Education remains one of the most vulnerable areas to cybersecurity attacks. Schools, districts, and institutions are all struggling to maintain data privacy and security, as well as safe and secure access to technology and physical resources.
The move to more flexible classroom environments, utilizing both on-premises and cloud applications, has many benefits for both educators and students. However, it also opens schools up to more security threats. As educational organizations also must ensure they are in compliance with PII, HIPAA, FERPA, COPPA, and other regulations, these security requirements can seem daunting.
Recently, we hosted a roundtable featuring experts from Connection’s education segment vertical and professional services department, as well as representatives from Juniper Networks. The panel discussed the threats facing education today, cybersecurity program strategies, technology solutions, and processes that can help your organization move forward with confidence.
Host: James Hilliard
Guests:
Timothy Allen – Director of Operations and Technology in the Professional Services Organization at Connection
Pam Aulakh – Senior Vertical Alliance Manager for K-12 at Connection
Rob Kwiatkowski – Senior Partner Systems Engineer at Juniper Networks
Michael Bergt – Technical Marketing Senior Manager at Juniper Networks
Bobby Sears – Senior Vertical Alliance Manager for Higher Education at Connection
To listen to the recording, register here.
Cybersecurity Attacks in the Education Industry
Education in the United States caters to a vastly diverse range of students from K–12 to higher education, including Masters and PhD programs. With more than 76 million K–12 and college students, education accounts for a large portion of the U.S. population. This translates into a monumental amount of data and information in circulation, as well as the need to safeguard that data.
Unfortunately, the vast amounts of sensitive data, including private information and credentials, makes education a valuable target for cyberattacks. In 2021, 771 institutions were affected by data breaches, impacting nearly 2.6 million records. While the percentage might seem small, the impact is significant, considering the size of some of these breached organizations.
Safeguarding Student Data: Cybersecurity Challenges in Education
The education industry is currently experiencing a myriad of data breaches and cyberattacks due to several challenges, including:
- Shortage of Cybersecurity Personnel—There has been a significant influx of new devices in schools as a result of increased federal funding recently. However, this surge in technology adoption has not been accompanied by an increase in IT staffing, resulting in a shortage of cybersecurity personnel. Districts are struggling to manage and secure their expanding fleets of devices. Cybersecurity has taken center stage, and CIOs have become concerned.
- Lack of Funding—Implementing strong security solutions can be costly, and as security measures become more advanced, the expenses for schools can increase significantly. Additionally, ensuring that the appropriate individuals have visibility into security threats can be a complex and challenging task.
- Onboarding and Securing New Devices—Establishing accountability for bring your own device (BYOD) and Internet of Things (IoT) devices during the onboarding and securing of new devices in educational settings can be challenging. It’s essential to define device ownership and responsibility. Furthermore, it’s crucial to consider what occurs from Day 0 to Day 2+ after deployment. During this phase, educating individuals about potential risks is of utmost importance, especially since a significant percentage of incidents are attributed to social engineering attacks.
- Training IT Professionals in Educational Settings—The shortage of skilled professionals affects education and other industries. K–12 school districts face a unique challenge as many CIOs come from teaching backgrounds rather than IT. To address this, institutions must invest in on-the-job training and continuous skill development to upskill their existing workforce. However, cybersecurity roles in education may not always offer competitive salaries.
In higher education, the situation is similar, with universities and colleges struggling to recruit and retain qualified IT professionals. Compensation is a factor, but professionals also prioritize work-life balance and flexible work arrangements. The influx of younger generations brings a different mentality, affecting hiring practices. AI plays a growing role in the hiring process, allowing institutions to adapt to the changing workforce dynamics post-pandemic.
- Meeting Compliance Standards—Compliance is a crucial aspect of education cybersecurity, and ensuring that schools and institutions are compliant with regulations is a challenging yet essential part of protecting data and privacy.
Failure to meet compliance standards can have severe consequences, including penalties and legal issues, which can be detrimental to the reputation and operations of schools and universities for years to come.
Developing a Security Strategy to Make the Grade
To tackle the set of cybersecurity challenges common in the education industry today, consider the following strategies:
- Adopt a “Zero-trust” Mindset—Adopting a “zero-trust” mindset is a valuable strategy for schools to enhance their protection against cyberattacks. This approach emphasizes a default stance of mistrust towards all entities. The key principle is to identify the data or resources in need of protection and limit access to authorized individuals. This strategy should be customized to suit each organization’s unique needs and assets.
Understanding one’s environment is a crucial element in implementing the zero-trust approach. Educational institutions must evaluate their network, devices, and resources to develop an effective security strategy. When undertaking network updates, thorough due diligence is essential to ensure that the selected solutions align with the specific environment.
- Utilize Security Landscape Optimization Services—Security Landscape Optimization Services can assess an organization’s security profile comprehensively. This consultative approach helps identify strengths and weaknesses in an institution’s security posture. Additionally, there are government resources available, such as the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST), which can provide valuable information and best practices.
- Protect Data in the Cloud—The adoption of cloud technologies has significantly increased in education. When implementing cloud technologies, it’s imperative to view cloud services as an extension of an institution’s estate. Regardless of whether data is hosted on-premises or within a cloud-based infrastructure, it’s crucial to consider who has access to the data, how it’s protected, and to maintain visibility over data interactions.
- Enhance Security Posture with AI—AI offers advanced threat detection, response, and automation that are proficient in recognizing baseline behaviors and identifying outliers that may signal a potential security threat. The adoption of AI in cybersecurity extends to automating responses to known threats, reducing response times.
AI’s role in education goes beyond security; it spans various applications, including enhancing the learning experience, personalizing education, and streamlining administrative processes. AI’s capacity to analyze vast datasets and adapt in real-time is invaluable for an industry that constantly evolves.
Juniper Networks is at the forefront of integrating AI into its products. By leveraging AI, Juniper aims to simplify security management, enhance visibility, and optimize network performance, ultimately ensuring a safer educational environment.
- Consistently Test for Resiliency—Regularly testing the resiliency of security measures is crucial to maintaining a strong security posture. Third-party testing is vital to ensure security efficacy. Educational institutions should test their security infrastructure at least annually or biannually to validate their controls and keep them up to date.
Zeroing in on Cybersecurity in Education: Continue to Navigate New Threats
Education isn’t just about acquiring knowledge; it’s also about safeguarding it. Protecting your school against cyberattacks is a multifaceted challenge that requires a comprehensive approach. By understanding the unique challenges and risks facing educational institutions, schools and universities can create robust security strategies that protect student data and privacy.
If your school or university is interested in learning more about education security solutions, visit www.connection.com/cybersecurity for additional resources to help you get started.
Bobby Sears
With over 20 years of experience, Bobby has had the privilege of collaborating with Fortune 500 companies, both within the enterprise landscape and the public sector. His extensive experience includes positions range from the Director of IT, which allowed him to harness the power of technology to drive organizational growth, to the VP of Sales, where he spearheaded sales strategies and teams to exceed quotas and expand business reach. As the Director of Marketing, he steered branding, outreach, and campaign management to resonate with target audiences and position companies at the forefront of the industry. As the Sr. Vertical Alliance Manager for Higher Education for Connection, Bobby is forging strategic partnerships aligned with customer needs to drive growth.
