The education sector, often seen as the backbone of society, has been increasingly targeted by cybercriminals, with ransomware attacks on the rise. A recent survey conducted by Sophos, a global leader in cybersecurity, sheds light on the alarming state of ransomware attacks within the education sector in 2022. The report, titled “The State of Ransomware in Education 2023,” reveals significant vulnerabilities and the implications of ransom payments for educational organizations.
Ransomware attacks on the rise
The Sophos survey discovered a worrisome trend in the education sector, with the highest rate of ransomware attacks reported in 2022. An astonishing 79% of higher and 80% of lower educational organizations fell victim to ransomware, marking an increase from the previous year’s statistics. This escalating trend has caught the attention of educators and cybersecurity professionals alike as the education sector grapples with mounting challenges in safeguarding sensitive data.
The costly consequence of paying ransoms
While ransomware attacks are inherently disruptive, the report reveals an equally concerning pattern of ransom payments in education. Over half of higher educational organizations (56%) and nearly half of lower educational organizations (47%) chose to pay the ransom demanded by cybercriminals.
Contrary to expectations, paying the ransom significantly inflated recovery costs for both groups. Higher educational organizations that paid the ransom experienced recovery costs of $1.31 million, compared to $980,000 when using backups. For lower educational institutions, the prices surged to $2.18 million when paying the ransom, while utilizing backups incurred expenses of $1.37 million. These findings emphasize that compliance with ransom demands may be something other than educational institutions’ most prudent financial decision.
Lengthened recovery times
Another primary concern resulting from ransom payments was the extension of recovery times. The report indicates that for higher educational organizations, 79% of those relying on backups recovered within a month, whereas only 63% of those who paid the ransom achieved the same timeframe for recovery. Similarly, lower educational institutions experienced slower recovery times, with 63% of those using backups recovering within a month, compared to 59% of those who paid the ransom.
Compromised credentials- A common root cause
The survey also explored the root causes of ransomware attacks in education. Across all educational organizations, there was a significantly higher number of seizures resulting from compromised credentials (37% for higher education and 36% for lower education) compared to the cross-sector average of 29%. This highlights the urgent need for more robust authentication measures to prevent unauthorized access.
The role of Multi-factor Authentication (MFA)
Sophos’ Chief Technology Officer, Chester Wisniewski, stressed the importance of implementing multi-factor authentication (MFA) in educational institutions. The lack of MFA adoption in the sector makes it more susceptible to credential-based attacks. Schools can significantly reduce the risk of cyberattacks and protect sensitive information by mandating MFA for faculty, staff, and students.
Best practices to defend against ransomware
To mitigate the rising threat of ransomware attacks, Sophos recommends several best practices for educational institutions:
1. Strengthen defensive shields- Utilize security tools with anti-exploit capabilities and Zero Trust Network Access (ZTNA) to protect against common attack vectors. Implement adaptive technologies for automatic attack response and consider 24/7 threat detection and response services.
2. Optimize attack preparation- Regularly back up data, practice recovery procedures, and maintain an up-to-date incident response plan to facilitate swift recovery in the event of an attack.
3. Maintain security hygiene- Timely patching and regular review of security tool configurations are vital in maintaining robust cybersecurity.
Conclusion
Institutions must take proactive measures to safeguard their data and infrastructure as the education sector faces an alarming surge in ransomware attacks. Sophos’ report underscores the significance of utilizing backups and avoiding ransom payments to minimize recovery costs and downtime. By prioritizing cybersecurity and adopting multi-factor authentication, educational organizations can strengthen their defense against cyber threats, ultimately ensuring the continuity of education and safeguarding the privacy of students and staff.
Image Source- Freepik