Industry Brief: Education Cyber Risk Priorities

Why education is different

Education runs the identity problem of a large enterprise without the HR process that normally governs one. Students arrive and leave on academic calendars. Alumni keep their email. Adjuncts, visiting scholars and research assistants are often created by departments, not by central HR. Each is an account that can be phished, and each sits in an environment built to be open.

The estate is just as uneven. Personal devices connect by default, departments and labs run their own servers, and in many institutions central IT cannot see or isolate everything on its own network. Meanwhile the records of thousands of institutions sit with a small number of student-information, learning-management and payment vendors. One supplier compromise can reach many schools at once.

The sector also holds two quite different risk profiles under one name. A school holding children’s records faces one set of duties. A research university with a medical school, a clinic and sponsored labs faces several more. Read the priorities below against your own mix, and expect the order to shift.

Five priorities at a glance

1. Identity across a population that never stops changing

Start by naming an owner for the identity lifecycle of every population, including the ones HR never hired. If nobody owns it, accounts for departed adjuncts and finished research assistants stay live indefinitely.

Then tier the authentication. Staff, and anyone who can reach finance, registrar, financial-aid, payroll or research systems, should use phishing-resistant authentication: FIDO2/WebAuthn passkeys, hardware security keys or certificate-based methods. A joint CISA and FBI advisory on Scattered Spider, an actor known for help-desk social engineering, notes that this class of authentication resists push-notification flooding and SIM swapping, which approval prompts and text codes do not. Students need strong authentication matched to what they can reach, not the controls the bursar’s office needs.

Drive deprovisioning from a source of record, such as the student-information or HR system, rather than from someone remembering to raise a ticket.

2. Student and financial-aid data

For US institutions that take part in federal student aid, the Department of Education’s Federal Student Aid office has said that each institution agreed, in its Program Participation Agreement, to comply with the GLBA Safeguards Rule, and that it enforces this through annual compliance audits. The FTC’s rule sets out what the program has to contain: a designated Qualified Individual; a written risk assessment; access controls and an inventory of where customer information lives; encryption at rest and in transit; multi-factor authentication for anyone accessing customer information; logging and monitoring; continuous monitoring, or annual penetration testing with vulnerability scans every six months; oversight of service providers; a written incident response plan; and a written report to the governing body at least once a year.

Treat that annual report as a decision paper, not a compliance artifact. It is the one place where a named person must put the risk in front of the board in writing, with owners and funding requests attached. Institutions outside the US face their own data-protection and sector rules, but the logic carries over: find the stores, name the owner, and give the governing body something it can act on.

Finding the stores is harder than it sounds. Student and aid data often leaves the system of record, into spreadsheets, departmental databases and adviser files. The inventory is the first control, because every other control depends on it.

3. Vendor-held records and support access

In a widely reported incident, an attacker used a compromised credential to get into a customer-support portal run by PowerSchool, a student-information vendor, and from there extracted student and teacher records from the systems of its customers. PowerSchool says the data included names, addresses, Social Security numbers and medical information for some people. It describes a user base of more than 60 million students and teachers across North America. That figure measures the vendor’s reach, not the number of people affected.

In this case the route in was a supplier’s support channel, not a school’s own system. The institution’s decision is therefore about knowing and contracting, not only configuring. Which vendors hold student records? Which can reach your systems through remote support? What has each committed to on authentication, logging and notification time? Ask for evidence rather than assurances.

Where GDPR applies, a processor must tell the controller without undue delay, and the controller must notify the regulator within 72 hours of becoming aware, where feasible. The speed of a vendor’s notice shapes your own options.

4. Research with obligations

Sponsored research brings other parties’ rules onto your network. Where federal agencies sponsor work involving Controlled Unclassified Information, NIST SP 800-171 sets the security requirements, and agencies write them into contracts and agreements. NIST’s latest revision groups the requirements into 17 families, including access control, incident response and supply chain risk management. Which revision applies to a given project depends on what the contract names.

Meeting that standard across a whole campus is rarely proportionate. The usual answer is an enclave: a bounded environment for the regulated work, with its own identity controls, logging and data flows, kept separate from the open network. The harder part is governance. The research office, the CISO and the principal investigator need to agree the boundary before an award starts, not after an auditor asks where the data is.

Regulated work is only part of the picture. Unpublished results, pending patents and partner data deserve classification too. The test is simple: who outside the project team can see this data, and who administers the systems it sits on?

5. Availability of term-critical systems

CISA has described a ransomware actor, Vice Society, that targeted the education sector and threatened to expose sensitive personal information about students and staff for financial gain. That is two harms in one event: systems that stop and records that leak. Recovery planning that covers only the first leaves the second to improvisation.

Availability failures also reach an institution’s finances quickly. An Illinois college that announced its closure said a ransomware attack had disabled the systems it used for recruitment, retention and fundraising, and that enrollment fell short once they were restored. The college pointed mainly to the pandemic as the financial strain, so the attack was not the whole story. It still shows how fast a cyber event can land on an organization whose budget depends on a single enrollment cycle.

Name the systems that must run for the term to run: admissions, the student-information system, the learning platform, identity, payroll, fee collection and exam delivery. Decide the recovery order, with identity first because the rest depend on it, and prove it with a restore test. Keep at least one copy of backups where an intruder with administrator rights cannot reach it.

Use zones, not a perimeter

A campus cannot be locked down without breaking what it is for. Zones work better. An open zone for guests and personal devices. A managed zone for staff and teaching systems. A regulated zone for finance and aid, clinics, research enclaves and exam delivery. The leadership decision is what may move between zones, and how that movement is checked.

Decisions for leadership

1. Name one accountable owner for the identity lifecycle of every population, including those HR does not hire.

2. Require phishing-resistant authentication for staff and for anyone who touches finance, registrar, aid, payroll or research systems.

3. Put the annual written security report in front of the governing body as a decision paper, with risks, owners and funding requests.

4. Inventory the vendors that hold records or have remote-support access, and write authentication, logging and notification time into their contracts.

5. Agree research enclave boundaries with the research office and principal investigators before awards start.

6. Fix the recovery order for term-critical systems and prove it with a restore test that includes identity.

What to track

Five measures show whether these decisions are holding:

• Share of privileged, finance, registrar and aid accounts using phishing-resistant authentication.

• Time from a staff or adjunct departure to account removal.

• Vendors with record or remote-support access, and how many have evidenced their authentication and logging.

• Research projects with regulated data held inside a defined enclave.

• Date and result of the last successful restore of identity and the student-information system.

NEXT STEP A practical start is one working session with the registrar, finance, the research office and IT, walking through the five priorities above and agreeing an owner for each.

Sources

• FTC Safeguards Rule: What Your Business Needs to Know. Federal Trade Commission.

• FSA Issues GLBA Safeguards Rule Guidance (summary of Federal Student Aid position). Thompson Coburn LLP.

• #StopRansomware: Vice Society. Cybersecurity and Infrastructure Security Agency (CISA).

• Scattered Spider joint cybersecurity advisory. CISA and FBI.

• PowerSchool data breach reporting. Tech.co.

• PowerSchool data breach threat report (summarizing PowerSchool and CrowdStrike findings). Anvilogic.

• Lincoln College to close permanently after ransomware attack. GovTech.

• NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. NIST Computer Security Resource Center.

• GDPR Article 33: Notification of a personal data breach to the supervisory authority. GDPR text, gdpr-info.eu.