Looking at the top 50 schools in each category, Proofpoint found that 96% of state secondary schools, 92% of sixth-form colleges, and 80% of universities are “lagging behind” on basic cybersecurity, leaving students, staff and partners open to a high risk of attacks. 

While there is no apparent indication of threats to schools ahead of students returning to school this week, a cyber-attack during the school year could have more serious implications. 

The beginning of the school year also presents a unique security risk since students and staff may have picked up malware on their devices over the summer, which they would then bring back on the school network. 

Last year alone, over three quarters (78%) of UK schools experienced at least one type of cyber-incident. Despite this, only 53% of schools felt they were ready for a cyber attack, according to an audit by The National Cyber Security Centre (NCSC) and the National Grid for Learning (LGfL).

“The reason educational institutions remain a highly attractive target for cybercriminals is they hold large amounts of sensitive, personal, and financial data,” said Matt Cooke, cybersecurity strategist at Proofpoint.

“Email is how the majority of threats arrive at any organisation, so tightening email security should be a top priority,” continued Cooke.

According to Proofpoint, an efficient way to heighten email security is domain-based message authentication, reporting and conformance (DMARC). This protocol protects domain names from being used by cybercriminals, and authenticates the sender’s identity before allowing the email to reach its destination. 

Recommended

• How to Spot Phishing Attacks and Stay Safe, According to Researchers
• Proofpoint Report Highlights Concerning Impact of Phishing Attacks
• Top UK Universities Failing to Implement Strong Email Security

In Proofpoint’s analysis of the top 50 UK Universities, only 16% had not protected themselves against domain impersonation, for sixth-form colleges it was 22%. However, this number skyrockets to 70% when observing state secondary schools.

Less DMARC security measures means more phishing emails getting through to state secondary schools/. This stat is concerning when looked at in conjunction with a recent study in the British Journal of Educational Studies, which showed one in seven 15-year-olds are at risk of responding to a phishing email.

“As people remain a critical line of defence against email fraud, educational institutions need to ensure that staff, students and parents are aware of basic security hygiene,” concluded Cooke.