Cyber resilience is key for Scotland's education sector
Universities across the UK have been targeted by attackers stealing data and high-profile research, writes Mark Robertson
When evaluating the most lucrative targets for cyber criminals, the education sector ranks high on the list.
Holding swathes of personal data and highly confidential research, often related to governments and innovation, the sector offers adversaries multiple avenues for monetising attacks.
Yet, many institutions lack the necessary skills and funding to adequately protect their complex environments. Academic institutions manage a complicated mix of networks, data and user access points, which makes their environments very difficult to secure.
Furthermore, cyber security is often bundled into broader IT budgets, meaning it rarely receives the dedicated investment or prioritisation it requires.
However, this misalignment between risk and resourcing is leaving many educational institutions exposed.
The impact of recent attacks
In the last few years, multiple education institutions have suffered major attacks, with the most recent occurring on Scottish soil.
These attacks have disrupted student learning, delayed exams and, in some cases, forced pupils to attend schools on weekends to catch up on missed lessons.
Universities across the UK have also been targeted, with attackers stealing data and high-profile research, in areas such as defence, AI, medicine and climate science, often in support of state-backed threat actors.
The biggest challenge for many education institutions is finding the resources in-house to safeguard their diverse and multifaceted environments.
Their environments are large and built for collaboration, focusing on open access, which can threaten security. Many institutions struggle to implement essential safeguards like Multi-Factor Authentication (MFA), largely due to the scale and diversity of their user base, which includes both students and faculty.
Furthermore, they are highly vulnerable to phishing and ransomware, today’s most dominant attack vectors, which can be amplified by the absence of round-the-clock monitoring and regular cyber awareness training for staff and students.
The government’s recent Cyber Security Breaches Survey also revealed that 85 per cent of further education colleges and 91 per cent of higher education institutions have suffered cyber attacks in the last year, which mirrors the volumes aimed at the country’s largest organisations.
This means prioritising defences is more important than ever. But how can this be achieved when inhouse budgets and resources rarely match the severity of the threat?
Strengthening defences in Scotland’s education sector
In response to the growing threat, it is essential the education sector takes proactive steps to get ahead of threat actors and protect their sensitive environments.
One example of this is being actioned by Edinburgh Napier University (ENU), which recently announced it has partnered with Acumen Cyber to strengthen its security posture. Recognising the severity of the threat, ENU identified the need to proactively enhance its cyber defences by partnering with a security expert to oversee and manage a key element of its operations. While the university had existing in-house protections, it recognised the importance of 24/7 coverage to guard against increasingly sophisticated threats.
Universities across Scotland are facing a growing wave of sophisticated cyber threats that target valuable research, sensitive data and the safety of students and staff. In an environment where resources are already stretched, the challenge of maintaining strong cyber defences has never been more important.
To stay ahead of threat activity, institutions must take proactive steps to understand and address the risks unique to their environments and sector. Accessing sector-specific cyber expertise, whether through internal development or external support, is essential to enhance cyber defences and close critical gaps.
This ensures that even in the face of escalating attacks, safety and security are maintained, data is continuously protected, while the integrity of Scotland’s education industry is never threatened.
Mark Robertson, CEO of Acumen Cyber
Comments
Want to join the conversation? Please or to comment on this article.