How to keep hackers off your school attendance list with object storage

Key points:

Education institutions are prime targets for hackers because they hold valuable data and often lack strong cybersecurity protections

A crucial part of staying ahead of ransomware is staying informed

See related article: Education suffers the highest rate of ransomware attacks

Learn How to Lower Cybersecurity Threats to Your School

As the 2023-2024 school year commences, focus on education is accompanied by a pressing concern for better cybersecurity. Cybercriminals are poised to exploit educational institutions, seeking access to personal, financial, and health records. Recent incidents, such as New Haven School System’s $6 million breach and Prince George County schools attack, highlight potential risks facing schools today. There is a critical need for robust cybersecurity measures for protection against attacks, inclusive of a comprehensive plan to keep hackers at bay.

What’s sending hackers to schools for the ultimate ransomware field day? Educational institutions hold a wealth of valuable information but lack IT budgets and updated cybersecurity tools, making them prime targets. In a perfect world, ransomware could always be stopped at the “front door” before it enters a school’s network premises, but this is hardly the case. Detection and prevention measures such as monitoring network traffic, establishing strict permission guidelines, and implementing multi-factor authentication (MFA) to confirm identities are continuously evolving, but attackers are becoming increasingly sophisticated, often finding ways to bypass these defense measures.

Understanding why schools are prime targets is the first step to building a healthy cybersecurity ecosystem. The next step is looking at what tools are in place and considering how to optimize their performance and functionality–not only for security, but recoverability and restoration. Emphasizing backup as a key component of security strategy may be the low-effort, cost-effective solution schools need to achieve cyber-resiliency.

Stay aware: Students aren’t the only ones preparing to go back to school

We’ve witnessed an alarming surge in ransomware attacks on educational institutions. At least 120 schools have suffered a ransomware attack compared to 188 in all of 2022. Despite their crucial role in shaping the future, schools often grapple with small IT budgets, limited staff, and outdated technology, making them lucrative targets for threat actors.

With these obstacles in mind, schools are more likely to endure consequences of an attack stemming from human error from students and overly complex tech that IT staff are too strapped to manage properly. This often opens them up to the possibility of data theft, followed by extremely long recovery times. For instance, in April, Alabama-based Jefferson County Schools suffered prolonged disruptions from an attack that occurred during the end of spring break in March, and an incident at Colorado public schools in June led to data exposure of student mental health records.

Stay prepared to stay protected

A crucial part of staying ahead of ransomware is staying informed. Currently, there are types of ransomware that are intelligent enough to commit an acoustic attack by listening to your keystrokes and predicting what someone is typing with 95 percent accuracy. Hackers can listen in to text chats or leak sensitive information, which is tough to manage in a school setting given the multitude of devices and connectivity options.

Though backup typically falls second to other defense measures, its impact can be outstanding. Consider The New Haven School system, which tried to alleviate getting data back up and running by paying ransom to the attackers. The biggest concern here is there is no guarantee that stolen data will be returned post-payment.

Veeam’s 2023 Ransomware Trends Report found that while 59 percent of organizations paid the ransom and were able to recover data, 21 percent that paid the ransom still didn’t get their data back. Additionally, only 16 percent of organizations avoided paying ransom because they were able to recover from backups. The truth is, no security plan is foolproof, and schools should consider quality versus quantity when it comes to which tools to bring to the battle against cyber threats. While implementing standard security measures is highly encouraged, the reality is that nothing will keep schools completely void of ransomware attacks.

This is where data backup comes to the forefront of cybersecurity strategies. This includes conducting regular backups of school data and following the 3-2-1-1-0 strategy, comprised of three copies of data saved on two types of media, with one copy offsite and one copy offline. Should a disruption occur, this makes the difference in guaranteed availability. Incorporating strong security measures like these into backup and management practices boosts the overall resilience of a school’s data infrastructure.

Stay ahead with immutable backup storage

It’s worth noting, targeting primary data and backups is well within the realm of possibility as ransomware rises. Although criminal hackers actively target backups, these remain the best defense against ransomware. Schools must ensure they take regular backups that are immutable, stored off-site, or, ideally, both. Immutable backup storage is a type of data storage system designed to prevent unauthorized or accidental modifications, deletions, or alterations to backed-up data for a specified period. Therefore, once data is written or stored, it cannot be changed or deleted until the predefined retention period expires.

Object storage is a great partner for education as it enables versioning and object lock, rendering itself ransomware-proof. Schools should incorporate backups with hardened security and an appropriate level of redundancy for constrained IT. What’s more, it’s a simple, powerful, and secure tool that schools can use to guarantee recovery. It is generally affordable compared to file or block storage solutions, further accommodating a limited budget for school IT.

Back to school with better protection

To prepare for potential attacks, schools must establish clear roles and responsibilities for key stakeholders. With the value of data continually on the rise, it’s not a question of if a school will face an attack, but when. Cybersecurity awareness among students and staff is paramount in keeping our leaders of tomorrow and their data safe. Furthermore, aligning with the U.S. Department of Education’s Cybersecurity Resilience Efforts can provide additional resources and support.

Data should be stored in a separate system to ensure availability in case of disruption. Combat attacks on primary storage with built-in immunity as an extra layer of protection against tampering. Keep school in session with a low-effort and cost-efficient solution like on-premises object-based backup storage–a tool built for low maintenance and constrained IT.