Why schools are vulnerable to ransomware attacks

A lack of security training for educators and budget limitations are two reasons schools are susceptible to cyberattack, says IBM Security.

Image: iStock/Maria Symchych-Navrotska

Preventing ransomware and other attacks is challenging enough if you work for a large corporation with the means to educate your employees and spend the necessary money on cybersecurity. But if you’re at a smaller organization, such as a school, with a tiny budget and limited security training, combating cyberattacks is all the more difficult. Plus, the abrupt shift to remote learning has opened up another area through which schools can be targeted.

SEE: Zero trust security: A cheat sheet (free PDF) (TechRepublic)

A new report by IBM Security examines how schools are vulnerable to ransomware and what they can do to beef up their defenses. Published Thursday, IBM’s Education Ransomware Study was based on a survey conducted last October by Morning Consult on behalf of IBM. The survey elicited responses from 1,000 K-12 and college educators and 200 responses from K-12 and college administrators, all in the US.

Among all the respondents, 78% said they’re now using some type of online learning. However, 60% revealed that they haven’t received or aren’t sure if they received new cybersecurity training to deal with the security challenges of remote learning.

Videobombing and other security threats can easily disrupt a virtual classroom. Malicious individuals who barge into a session uninvited to spew foul language or make obscene gestures are especially upsetting for younger students. Around 1 in 5 of those surveyed said one of their peers encountered a security issue during a class. However, half of the respondents said they’re not even familiar with videobombing despite its growing use.

Using personal devices can be problematic because such devices typically aren’t managed or protected by the school’s security tools. Yet 59% of all the educators and administrators surveyed said they use using personal devices for work. Among just college educators, that figure shoots up to 81%.

More than half of the respondents said that budget is a large or medium barrier when it comes to beefing up their cybersecurity defenses. In fact, a limited budget was cited by 45% as the greatest barrier toward establishing stronger security. Other barriers cited included the availability of security technology, awareness of security threats, education about security threats, and the skills needed to combat such threats.

Despite the potential threats, half of the respondents said they’re not very concerned or not at all concerned about a cyberattack hitting their school. Further, 55% said they’re somewhat confident about their school’s ability to manage the consequences of an attack. However, given the weaknesses in the security postures of many schools, such responses sound overconfident.

“Stay-at-home orders, and the switch to remote learning, have changed the focus for cybercriminals looking for easy targets as everyone from kindergartners to college professors have adopted remote technologies,” Christopher Scott, director of security innovation, office of the CISO at IBM, said in a press release. “And with budgets focused on new ways of learning, schools are in need of additional resources and technology to change the dynamic and lower the financial ROI for the bad guys targeting them.”

To help US public schools better defend themselves against ransomware and cyberattacks, IBM announced the launch of a new education security grant. The company will award a total of six grants of $500,000 each ($3 million in total) to school districts that apply at IBM.org. School districts can apply between Feb. 4 and March 1, 2021, and recipients will be announced shortly thereafter.

To prepare for ransomware attacks, school educators and administrators should also consider the following tips from IBM:

Prepare and budget for cybersecurity by creating incident response plans and exploring resources like cyber insurance.
Train staff, students, and parents and provide clear guidelines for device usage, passwords, secure Wi-Fi connections, and video conferencing.
Test and patch critical systems, especially those used across multiple schools to avoid widespread impact, and use the cloud to securely store and backup data.
Embrace the cloud, use cloud and SaaS tools when possible, and back up files offline to ensure their recovery.
Stay educated and collaborate through information sharing to be aware of potential threats and vulnerabilities, and build relationships with law enforcement for further collaboration.