Surge in ransomware attacks threatens student data

Popular targets

Threat actors have long targeted K-12 schools and higher education in the past, but such attacks have increase amid the shift to remote learning during the COVID-19 pandemic. "They are extremely vulnerable even more than they were one year ago," Conner said.

New research by endpoint security vendor Absolute Software examined the effects of distance learning on endpoint health, device usage, safety and security as schools adapt to remote and hybrid learning models in the 2020-2021 school year. It determined that 60% of all malware attacks, particularly ransomware, occur in education.

Endpoint protection vendor Morphisec also released new research, which examined COVID-19's impact on the new, virtual school year and consisted of over 500 teachers and administrators across the U.S. who were surveyed in July. According to the report, "despite ransomware attacks increasing in number and sophistication, over half of K-12 educators say their institution has not warned them about the specific dangers of ransomware. In fact, across both K-12 and higher ed institutions, just 13% of educators say they feel ransomware poses the most significant risk as they move to distance learning environments."

As evident from the Nevada School District ransomware attack, Fairfax County Public Schools and others, ransomware is posing one of the largest threats. Because COVID-19 brought on a need to switch to remote learning so quickly, schools did not have much time to adjust, making them all the more vulnerable.

Andrew Homer, vice president of security strategy at Morphisec, said schools' boards are putting tremendous pressure on educators to figure out distance learning and security simultaneously, while teaching.

"Distance learning just massively opened up a huge attack surface because now you're using unhardened collaboration applications like Zoom and at the same time, these machines are now remote so how are you going to update them, patch them?" he said. "These are all unforeseen things. They are being pressured to do more with less and these kids in K-12 are the less responsible folks around security hygiene. It's the perfect storm type scenario."

Awareness around the expanded attack surface is another concern and is not well understood by the teachers, faculty and staff who are actually deploying the distance learning solutions, Homer said.

According to the research by Absolute, "remote learning is creating tech support challenges that are taking away valuable time for teachers to "teach." The data showed 9 out of 10 teachers reported spending more time troubleshooting technology problems.

"They're are not understanding what the threats are that makes them vulnerable. Enabling these collaboration applications, having these machines outside the school system and the implications around that, it's no surprise that many have already been attacked," he said. "We know Zoom is being targeted. These are applications that have not seen widescale usage. What's worrisome is there's no increase in spending or budget or staff to combat this looming threat."

Morphisec performed a demonstration where threat researchers broke into Zoom and were able to use it as an information stealer to scrape credentials and actually record sessions unbeknownst to users. "They are easy to crack because they haven't been used in enterprise and mission-critical type environments up until now. And you can go right down the line whether it's Slack or Webex," Homer said.

According to Absolute data, there was a 141% increase in collaboration software, including BlueJeans, Skype, Microsoft Teams and many popular tools.

One reason K-12 is an easy target is the weak security posture, Conner said. Remote learning is only amplifying the dangers. "Schools are not always the best at cybersecurity or backing up. And now, it's extremely distributed networks."

Conner also said many challenges facing the new school year simply come down to a lack of funds for K-12 school systems.

"A best practice would be to really start to segment the networks. Put different applications and identities in different levels of security. If you're an admin or associated with financials, you need to be in a much more secure platform, not just at the school but at your home," Conner said.

Absolute data indicates that 46% of schools have at least one device that uses rogue or nonauthorized VPN or web proxy applications, "but it only takes one vulnerable device to create a security incident."

The rush to get remote learning up and running also resulted in ill-preparedness, Homer said. "Everyone from the superintendent to the board of trustees are deeply concerned about ransomware, they just don't have a good plan on how to prevent it and prevent some of these attacks because they've been so focused on enabling distance learning," he said.

Attackers recognize these flaws, making schools an even easier target.

"They have their business model, too. They can go after K-12, which they know are not patching their systems, they're vulnerable to using these collaboration applications and go after them. It's much easier with known exploits than they can with an enterprise company that has a robust, layered Defense in depth strategy."