By Bob Stevens, vice president of Americas, Lookout.
Fall 2020 has already proven to be a challenging year for school cybersecurity. While teachers and students work together to learn in new environments, bad actors are exploiting the situation to breach systems and steal sensitive information.
While cybersecurity awareness in education is growing, Chromebook, tablet and smartphone threats aren’t as well-known, or well-protected, as their desktop counterparts. Administrators, teachers and students need to understand that – all devices – including mobile devices – need to be secured. The good news is that schools can take measures to prevent and mitigate damage from cyberattacks. Here are three steps to help students, teachers and administrators stay safe.
Secure Commonly Used Devices, Like Chromebooks, tablets and smartphones
Cost-effective yet functional, Chromebooks enable students to attend class and complete homework remotely. In some ways, security is a strength of Chrome OS. First, it doesn’t allow anyone access to its kernel – the core part of the operating system – and run apps in isolation. Chromebooks also automatically receive regular updates to ensure vulnerabilities are patched. However, there are numerous threats, such as phishing, that Chromebooks are still susceptible to.
For many students that don’t have access to laptops or Chromebooks, the existing tablets and smartphones their families own are critical to learning remotely. But these devices are rarely top of mind in a school district’s security strategy.
Implement Modern Endpoint Security Across All Mobile Devices
As education via mobile devices becomes a new mechanism for learning, defending against these mobile threats is as central to a district’s security as protecting desktop or laptop computers. Districts can mitigate these risks with modern endpoint security that protect against phishing and web content, network-based, and malware. Modern endpoint security can stop both known and unknown threats from these sources, helping get a step ahead of bad actors.
Help Users Identify Overlooked Mobile Threats
Security solutions are necessary, but teachers and students should still have a basic understanding of the threats they face, especially ones that can be difficult to detect. For example, it’s relatively easy to identify a malicious phishing email on a desktop. But on mobile devices, common phishing tell-tale signs are difficult to notice or are nonexistent. Even the youngest mobile users need to be aware of mobile devices’ hidden dangers. This awareness includes familiarity with the risks of a simplified user interface and smaller mobile displays, both of which make it challenging to identify questionable links or websites.
While many users are familiar with email-based phishing attacks, many mobile phishing attacks now start via SMS or text, social media platforms, gaming, or third-party messaging apps. Once a device is compromised, these types of attacks can provide access to a device’s microphone, email, photos, documents, and phone logs.
Teachers and students must recognize threats from these sources so they don’t fall prey to attacks. All mobile device users should have a basic cybersecurity awareness and regularly seek best practices like researching a source for legitimacy before tapping on inbound links and never sharing personal information with strangers online.
Students and teachers are learning a lot this year, not just from the standard curriculum but also about technology’s role in the learning process. It’s critical that for administrators, teachers and students to understand that mobile security is a part of their technology education. Whether that means learning about the role of modern endpoint security as a part of a district’s overarching security strategy or better recognizing potential mobile threats, we can all walk away from the 2020 – 2021 school year better armed against threats in today’s increasingly mobile world.
What does “security” mean in the context of a school? Until recently, the first things that came to mind were probably physical security technologies like surveillance cameras, metal detectors, access control stations, and even just good old fashioned locks.
But the recent COVID-19 crisis has changed that: because of the nationwide shift toward remote learning that the pandemic has prompted, schools have been forced to reevaluate their cybersecurity policies and requirements as they work to keep their data safe amid increased reliance on videoconferencing, learning management portals, and other online educational tools.
Distance Learning Tools in the Spotlight
One of the first security concerns to gain public attention was the vulnerability of the web’s most popular videoconferencing tools. Zoom, in particular, gained notoriety for the problem of “Zoom Bombing,” where random individuals would be able to drop into meetings run by others without being invited.
With much of the population working from home and relying on remote web conferencing tools, Zoom saw a massive spike in daily users, 10 million in December 2019 to 200 million in March 2020—a dramatic increase that put the previously small problem of Zoom Bombing into the public eye.
Zoom has, fortunately, implemented additional security controls specifically designed to combat Zoom Bombing, but these controls are optional and must be selected by the user. This underscores the need for effective training.
It isn’t fair to pick on Zoom, of course—in fact, Zoom’s problems highlight one of the biggest struggles facing both schools and businesses specializing in remote learning tools. Such a massive spike in remote users over a short period of time means that IT departments lacked the time to evaluate the security controls for remote learning products, and the makers of those products may not have had time to refine those controls for such heavy use.
Learning management systems (LMS) are a great example of this. Used to store grades and enable students to remotely turn in homework, LMS have long been a convenient tool for schools; however, they have generally had the benefit of operating within the safety of the school’s network. And although a bored student might occasionally attempt to hack their grades, LMS platforms have generally not been in the crosshairs for cyberattackers.
Lucy Security works with many K-12 districts across the country to help build cybersecurity awareness and protect against phishing attacks (most ransomware attacks start with a simple phishing email.)
Below are some comments from Colin Bastable, Lucy CEO, about the types of trends and issues he sees and what K-12 IT departments can do to protect their employees, pupils and district resources from clever cyber attackers.
According to Colin Bastable, CEO of security awareness training firm Lucy Security:
Education: an easy target for cyber attackers
K-12 school districts range from fewer than 100 employees to several thousand. Some have tiny budgets, and some have more significant resources, but they all struggle with vulnerability to cybersecurity attacks. Just this week, CNN reported that a Texas school district lost $2.3 million to an email phishing scam. Unfortunately, this news is just the latest in an ever-increasing trend of cyberattacks targeting K-12 schools.
According to the K-12 Cybersecurity Resource Center, more than 752 cyber incidents at K-12 schools have been reported since January 2016, resulting in loss of productivity as well as much-needed funds.
Common K-12 cyber scams
One common scam is the Gift Card Scam, where an email purporting to be from the school principal or a head of department asks an administrator or assistant if they can buy some $100 gift cards. Often, this might be during a break, such as Thanksgiving, when the school staff are unlikely to meet.
Once the admin has the cards, they email a reply (to the fake email address) saying “I have them” and the thief asks them to scratch off the security number and send pictures of the cards, “because I need to get the gift to the students today.”
Another common attack is to send a change of bank deposit details to the school payroll staff.
These are quite simple attacks, yet extraordinarily successful. More sophisticated attacks involve BEC (Business Email Compromise) attacks, like the gift card scam, but involving hundreds, thousands and millions of dollars in losses, where the imposter asks for urgent payments to be authorized.
Ransomware attacks are also prevalent in K-12 and local governments, causing multi-million-dollar losses and billions of losses worldwide.