03 Aug Cybercriminals Get An A+ In Hacking K-12 Schools
Districts can avoid ransomware days with strong email protection
– New York City, N.Y. – Aug. 3, 2021
Even though summer feels like it just started, plenty of school districts across the country are gearing up for a new school year.
As districts put together back-to-school shopping lists, one thing needs to be at the forefront: Security.
According to the Multi-State Information Sharing and Analysis Center (MS-ISAC), a federally-funded organization that helps improve cybersecurity for state and local governments, ransomware attacks on K-12 schools are projected to increase by 86 percent in 2021. That’s right. 86 percent.
According to the group, that comes on the heels of a 19 percent increase between 2019-2020. Now, it’s expecting attacks to reach another dimension.
Schools don’t just have snow days anymore. They have ransomware days.
There are a few reasons behind the increase, according to the MS-ISAC. One, schools may have small IT teams that have varying responsibilities, making it difficult for one person to handle a massive threat that gets past huge IT teams.
Two, hackers think that, in the rush to get back to regular schooling, schools may be more willing to pay up. And third, there’s plenty of valuable information about students and teachers held at schools. Educators hold tons of sensitive information about students. From birthdays to allergies, medical conditions to family histories, educators are tasked with ingesting this information for all their students and then protecting it from getting out.
The law that governs it is called the Family Educational Rights and Privacy Act, or FERPA. Since the law was first introduced in 1974, a lot has changed.
Educational information isn’t just shared via email. It’s on Microsoft Teams and Zoom, Google Drive and Dropbox. Every school district has expanded its suites — meaning there’s more room for error. With teachers and students balancing learning from home with other responsibilities, accidental sharing of personal information is more likely. There are common-sense things to keep in mind when dealing with FERPA. First, teachers and administrators shouldn’t send grades or other non-directory information such as disciplinary history or Social Security information via email. Programs that a school doesn’t have a contract with shouldn’t be used.
Those are good measures to prevent accidental sharing.
But if there’s a compromise and bad actors are in the system, accidental sharing goes out the window.
The best way to prevent that from happening is to have proper email security. Most attacks start with email and it is the number one threat resulting in breaches. Some 91 percent of breaches start with email. The best way to stop data loss is to prevent your cloud accounts from being compromised. That starts with stopping phishing attacks.
Beyond that, implementing data loss prevention technology is critical. This gives admins the ability to inventory records and control how they are shared. And it ensures that sensitive information isn’t disclosed publicly.
A strong DLP program will create and automate universal policies across multiple cloud applications, so as to control how files are shared amongst internal and external users.
This works in two ways. One, it stops the accidental sharing of information.
It’s also important to protect against outside actors. Should a hacker infiltrate the system, a DLP policy that’s already identified and marked files containing confidential, financial and personal information would come in handy. Additionally, watermarking and file retraction can provide audit trails and file controls long after a document has left the organization.
As educational institutions, protecting students is the number one goal. That applies to data and email security. With attacks on the rise, waiting to employ security is no longer an option.
To avoid accidental data leakage and a string of ransomware days, investing in strong email security now can save a whole lot of money later. A security solution tailored for education should do the following:
- Set proactive anti-phishing policies for faculty, students, and alumni — or use our recommended out-of-box configurations
- Specifically protect against spear-phishing and impersonation attacks from V.I.P. staff such as the superintendent, principal, dean, and professors
- Create self-triggering remediation workflows to quarantine malicious links and attachments
- Remove known threats from inboxes using Search & Destroy technology
- Automatically identify behavioral and systemic anomalies
- Gain immediate visibility and insights into your environment
- Significantly reduce phishing emails and clicks from students and faculty
Ransomware attacks could particularly spike at the beginning of the school year. This is why it’s imperative to begin protection now.
Start a Demo to Experience the Power and Simplicity of Avanan
– Gil Friedrich is co-founder and CEO at Avanan.
About Avanan
Avanan is a cloud email security platform that pioneered and patented a new approach to prevent sophisticated attacks. We use APIs to scan for phishing, malware, and data leakage in the line of communications traffic. This means we catch threats missed by Microsoft while adding a transparent layer of security for the entire suite and other collaboration tools like Slack.
Avanan catches the advanced attacks that evade default and advanced security tools. Its invisible, multi-layer security enables full-suite protection for cloud collaboration solutions such as Office 365™, G-Suite™, and Slack™. The platform deploys in one click via API to prevent Business Email Compromise and block phishing, malware, data leakage, account takeover, and shadow IT across the enterprise. Avanan replaces the need for multiple tools to secure the entire cloud collaboration suite, with a patented solution that goes far beyond any other Cloud Email Security Supplement.
