• 78% of schools fell victim to at least one type of cyber incident in 2022 – with 7% experiencing significant disruption as a result
• 21% suffered a malware and/or ransomware attack and 18% faced periods with no access to important information
• 26% had not implemented multifactor authentication to safeguard important accounts
• 25% continued to allow limited staff access to USBs that can compromise systems through infections from computer viruses, malware and spyware
• 4% had no back up facilities
• 6 schools reported a parent losing money due to a cyber incident.

Top three attack vectors used by criminals:

1. Phishing – fraudulent emails from attackers used to deceive staff into revealing sensitive information
2. Spoofing – where attackers impersonate someone else to gain a victim’s confidence, access to a system, steal data, or spread malware
3. Malicious software including:

• Malware – used to disrupt or gain access to systems
• Viruses – programs that when executed replicate themselves by modifying other computer programs and inserting their own code
• Ransomware – designed to block access to a computer system until a sum of money is paid.

Schools continue to remain at particular risk from cyber criminals and must demonstrate vigilance, says the National Cyber Security Centre (NCSC, part of GCHQ) and edtech charity LGfL-The National Grid for Learning (LGfL), which today published their Cyber Security Schools Audit 2022 of UK schools nationwide.  The report can be downloaded here securityaudit.lgfl.net

Given the global shortage of skilled, experienced cybersecurity professionals, even large corporations struggle to recruit qualified staff. According to Mark Bentley, Cybersecurity Lead at LGfL, “For cash-strapped schools – rightly focussed on teaching and learning and keeping children safe – recruiting qualified staff is both a significant challenge and an additional expense – this is why LGfL and partners, which include some of the world’s largest security providers, have published an additional report that includes further analysis and important next steps for schools, also available at securityaudit.lgfl.net.”

However, the audit did reveal that schools are wising up to the cyber threats they face:

• 53% of the schools reported they felt prepared for a cyber-attack (compared to 49% in 2019)
• Awareness of phishing in schools has increased from 69% in 2019 to 73% in 2022
• 55% (compared to 35% in 2019) implemented staff training for non-IT staff
• 49% (compared to 41% in 2019) have included their core IT services in a risk register or business continuity plan
• 90% (compared to 33% in 2019) have at least one of the following – a cybersecurity register, risk register, or business continuity plan.

Sarah Lyons, NCSC Deputy Director for Economy and Society said, “Our schools rely so much on the myriad of data required to run efficiently – including sensitive data on students, parents, governors and staff – therefore more work must be done to support the cyber security around these essential services. That’s why the National Cyber Security Centre has been working with schools and the education sector to provide free tools and guidance to help schools manage their cyber risks effectively and supporting them to keep this valuable information safe.”

Concluding, Mark Bentley, said, “Cybersecurity can sometimes feel like a Rubik’s cube that changes its colours just as you are on the verge of solving it. Every week seems to bring new threats and make the list of ‘vital steps to stay protected’ grow even longer! But as with any complex issue, you can do a lot to manage and mitigate cybersecurity risks and this report is helping us to shape the support needed so that schools can do just that.”

“LGfL-The National Grid for Learning is set to bolster online defences for schools in response to the National Cyber Security Centre’s alert to act now following Russia’s attack on the Ukraine,” says John Jackson, CEO, whose organisation has stepped up its cybersecurity resilience package to include monitoring, identification, sandboxing¹ and the eradication of ever-evolving threats from phishing attempts, malware, hacks, viruses and ransomware. LGfL has provided services to the public sector over many years and is approved by the governing bodies for the Public Service Network (PSN) and Health and Social Care Network (HSCN) to provide secure access to systems across the public sector, including central government systems.

Newly appointed as the only UK Platinum Partner for Malwarebytes, LGfL is using its significant group buying power to supply schools with cybersecurity solutions at significantly discounted prices,  to help  safeguard their ever tightening budgets and their mass procured devices purchased for remote learning during lockdown.

In addition to the existing Incident Response (threat remediation), LGfL is now able to offer:

• Endpoint Protection (threat prevention)
• Endpoint Detection and Response (threat prevention, monitoring, sandboxing, isolation and rollback)
• Endpoint Protection for Servers (threat prevention for servers)
• Endpoint Detection and Response for Servers (threat prevention, monitoring, sandboxing, isolation and rollback for servers).

Using its Malwarebytes OneView console, LGfL will also be able to give third party support organisations (PSOs) greater visibility and control over what is happening across multiple sites. It will also be able to provide full information on licences issued/used through its OneView Portal and recover and redistribute any unused licences, helping schools to save money.  Existing licences will be transferred on to the console.  

Through its full CyberCloud solution, LGfL is now also able to offer 12 layers of protection to schools using its Let’s Get Digital Broadband Service, including:

1. JANET:IP transit and DDoS (Denial of Service) protection – cyberattacks aimed at disrupting the normal traffic of a target’s servers, services, or networks by overwhelming the infrastructure, at or around the target, with a large amount of Internet traffic
2. Core firewalls to protect the network – a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules
3. Security Operations Centre – alerting and monitoring to protect the network
4. Local school firewalls
5. Sophos antivirus for workstations, servers and home use – software that detects and cleans up viruses, Trojans, worms, spyware, adware and other malicious applications
6. Intercept X managed threat response for workstations and servers – anti-ransomware technology that detects malicious encryption processes and shuts them down before they can spread across a network. Intercept X prevents both file-based and master boot record ransomware
7. Meraki Mobile Device Management – that allows users to manage mobile devices from the cloud in a secure environment
8. Malwarebytes incident response and automated remediation – that detects and removes malware from computers
9. Email protection including MailProtect filtering (Cloudmark) – a cloud-hosted, email filtering system that harnesses the combined strength of multiple market-leading technologies to offer protection against email-borne viruses, malware, fraud and phishing, as well as filtering unwanted bulk mail.  And Egress encryption which encrypts the message so that it is secure in transit and when it reaches the recipient.
10. Web filtering – provided by Webscreen a highly flexible web filtering system designed to allow establishments and groups, such as MATs, to have access to local filtering settings and Netsweeper which enables organizations to protect internet users from harmful online content and provides web filtering, digital monitoring, and online activity reporting solutions to ensure digital safety on-premises and in remote environments
11. End user training including Sophos Phish Threat which educates and tests end users through automated attack simulations, quality security awareness training, and actionable reporting metrics
12. Research and awareness – National Cyber Security Centre (NCSC) Security Audit and Newsletters etc.

For further information on LGfL’s cybersecurity resilience packages please contact: Gareth Jelley, LGfL’s Cyber Security Centre of Excellence 0208 2555 555 (Option 3)

1. ^{Sandboxing  keeps potentially malicious programs or unsafe code isolated from the rest of the organization’s environment. This way, it can be analysed safely, without compromising the operating system or host devices. If a threat is detected, it can be removed proactively.}