Cyber-attacks in schools are increasing year on year: research from the Department for Education shows that 21% of schools in the UK are experiencing cyber-attacks weekly.

But why are they such popular targets?

School systems are viewed as ‘good’ targets by cybercriminals. They contain reams of personal information, from dates of birth to home addresses, and the lack of funding available to schools has led to the perception that they are easier to penetrate than other organisations.

As a result, schools must recognise the threat and take proportionate action. With over a decade of experience working with schools to implement effective cybersecurity policies, Ash Earl, Cyber Security Consultant at RM Technology, believes basic security hygiene can bolster schools’ defences, protecting their systems and data.

Here are his top tips for how Scottish schools can improve cyber hygiene this CyberScotland Week.

1. Raise awareness  

Human error is one of the most common reasons for a cyber-attack. All it can take is someone clicking on a ‘bad’ link to start a chain of events that will end in the school network being compromised, sensitive data being lost and vital IT systems being damaged.

Therefore, the first step in improving your school’s cyber hygiene is to educate teachers and other staff on the risks and how to spot and act upon them.

One of the easiest places to start is training staff on how to spot a phishing attack – which is the most common way for a school to become infected by ransomware. This normally occurs when someone opens an attachment in an email or clicks a link to a malicious website.

The email may look legitimate, posing as something they might expect to receive, making it difficult to distinguish from a legitimate email. Users are then tricked into sharing their login details or downloading malware which can then be used to launch a larger attack.

By training teachers to be vigilant about links, email addresses and requests for personal information, you can take a simple but effective step in protecting your school network.

Running a gap analysis report can also go a long way in identifying where your potential pitfalls might lie and help create a training programme that is right for staff.

2. Get the basics right  

When it comes to cyber hygiene, there are a few basic practices that can help bolster a school’s defences.

You should always use different passwords for different services, and never share passwords for personal accounts with work accounts.

A great way to make passwords easy to remember is to follow the NCSC advice for using passwords generated from three random words that are long enough and ‘strong enough’ for most purposes. Using password managers can also help school staff access the complex passwords they need when they need them.

The next is enabling multi-factor authentication, which acts as an additional layer of security making it harder for unauthorised users to hack into accounts.

Recommended reading

• CyberScotland Week Partners with Scots Comedian for Online Safety Campaign
• CyberScotland Week to Combat the Growing Rise in Cyber-crime
• CyberScotland Partnership Offers SMEs Free Cybersecurity Handbook

Ensuring teachers have access to verified and trustworthy authentication apps, such as Google or Microsoft Authenticator, can strengthen defences further by providing a time-based code.

Lastly, blocking unauthorised use of VPNs and restricting access to harmful websites helps ensure students do not accidentally expose vulnerabilities in school networks when using the internet for schoolwork. Schools can create a more secure online environment by creating digital ‘safety rails’ within a school’s IT infrastructure.

It might not feel like much, but these steps will have a big impact with Microsoft’s 2023 Digital Defense Report stating that “basic security hygiene protects against 99% of attacks”. The simple fact is that a school with basic cybersecurity hygiene is less likely to even be targeted because the threat actors will divert attention to those less well-protected first.

3. Be consistent 

With so many competing priorities in schools today and reams of regulations, it can be hard to find the time to regularly assess your cyber health and ensure you are keeping up to date on the latest threats out there. However, cybersecurity best practices are evolving constantly – and staying updated is important.

Glow, Scotland’s national digital learning platform offers a wealth of free resources for schools as well as training packs which tackle the latest developments – helping you stay on top of the latest developments.

By promoting awareness, implementing essential practices, and cultivating a culture of vigilance, schools can create a safer and more secure online environment for everyone.