This post has been taken from PlatformEd. It's totally free to sign up where you can access videos, conversations, articles and resources from colleagues in the Schools Sector - With daily posts and regular free virtual events for members, it's quick and easy to create an account and start connecting with professionals up and down the UK.
Cyber Trends: The Growing Risk of Ransomware for Schools
With the tragic war in Ukraine continuing, news of heightened Cyber Security hits our screens and inboxes. Cybercrime is as indiscriminate as it is pernicious. Moreover, with the advent of ransomware, organisational data is an easy target for a new global racket of hackers.
In a joint release with global allies earlier this year, the UK’s National Cyber Security Centre (NCSC) penned a report into 2021’s ransomware trends. For the school business leader and IT professional alike, this included some useful updates.
Though the report is not specifically targeted at schools, education and public services are heavily referenced by the various national cyber authorities. Some of the key takeaways from this report were a generally increased sophistication of criminal activity.
The Professionalisation of Cyber Crime
Ransomware specific toolkits called Ransomware-as-a-service (RaaS), are widely available to criminals high and low. Some hackers are even offering corporate style ‘24/7 help centre(s)’ to improve the victim-payment-journey. It appears that criminals are going to all possible lengths to ensure that the ransom is paid.
In this same spirit of modelling criminal practices on emerging business excellence, the report singles out the activities of Eurasian ransomware groups. According to cyber authorities, there is a regional trend of selling off their victim data in cartel buy-outs. Criminals will then use this upcycled information to gain access to encrypted data and vulnerable computer networks.
Vectors, Tactics and Timing
In addition to the professionalisation of ransomware tactics, there is also a downward trend in terms of the size of the target. With smaller organisations now being attacked, this could spell danger for Schools and Trusts who may have previously been classified as ‘big-game’.
The report also reiterates the key threat vectors including Phishing emails and Remote Desktop Protocols (RPD). It notes also that these vectors “remain popular because of the increased use of remote work and schooling.”
In FE Week’s recent article on the risks facing schools, they note increased exposure owing to Covid19's technical revolution. As schools continue to benefit from remote and hybrid working and learning platforms they expose themselves to ransomware as well as other risks. One such emergent danger according to the article is that of spear-phishing emails knowns as “business email compromise (BEC) Scams”
A final interesting note for Schools from the joint NCSC report was a trend towards organisations being specifically targeted during public holidays and weekends. This trend has been well documented. According to computer weekly 37% of UK respondents to a recent report “did not have specific contingencies in place at such periods.”
Resources
It’s important to note that the NCSC offers great guidance for organisations in defending against ransomware attacks. You can find best-practice and advice for training, tips for data backup and specific anti-ransomware tactics.
- Heightened Cyber Security Threats: What To Do
- Understanding Ransomware
- Mitigating Ransomware
- Defending Against Phishing
.png?width=1200&name=PLATFORMED%20-%20BLOG%20CTA%20(1).png)
PlatformED is an open group for anyone who is interested in subjects relating to school business management; from policy changes in funding and estates to best practice in procurement, payroll, budgeting and auditing.
