Ransomware defence in Higher Education: how to safeguard your institution

Ransomware attacks may have been around a while, but they’re still just as damaging – becoming increasingly sophisticated, and unfortunately, increasingly common.

Further Education institutions are worryingly over-exposed to ransomware attacks. Although heavily reliant on data, including employee and student information, payment details and even course material, stretched budgets and a focus on student safety mean physical safety becomes a priority. In many cases, CCTV systems, gates and barriers and security guards eat up budgets, with cyber security often an afterthought.

Unfortunately, attacks on IT infrastructure can be just as problematic as a physical security issue, and they’re exceptionally common. 92% of further education institutions, including schools, colleges and universities, identified either a breach or a full-on attack in the last 12 months.

And with an average cost of £2 million per attack according to cyber security firm JISC, even a moderate cyber-attack or ransomware incident can impact stretched budgets even further.

A sector at particular risk

As mentioned, further education is a data-heavy sector. Large amounts of information are stored across a variety of systems, often inadequately, making it easy to access for attackers who can identify these opportunities to exploit quickly and easily.

The information and data they can access or withhold can then be bartered for a ransom payment, or otherwise sold on the black market for identity theft or fraud purposes. Often, attackers will collect the ransom, and sell the data anyway.

This ‘double jeopardy’ situation has an impact beyond just budget too. In late 2022, City Lit, England’s largest adult education college, lost system control due to a ransomware attack. The college had to cancel online lessons and notify staff and students that their data had been compromised.

As well as being time-consuming and resulting in students requesting refunds for the missed lessons, the attack affected the college’s reputation and resulted in unwanted press that highlighted the lack of cyber security in place before the attack.

The big threat for further education institutions is open access to systems by default. From students logging on to access course materials or parents logging on to pay fees, the number of risk factors increases with the size of each network.

It doesn’t help that personal devices with little to no cyber security protection, and little to no training on cyber security risk, are both common in the sector too.

So, what can institutions do to mitigate the risk?

Government guidance

As cyber security and ransomware attacks are increasing in volume, with very high risk at both individual and organisational levels, the government has outlined a set of standards that cover cyber security, user accounts and data protection.

Further education institutions need to align their practices with these standards as a bare minimum, but only around 32% of institutions admitted to having actioned all steps laid out by the government.

Another helpful resource for IT teams in further education is the ‘10-steps to cyber security’ resource created by the National Cyber Security Centre. This cycle-based approach touches everything from suppliers to students to third-party stakeholders, with actionable steps at each touchpoint. Again, uptake has been slow, with around 18% of institutions achieving all ten steps as part of their cyber security strategy.

How can SCC and Veritas help further education institutions?

Where our experts stand out from the rest of the market, is the power that Veritas technologies has to enable them to offer advanced expertise in the world of cyber security.

Veritas Technologies, which specialises in cyber security and ransomware strategy, is a long-term partner of SCC and an integral part of SCC’s focus on providing the very best in technology services to the public sector. Some of their solutions include:

• Ransomware assessment: the scope of engagement around a Ransomware Risk Assessment involves thoroughly understanding the customers infrastructure to establish an extensive strategic approach, with comprehensive advice on how to enhance their resiliency. Our experts will then review the threat as well as a response to neutralise them, with solutions that are practical and meets the business and compliance requirements.
• Data compliance and governance: protect sensitive data and meet regulatory requirements when it comes to protecting data from attackers. This preventative measure means you can keep your data protection up to speed, even for the most sophisticated cyber-attacks.
• Data migration: move exposed data from hardware or less secure digital storage to cloud-based servers encrypted with the latest cyber security essentials. You can also retain full visibility of data and ensure complete storage compliance in line with Higher Education data security governance. This means you can recover quickly from an attack and get things back up and running much faster.
• Business continuity and disaster recovery: from minimising impact, to getting vital systems back online faster: stay operational in the event of an attack. This solution is aimed at systems that have the biggest impact if they are unavailable, making it ideal for essential Higher Education.
• SaaS based protection: with SCC and Veritas by your side you can expect an easy way to backup M365, Slack, Google Workspace, Box, PaaS Solutions, on premise workloads but, more importantly it can also back-up Salesforce; without needing to buy a separate product for it. With a single-tenant architecture you can envisage high performance, with an RPO of minutes, not hours and petabyte scalability. Without forgetting, onboarding services, you will be ready and resilient in the face of ransomware.

With SCC and Veritas, you can get a fast and effective solution that leaves you to focus on student and team welfare. Get in touch with SCC today to get your ransomware strategy in place.