In recent years, for any institution that has developed a risk register, it is probable that cyber risks are within the top five of all concerns. Cyber extortion and ransomware continue to dominate the headlines, with educational institutions at all levels, from K-12 to higher education, consistently experiencing their effects.
Enhanced Education Risk Management amid Lingering Cyber Threats
Since 2020, numerous educational institutions have enhanced their risk management procedures. This includes incorporating measures like multifactor authentication, endpoint detection and response, intensified employee training, and segmented backups. These enhancements improved their risk profile and enabled navigation of the cyber insurance marketplace with more ease. Unfortunately, threat actors continue to infiltrate vulnerabilities and compromise vendors, leading to social engineering crime and extortion losses.
Rising Ransomware Incidents
As noted in the Sophos report, “The State of Ransomware in Education 2023,” 80% of lower education and 79% of higher education providers reported being hit by a ransomware incident, compared to 56% and 64% respectively the prior year. The primary origins of these attacks were traced back to exploited vulnerabilities and compromised credentials. Additionally, almost 50% of all educational institutions paid a ransom, largely due to the challenges with data recovery from backups.
In a landscape where digital threats loom large and the tactics of cybercriminals grow increasingly sophisticated, a static and one-size-fits-all approach to cyber risk management falls short. These findings, in tandem with numerous cases documented in RCM&D’s Education Practice, emphasize the necessity for ongoing assessment of cyber risk procedures. This is not solely to meet prerequisites for obtaining cyber insurance, but also to be prepared with an effective response to an actual extortion event.
Maintaining effective digital risk inventories and participating in cyber extortion tabletop disaster drills to test your incident response plan should be part of your overall cyber risk hygiene policies and procedures. By subjecting protocols to such drills, educational institutions can uncover vulnerabilities, refine procedures, and fine-tune coordination among various teams.
Reach out to an Advisor
The journey to bolster cyber resilience within educational institutions is an ongoing endeavor that requires unwavering commitment. Reach out to an advisor to learn how RCM&D’s Education Practice can help.