By Ashish Thapar Managing Principal and Head – APJ Region, Verizon Business Group
Educational institutions have long been a data goldmine due to the collection and storage of sensitive student information. From personal information such as address, health records and payment information, these institutions often run massive network systems across various campuses, with thousands of students and staffs connecting to their online portals.
To home in on this point, a Bangalore-based edu tech start-up, Unacademy, recently suffered a major security breach with the details of over 22 million users up for sale on the dark web.
Global data from this past year shows that this industry saw phishing attacks in 28% of breaches and hacking via stolen credentials in 23% of breaches.
According to Verizon’s Data Breach Investigation Report 2020 Educational Services performed poorly in terms of reporting phishing attacks, thus losing critical response time for the victim organizations.
In the Education sector, the top three patterns are Everything Else,Miscellaneous Errors, and Web Applications and they alone represent 81%of the 228 breaches that we covered in DBIR 2020.Phishing dominates the Everything Else pattern by a comfortable margin, not unlike many other industries.
However, the Educational Services sector stands out by also getting a failing grade in phishing reporting practices.Of all industries, according to our non-incident data, only 24% of organizations had any phishing reporting at all, and none of them had at least 50% of the emails reported in phishing awareness when your organization is being targeted. If they don’t report it, you miss out on your early warning systems.
Similarly, the prevalence of the Web Applications pattern is mostly because of the use of stolen creds on cloud email accounts. Although we cannot say this is the organizations’ fault, according to our non-incident data analysis, Education Services had the longest number of days in a year—28—where they had credential dumps run against them. The global median here is eight days. The overall number of credentials attempted is also one of the highest of all industries we analyzed for this year’s report.
Outside of these two patterns (everything else and web applications), sadly, the news is still not great. Ransomware is really taking hold of Education vertical incidents, and has been responsible for 80% of the Malware-related incidents, up from 48% last year (Figure 2). All of those Ransomware cases have also played a role in the increase we have seen in financially motivated incidents for the past two years.
One additional concern in this sector is the fact that, according to our analysis, this is the only industry where malware distribution to victims was more common via websites than email. This information doesn’t really seem to make sense until you consider malware being distributed via unmonitored email (such as personal mail accounts from students on bring-your-own devices connected to shared networks), and all of those infections obviously endanger the larger organization.
This year, we’ve aligned our findings with the Center for Internet Security Critical Security Controls (CSCs) to provide you with a way to translate DBIR data into your security efforts.
Here are the top Controls that our data suggests will be worthwhile for most organizations out of which CSC 17, CSC 12, CSC 5 and CSC 11 are more relevant for the Education sector:
Continuous Vulnerability Management(CSC3): Use this method to find and remediate things like code-based vulnerabilities; also great for finding misconfigurations.
Secure Configuration (CSC5and CSC 11): Ensure and verify that systems are configured with only the services and access needed to achieve theirfunction.
Email and Web Browser Protection (CSC 7): Lock down browsers and email clients to give your users a fighting chance when facing the Wild West that we call the internet.
Limitation and Control of Network Ports,ProtocolsandServices(CSC 9): Understand what services and ports should be exposed on your systems, and limit access to those.
Boundary Protection (CSC 12): Go beyond firewalls to consider things like network monitoring, proxies and multi-factor authentication.
Data Protection (CSC 13): Control access to sensitive information by maintaining an inventory of sensitive information, encrypting sensitive data and limiting access to authorized cloud and email providers.
Account Monitoring (CSC 16): Lock down user accounts across the organization to keep bad guys from using stolen credentials. Use of multi-factor authentication also fits in this category.
Implement a Security Awareness and Training Program(CSC17)—Educate your users, both on malicious attackers and on accidental breaches.
Best Articles