No Spring Break for Schools: Social Engineering Attacks on the Education Sector

Social Engineering Attacks on the Education Sector

May 2022

The most logical way to proceed now would be to cancel the deactivation… But wait, let’s first give it a thought: Have you ever requested an email deactivation? Why is it with the urgency? And why does the email contain some grammar mistakes? And hold on a second, it doesn’t even say your name, how can you be sure this email is addressed to you?

The human factor, the education sector‘s biggest challenge

According to Garry Scobie, Deputy CISO at the University of Edinburgh, educational organizations’ first and foremost threat is social engineering, as well corroborated by the Verizon’s Data Breach Investigations Report (DBIR), which states that in 2021 the number one initial attack vector on educational services was social engineering. However, the problem with this type of attack is not its scope, but its consequences: last year the average cost of a cyberattack caused by social engineering was $4.47 million, as IBM highlights.

‘’Educational organizations first and foremost threat is social engineering’’ – Garry Scobie, Deputy CISO at the University of Edinburgh

But what exactly is social engineering and how can we identify it?

The main characteristic of this type of attack is the hacker’s manipulation of the victim. Social engineering attacks seek to gain unauthorized access or confidential information by exploiting human error. Essentially, this technique is based entirely on the manipulation of humans, since hackers, once they know the motivations and vulnerabilities of users, manage to take advantage of them in order to infiltrate their victims’ systems.

According to Kaspersky, social engineering attacks include certain patterns, such as:

• Provoking heightened emotions in the user
• Urging the user to perform a certain action
• Convincing the user of the legitimacy of the communication

Moreover, this dangerous technique includes several types of cyberattacks, from whaling, business email compromise (BEC), and pretexting to Quid Pro Quo, Honeytrap, or USB baiting, not to mention phishing attacks, the star of the show.

Phishy tricks against educational organizations

IBM’s X-Force Threat Intelligence Index 2022 confirmed that last year’s top infection vector threat was phishing, which is ‘’a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person,’’ as defined by the NIST’s Computer Security Resource Center.

And it seems that in the last few years this infection vector has not stopped targeting the education sector, as indicated by the American Consortium for School Networking (CoSN), which stated that more than 90% of cyberattacks in schools start with phishing campaigns.

But why, you’ll wonder, are educational institutions so heavily targeted?

Garry Scobie believes that the fact that the organizations in this sector suffer so many cyberattacks is mainly due to an extensive attack surface which can result in numerous vulnerabilities. The amount of valuable information stored, along with rapid digitization and extensive use of BYOD devices, makes the environment an attractive target for cybercriminals.

A great example of this is the cyberattack suffered by the University of California San Diego Health in early 2021, when an employee’s email was compromised through phishing, allowing hackers to get their hands on the personal and medical data of students, employees, and patients.

However, we must not forget the lethality of other types of attacks on educational institutions caused by hackers exploiting the accounts of privileged users, i.e. those who have administrative access to an organization’s critical systems, since, as Forrester Research indicates, 80% of data breaches are related to compromised privileged accounts.

“The large attack surface is the main reason hackers target the education sector” – Garry Scobie, Deputy CISO at the University of Edinburgh

Cybersecurity solutions that face up to social engineering

Social engineering attacks are easy to click on but difficult to get rid of. With the number of cyberattacks on educational institutions on the rise, IT departments have the imperative task of raising awareness among students, faculty, and staff. By educating them, the education sector will be able to prevent serious tragedies.

In general, the major cybersecurity problem for educational institutions is associated with access and identities. User passwords are stolen from databases or through phishing scams or are simply weak and easy to crack by hackers with the right tools.

Multi-factor authentication (MFA) offers an effective solution to this problem by requiring users to authenticate with more than one factor. With a password plus a unique identifier, the system receives two layers – or factors – of proof that a user is who they say they are.

On the other hand, the Single Sign-On (SSO) principle provides organizations with a single authentication for users of all their applications, simplifying their lives and facilitating efficiency. But SSO not only brings benefits for standard users, but this type of tool also saves IT, administrators, a significant amount of time.

WALLIX solutions, educational organizations’ new best friends

WALLIX enables organizations in the education sector to meet these pressing challenges with its simplified cybersecurity solutions. WALLIX’s MFA tool creates a layered defense in depth and enhances cybersecurity by protecting users’ remote access to IT, applications, and data, with a highly secure connection wherever they are and facilitating the “Zero Trust” risk management policy.

In addition, WALLIX Trustelem simplifies and secures access to the educational organization’s key applications from a centralized platform. This efficient solution provides users with a Single Sign-On experience, so they do not have to manage a different password for each target application and enter credentials repeatedly.

However, the comprehensive protection of the education sector does not end there. IT departments must also protect themselves effectively against all types of threats, as they are the ones holding accounts with access to the most critical resources, and with great privilege comes great responsibility. A unified privilege solution such as WALLIX PAM4ALL enables IT teams in the education sector to secure, control and manage all access, whether human or machine, to the infrastructure.

Find out how all WALLIX solutions help you protect your educational organization by watching the Cybersecurity Strategy in the Education Sector webinar and learn from Garry Scobie, the University of Edinburgh’s CISO, about the cyber threats facing the education sector.

For more information, do not hesitate to contact our experts. They will be happy to assist you!