastructure Security Agency (CISA).⁷

CISA’s vulnerability scanning is free and is done by qualified cybersecurity professionals. The service aims to check for weak system configurations, known vulnerabilities and suboptimal cybersecurity practices.¹⁶

Help promote cybersecurity in the education sector by gaining the critical knowledge and skills that they need. Your role can help protect students, minimize data theft, and enhance learning outcomes.

An online MS in Cybersecurity from Yeshiva University equips you with advanced skills to upgrade cybersecurity protocols and make the online world safer. With a faculty that leads in research and is composed of industry experts, this 100% online program lets you learn and deepen your knowledge at a pace that best fits your schedule.

Contact an admissions outreach advisor to see how you can get ready to become a leader in your field and unlock higher-level job opportunities.