Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd

Posts Tagged :

Education

Research highlights cyber threat to schools

960 640 Stuart O'Brien

There have been 301 attacks against UK and US schools so far in 2019, compared to 124 in 2018 and 218 in 2017. 

That’s according to Barracuda analysis of data compiled by the K-12 Cybersecurity Resource Center (K-12 CRC), which has been tracking reported attacks against U.S. schools since 2016.

This only accounts for the reported cases, however, and Barracuda says it’s highly likely that additional cases exist that went either unreported or even undetected, especially as stealthier malware that seeks to steal information, participate in botnets, or mine cryptocurrency is on the rise.

The National Cyber Security Centre (NCSC) recently published a report compiling cybersecurity-related findings from 430 schools across the UK. It found that 83% had experienced at least one cybersecurity incident, even though 98% of the schools had antivirus solutions and 99% had some sort of firewall protection.

Using a single source of open threat intelligence data and a list of all known websites belonging to U.S. and UK schools, Barracuda researchers found 234 unique malware samples that attempted to connect to school domain names.

It also found 123 IPs associated with the same set of schools that had negative reputation, which could point to additional malicious activity, in addition to disrupting activity at the school due to emails and web pages being blocked.

Among the highlighted threats are:-

Cyberattacks Against Schools — The most common threats targeting schools are data breaches (31%), malware (23%), phishing (13%), network or school infrastructure hacks(10%), and denial-of-service attacks (4%), based analysis of the 708 incidents reported to the K-12 Cybersecurity Resource Center since 2016. The remainder of the incidents were made up of accidental disclosure of data (16%) and other incidents (3%). 

Barracuda says many school districts only have one or two IT personnel to service the district, let alone any dedicated cybersecurity staff. Plus, the steady increase in school-issued devices in recent years drastically expands the attack surface along with the number of systems that need to be secured. 

This, it says, makes schools largely a target of opportunity as well as subject to the massive campaigns spreading scams and malware indiscriminately. Lowered security postures due to budget constraints, combined with a large user base of minors who don’t have the critical-thinking skills to properly assess potential attacks, makes both types of attacks more effective, unfortunately.

How schools can protect against the threat

Barracuda says the only way for schools to truly protect against cyberattacks is a complete security portfolio including perimeter security, internal network security, incident response capabilities, and a knowledgeable security staff to configure these solutions and handle incidents:-

1. Perimeter security

Perimeter security generally consists of network firewalls, web filters, email protection, and application firewalls. While affordable and easy-to-configure solutions are available, obtaining the budget for a full security portfolio can prove difficult for many school districts, and without all areas covered, attack vectors will undoubtedly still exist. 

2. Internal network security

While internal security such as intrusion detection, data backup, and anti-malware solutions are important for catching any breaches in perimeter security, the additional risk of insider threats that schools face make these measures even more critical. While Windows Defender offers decent anti-malware protection these days, upgrading existing machines to Windows 10 to take advantage of this feature can be costly and is often overlooked by many organisations. Regardless of the software being used, though, keeping up with security patches is critical because it helps patch exploits that can potentially be leveraged by attackers. 

3. Incident response capabilities

In the event of an incident, intrusion detection and incident response solutions both assist in discovering incidents and helping security staff isolate and remediate them. Data backup as part of internal network security can also assist during an incident if data is corrupted, encrypted, or deleted.

4. Knowledgeable staff

Maintaining a capable IT security staff is challenging for many school districts because IT staffing needs often compete with other much needed positions, such as additional teachers to keep up with enrollment rates. Without this staff, though, it can be difficult to patch systems and respond to potential incidents or even properly configure security solutions to maximise their benefit. 

NCSC publishes university threat assessment

960 640 Stuart O'Brien

The threats facing the UK’ universities and the steps they can take to protect themselves have been outlined in a report from the National Cyber Security Centre (NCSC), a part of GCHQ.

The NCSC’s threat assessment aims to raise awareness of state-sponsored espionage targeting high-value research, as well as the risk of financial losses at the hands of cyber criminals.

While the NCSC has been working with the academic sector on an ongoing basis to improve security practices, this is the first threat assessment it has produced specifically for universities.

The assessment notes that while cyber criminals using methods such as phishing attacks and malware pose the most immediate, disruptive threat, the longer-term threat comes from nation states intent on stealing research for strategic gain.

To mitigate the risks, universities are encouraged to adopt security-conscious policies and access controls, as well as to ensure potentially sensitive or high-value research is separated rather than stored in one area.

Measures to support universities have been outlined in Trusted Research, from the Centre for the Protection of National Infrastructure (CPNI) and the NCSC, which offers accessible and actionable cyber security advice for university leaders, staff and researchers.

Sarah Lyons, Deputy Director for Economy and Society at the National Cyber Security Centre, said: “The UK’s universities are rightly celebrated for their thriving role in international research and innovation collaborations.

“The NCSC’s assessment helps universities better understand the cyber threats they may face as part of the global and open nature of research and what they can do about it using a Trusted Research approach.

“NCSC is working closely with the academic sector to ensure that, wherever the threat comes from, they are able to protect their research and their universities in cyberspace.”

The assessment found that the open and outward-looking nature of the universities sector, while allowing collaboration across international borders, also eases the task of a cyber attacker.

Among the examples highlighted in the assessment was an attack from last year attributed to Iranian actors in which they were able to steal the credentials of their victims after directing them to fake university websites.

The attack took place across 14 countries, including the UK, and many of the fake pages were linked to university library systems, indicating the actors’ appetite for this type of material.

The assessment also highlights the financial damage which can be caused by cyber attacks on UK universities, citing previous figures from UK Finance which estimated that UK university losses from cyber crime for the first half of 2018 were £145m. 

The threat assessment for universities can be read here.

Universities invited to apply for NCSC certification

960 640 Stuart O'Brien

Universities across the UK now have a further opportunity for their cyber-security related degrees to gain certification as part of the National Cyber Security Strategy.

After a rigorous process, the National Cyber Security Centre (NCSC) – a part of GCHQ – has already certified 23 Master’s degrees, three Integrated Master’s and three Bachelor’s degrees from 19 universities over the last four years.

With applications now open the NCSC is looking for fresh candidates to increase these figures, with degree apprenticeships now also eligible.

NCSC-certified degrees are designed to help universities attract high quality students from around the world, employers to recruit skilled staff and prospective students to make better informed choices when looking for a highly valued qualification.

The degree certification programme is part of a range of programmes which the NCSC and its government partners have initiated across UK academia designed to address the knowledge, skills and capability requirements for cyber security research and education.

The other programmes include Academic Centres of Excellence in Cyber Security Research (ACEs-CSR), Academic Research Institutes, and Centres for Doctoral Training in Cyber Security.

Chris Ensor, NCSC Deputy Director for Cyber Skills and Growth, said: “I’m really pleased that we’ve now launched a programme for certifying degree apprenticeships.  This will be a valuable addition to our certified undergraduate and postgraduate degree programmes.

“Degree Apprenticeships offer a flexible option for both students and employers, as we have seen from our own Degree Apprenticeship programme.

“I’m really looking forward to seeing some more successful applications, and strongly encourage any interested universities to get in touch and find out more.”

Universities Minister Chris Skidmore said: “The fast-paced world of technology is constantly evolving and it is vital that young people have the option to study high quality courses in cutting edge industries, such as cyber security.

“We want to maximise choice and flexibility for people wanting to study in higher education, whether that’s as part of a traditional course or a degree apprenticeship.

“Not only will these certified degrees provide a benchmark for future cyber security professionals, but also help to ensure they are ready for the world of work and prepare them for an exciting career.”

Institutions who are interested in applying for certification can find out further detail via https://www.ncsc.gov.uk/information/ncsc-degree-certification-call-new-applicants-0

40% of Americans would retrain with cybersecurity jobs in mind

960 640 Stuart O'Brien

A new survey shows that not only are the majority of Americans concerned about cybersecurity threats, but many are willing to consider returning to college to pursue a cybersecurity education – especially if their employer pays for it.

The State of the Cybersecurity Workforce and Higher Education survey, conducted through Engine Insight’s Online CARAVAN omnibus, asked US adults ages 18 and up for their opinions on and awareness of the cybersecurity field, as well as the role that higher education plays in it.

Of the 1,004 adults surveyed, 41 percent said they would probably or definitely consider returning to college to earn a certificate or degree to prepare for a cybersecurity job.

However, willingness rose to 72 percent if current employers were willing to pay for respondents’ education in preparation for an in-house cybersecurity job. Those respondents most willing to consider pursuing an employer-funded cyber education were between the ages of 35 and 44.

“These findings are great news for employers seeking to address the cyber skills gap within their organizations yet facing recruitment challenges,” said Melissa Marcello, associate vice president at Champlain College Online. “Our survey shows that employers have a ready and willing pool of future cyber experts within their current workforce, if they’re willing to provide the resources and support to upskill and train them.”

Other key findings from Champlain’s survey:

  • Overall, 88 percent of surveyed adults said they were very or somewhat concerned about cybersecurity threats impacting them personally, with older respondents showing greater concern than younger ones.  A full 50 percent of respondents ages 54 to 72 said they were “very concerned” about such threats.
  • 68 percent of respondents were confident in colleges and universities’ abilities to create solutions that address cyber threats-nearly as confident as they were in the private sector and significantly more confident than they were in the government.
  • When presented with various roles that colleges and universities could play in reducing cyber threats and improving information security, 90 percent of respondents felt that higher education institutions should ensure all college students-regardless of major-have a basic cybersecurity education.
  • Feeling that it was too late to consider a career change was the primary reason identified by respondents for not considering returning to college to prepare for a cybersecurity job. About one-fifth (22 percent) of respondents felt that way, including many younger respondents in prime career-changing years.
  • Women (13 percent) were significantly more likely than men (6 percent) to say they didn’t think they had what it takes to be successful in a technical field.
  • An overwhelming majority of respondents – 85 percent – believed that more should be done to encourage women to enter the cybersecurity field. Perhaps surprisingly, respondents age 65 or over were significantly more likely (94 percent) to feel this way than any other age group.

“Cybersecurity is crucial to so many industries that it’s vital for everyone, regardless of gender, age or career field, to have at least a baseline understanding of cyber principles,” said Kathleen Hyde, chair of cybersecurity programs at Champlain College Online. “For those seeking more, like career changers, nearly everyone is an ideal candidate for a cybersecurity degree or certificate program because of the vast landscape.”

Champlain College Online fielded its online cybersecurity survey from June 21-24, 2018, with a randomized, nationally representative sample of 1,004 U.S. adults ages 18 and above.

UK universities recognised for excellence in cyber security research

960 640 Stuart O'Brien

Three UK universities have been recognised as Academic Centres of Excellence in Cyber Security Research (ACE-CSR).

The National Cyber Security Centre (NCSC) and the Engineering and Physical Sciences Research Council (ESPRC) have identified the University of Kent, King’s College London, and Cardiff University as having first-rate research with scale and impact.

The universities will now join 14 other institutions in a scheme forming part of the Government’s National Cyber Security Strategy, which is making the UK the safest place to be online and helping to support the country’s thriving digital economy.

The universities will now have the opportunity to bid for funding to develop cutting-edge research in cyber security, including at Doctoral level, as well as attend annual conferences and workshops.

The scheme aims to create a better understanding of the strength of the UK’s academic capability in cyber security and identify areas where there are research opportunities or technical gaps. It makes collaboration between academia, business and government easier, and helps make sure cutting-edge research is turned into practical products and services. This includes developing tools to tackle mass marketing fraud online and better understand cyber criminals.

Minister for Digital Margot James said: “These universities are doing fantastic research in cyber security and they are rightly being recognised for their pioneering work. We have some of the best minds in the world working in the field and thanks to this scheme they can now help shape our National Cyber Security Strategy and develop the talent and services of tomorrow.”

Chris Ensor, Deputy Director for Cyber Security Skills and Growth at the NCSC, said: “The UK has world-class universities carrying out cutting edge research into all areas of cyber security. It’s fantastic to see three more universities recognised as Academic Centres of Excellence and I’m especially pleased that we now have centres in all home nations. The NCSC looks forward to collaborating with these institutions to make the UK the safest place to live and work online.”

Professor Pete Burnap, Professor of Data Science & Cybersecurity, and Director of the Airbus Centre of Excellence in Cybersecurity Analytics at Cardiff University said: “We are delighted to receive this recognition as it evidences our long track-record of research excellence in cyber security. Our core identity is the interdisciplinary fusion of artificial intelligence and cybersecurity, a concept we call Cyber Security Analytics. AI is at the heart of the UK government’s industrial strategy and our aim is to innovate with AI to improve automated cyber threat intelligence and support decision making and policy responses to make the UK more secure for individuals, business and the government. We are proud to be the first Welsh university to be recognised by NCSC for our cyber research capability, and we hope to build on the impressive expertise that already exists across the region between academia, government and business.”

Dr Jose M. Such, Director of the Centre, and Senior Lecturer in the Department of Informatics at King’s College London said: “We are thrilled to be recognised for the high-quality socio-technical cyber security research we conduct at King’s College London. This recognition acknowledges the critical and diverse mass of researchers working on this area at King’s from different but complementary angles and points of view. Our research focuses on three main research themes and their interrelationship: the use of AI for cyber security together with the cyber security of AI itself, the theoretical aspects of cyber security like verification and testing, and the socio-political and strategic aspects of cyber security.”

Shujun Li, Professor of Cyber Security and Director of the Kent Interdisciplinary Research Centre in Cyber Security (KirCCS) at the University of Kent, said: “We are excited to be given the ACE-CSR status as an acknowledgement of the excellent research in cyber security at the University of Kent. Our research is truly interdisciplinary drawing on the expertise of colleagues from computer science and engineering as well as wider disciplines such as psychology, law, business and sociology. Our ambition is to have one of the largest and most productive cyber security research centres in the UK by 2022 as well as helping to grow the next-generation cyber security researchers.”

The ACE-CSR programme is supported by Government’s £1.9 billion National Cyber Security Strategy (NCSS) 2016-2021.

List of institutions that are recognised as Academic Centres of Excellence in Cyber Security Research are:

  • University of Birmingham
  • University of Bristol
  • University of Cambridge
  • Cardiff University
  • University of Edinburgh
  • University of Kent
  • Imperial College London
  • King’s College London
  • Lancaster University
  • Newcastle University
  • University of Oxford
  • Queen’s University Belfast
  • Royal Holloway, University of London
  • University of Southampton
  • University of Surrey
  • University of Warwick
    University College London
Security

GUEST BLOG: The WannaCry fallout – It’s not just hospitals looking for extra protection

960 640 Stuart O'Brien

By Claire Stead, Online Safety Expert at Smoothwall

It is without doubt that the international uproar and magnitude of the WannaCry cyber-attack on the NHS has left many organisations on edge. Unfortunately, this is the digital world organisations now live in, with cyber-crime now accounting for 50% of all UK crime. Not only that, but ransomware attacks have risen by 600% from 2015 to 2016, highlighting how much more serious ransomware and other cyber-attacks are becoming.

It seems that the NHS’s cyber-attack has been a wake-up call for organisations, as we at Smoothwall have seen a notable increase in the number of inbound requests from organisations not in healthcare, but in business and education looking to shore up their security offerings. What’s clear, is that this has been a wake-up call for each and every industry sector, whose fingers have just got that little bit closer to the panic button.

All organisations, no matter how large or small, public or private sector, need to realise that they have a target on their backs and make cyber security a top priority. They need to have both the cyber security tools and processes in place, as well as an on board workforce to ensure their cyber security is as tight as possible.

All members of an organisation need to be educated to understand the importance and risks around cyber security, and the appropriate processes to follow to keep hackers out, and data safe and secure. This goes throughout the organisation from the c-suite to the rest of the workforce. It is common knowledge that human error accounts for the majority of cyber security incidents with many businesses not investing in the training of their staff to ensure they can detect against malicious email, web pages or links. Organisations need to instil a cyber security mantra within its employees, so that they do not become the weak link in the cyber security chain.

Our approach is simple and is summed up using our 4Ps:

Perception – the security mindset must now be shifted to a ‘security first’ policy. Businesses, schools and hospitals now have to put security at the forefront of all their policies as the risk of an attack grows year by year.

Policy – whether in a school or a business, pupils/staff need educating about the risks of their actions and know the security measures in place to mitigate those risks. This could be anything as simple as regularly updating complicated passwords to recognising ‘phishing’ emails.

Protection – a layered security programme, creating a brick wall of security that can verify the organisation is constantly protected.

Proactivity – it’s no good to have a security programme installed and to never think on it again. The landscape is developing at an incredible rate, and as a result, schools need to ensure that they are keeping up to date with the latest updates and improvements to ensure that they are protected as best they can be.

No cyber security programme is ever going to be 100% secure, but with the right measures and tools in place, with a fully compliant team on board, it will give organisations that much more of a fighting chance against the threats of cyber criminals.