The education industry has gone through a major transformation over the last ten years. Online degree programs, virtual classrooms, and cloud-based student portals are just some of the benefits of technology providing accessible and convenient ways for students to learn. Students can now submit their homework, communicate with teachers, view their transcripts, and earn a complete degree without ever going to campus.
With this increase in digital capabilities of educational institutions comes an increase in concerns regarding cybersecurity and student privacy. As evidenced by recent reports regarding the Strategic Education Inc. data breach investigation, there is greater focus on protecting the sensitive data that is kept in many educational organizations. While each cybersecurity incident has individual circumstances, every single incident serves as a reminder of the challenges that educational institutions face with protecting personal data.
The Growing Amount of Data Collected by Educational Institutions
Many types of data are collected by colleges, universities, and online institutions from students and applicants. It is important to collect these types of information for enrollment, administration of financial aid, record keeping of academic information, and verifying identity.
Some examples of types of data that are typically kept at educational institutions are:
- Full Name and Address
- Email Address and Phone Number
- Social Security Number
- Driver's License Information
- Passport Information
- Financial Aid Information
- Academic Transcripts
- Payment/billing Information
Educational institutions typically keep records related to student applicants for a long time, and, therefore, they can be a significant target for cybercriminals wanting to access sensitive information such as the above-mentioned items.
Why Cybercriminals Target Educational Organizations
Large databases containing a great deal of personal, and financial data are owned by educational institutions, mainly in comparison with many other companies, such as retailers who mainly hold on to customer records. In contrast, educational institutions can keep record for current, former students as well as their faculty, staff, contractors and Alumni.
Education suffers from a number of different cybersecurity vulnerabilities:
Large User Base
Schools and Universities, and online learning institutions can provide access to thousands, and millions of students (and support staff). Managing account and access control for so many users (and accounts) is time consuming, difficult and this creates additional security points.
Multiple Systems Connected
Educational facilities often have connected multiple different software applications for:
1. Admissions
2. Course Management
3. Financial Aid
4. Student Communication
5. Administrative Functions
Each Software application can create additional security points as they are already connected to the institution’s network/system.
Remote Learning Environments
The increase in remote / hybrid learning has grown the number of devices connected to the institution’s network/system. Students and staff may be accessing sensitive data via home networks, public Wi-Fi or personal devices.
Third Party Vendors
Schools often use third-party service providers to offer educational technology solutions. Although there can be tremendous benefits to having external service providers work with the institutions, they can also create additional risk as they could cause problems and/or have security issues with their technology.
When there is an unauthorized access to information, it has consequences for the individuals whose information was compromised and for educational institutions. Individuals that had their information compromised may be concerned about their identity being stolen as well as possible financial fraud and unauthorized use of their personal information. Educational institutions may experience disruption of services, damaged reputations, and increased costs to investigate the incident and improve security.
Victims of an unauthorized access incident often take precautionary measures to prevent becoming victims of identity theft even if no unauthorized access was found by investigating agencies (monitoring accounts, obtaining copies of credit histories, and changing passwords).
With the increasing use and reliance upon digital systems, cyber security is more than just being an IT issue; it has become an important factor in building the trust that both educational institutions have in their students, and the communities they serve.
Best Practices for Protecting Student Information
Educational institutions have an important responsibility for protecting sensitive data, but students have a personal responsibility to take steps to protect their own data.
Enable Multi-Factor Authentication
Multi-factor authentication, when available, is an added level of protection because it requires an additional form of verification in addition to a password.
Create Unique Passwords
Choosing unique and strong passwords for your educational accounts will help to reduce the possibility of someone gaining unauthorized access.
Be Aware of Phishing Schemes
Cybercriminals use email as a method to attempt to gain personal information from unsuspecting victims. Emails sent to students that appear to be from a trusted source may be an attempt to solicit personal information; students should verify that the email is legitimate before responding to any requests for personal information.
In order to detect anything suspicious on your account early, you should check your financial statements and credit reports frequently.
Your computer(s) and mobile device(s) should be kept up-to-date through software and security updates. This will help to mitigate your risk of a cyber attack due to any current vulnerabilities.
Looking Ahead
As technology continues to transform the way we deliver education, institutions will need to continue focusing on cybersecurity as a critical area of compliance within their organization. Students expect to access services conveniently through digital technology, but they also expect that organizations will use their information responsibly.
The future of education will rely even more heavily on artificial intelligence, cloud services, and collaborative learning environments. While there are tremendous opportunities for these technologies to enhance education, they will continue to increase the need for institutions to maintain sound cybersecurity measures and safeguard sensitive data.
Institutions that focus on establishing a strong cybersecurity culture and invest in state-of-the-art technology, as well as educating faculty, staff, and students on the importance of cybersecurity will have a greater chance of succeeding in this rapidly evolving digital environment. Additionally, students who learn about basic cybersecurity will also be able to help protect their own information and contribute to creating a secure online learning environment.
