The Global Risks Report (Report) tracks perceptions among risk experts and world leaders in business, government, and civil society. It examines risks across five categories: economic, environmental, geopolitical, societal, and technological. Although the Report analyses risk globally and within all sectors, the issues that it presents are relevant for schools seeking to operationalise measures to mitigate risk. At the end of this article is a link to the Report.
The Report notes that “lower barriers to entry for cyber threat actors, more aggressive attack methods, a dearth of cybersecurity professionals and patchwork governance mechanisms are all aggravating the risk” of cyber attack. The significance of this for schools comes from Microsoft intelligence which highlights 82.65% of all malware attacks are targeted at the education sector. With an annual growth rate of 358% in malware attacks globally, and schools being a primary target, we should assume that the risk of cyber attack within education is not getting smaller, nor going away anytime soon.
Alongside this, “as attacks become more severe and broadly impactful, already- sharp tensions between governments impacted by cybercrime and governments complicit in their commission will rise as cybersecurity becomes another wedge for divergence—rather than cooperation—among nation-states.” Schools should be aware that state sponsored cyber attacks (highly rewarding and relatively low cost/low risk ways to carry out espionage and military operations) will affect them because of these tensions. This becomes even more evident when stated that “Cyber threats also continue to drive states apart, with governments following increasingly unilateral paths to control risks. As attacks become more severe and broadly impactful, already-sharp tensions between governments impacted by cybercrime and governments complicit in their commission will rise as cybersecurity becomes another wedge for divergence, rather than cooperation, among nation states.”
Another finding from the Report is that “new technologies and an ever-expanding attack surface enable a more dangerous and diverse range of cybercrimes.” We already know some of the reasons why this increase in malware encounters is occurring. Schools have traditionally taught children in the classroom, at school. Distance learning creates a larger attack surface though, with people at home often having lower security protections than at school. Weaknesses in device and system security and management make it easier for attackers to compromise accounts, spread malware and potentially gain access to sensitive information. These attack surfaces, with the reliance on new technologies, will continue to grow, with cyber attacks developing on new fronts. It's important therefore for schools to get to grips with the current areas where they have risks before adopting new technologies and systems, which will grow those risks.
Cyber criminals tailor their attacks, and this “ includes timing them for when cybersecurity teams and leadership could be distracted by other priorities, such as during peak COVID-19 outbreaks or a natural disaster. This is a fact we have known for some time, that attackers tailor their timing for when school tech teams are distracted by other priorities. Whilst Covid has been one of them, the rhythm of the school year is another. 9ine's intelligence shows that most attacks happen during school holiday periods, or in days leading up to the start of a new term. The times when schools are most vulnerable, operationally and reputationally. These factors need to be considered and incorporated into the operational IT security planning, controls and management.
However, it is understood that there are “limited technical and financial resources to enhance cyber defences against critical infrastructure breaches or cyber regulations to safeguard data and privacy.” There may be limited resources that your school has to hand to mitigate cyber risks, and these need to be used sparingly, not wasting resources and consequently increasing privacy and cyber risks. 9ine's expertise, support, products and services are designed to enable schools to focus their limited resources on what is important. This will, in turn, help your school to use resources efficiently and effectively when mitigating risk.
Staff time is included in school resources, the Report highlights that 95% of breaches can be traced to human error, intentional or accidental. Many of the cyber risks found within schools can be mitigated through improvements to operational management and control of existing IT systems and user’s training. Cyber risk is therefore a choice for schools to make - do they apply effort in changing their IT operational processes or do nothing? Regardless of how many cyber penetration tests you have performed, without changing your IT operations and controls you will remain vulnerable.
The Report mentions that “Leaders must remain attentive to perennial concerns like cybercrime and ransomware attacks as well. At the organisational level, upskilling leaders on cybersecurity issues and elevating emerging cyber risks to board-level conversations will strengthen cyber-resilience.” This raises the idea that investment in cyber resilience skills and expertise is critical for every organisation, even at a senior level. At 9ine, we have purposely developed a monthly workshop, the 9ine Tech Academy, where training is provided, with technical cheat sheets on cyber resilience for school tech teams. In utilising training such as this, risk can be mitigated in a way that everyone understands, and risk can be mitigated from a senior level with the appropriate budget.
From the 2022 Global Risk Report, it is evident that the risks that impact businesses globally, are also highly encountered within the education sector. The operational mitigation of risk within schools should aim to tackle those pointed out within the Report accordingly. If your school is unsure as to how to mitigate cyber risk and keep your community protected, get in touch and see how we can help.
You can view the 2022 Global Risk Report here.