Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/29/2020
01:10 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Aim BEC Attacks at Education Industry

Heightened vulnerability comes at a time when the sector has been focusing on setting up a remote workforce and online learning amid the pandemic.

K-12 schools and colleges are more than twice as likely to get hit with a business email compromise (BEC) than companies outside of the education industry, new research has found.

According to Barracuda Networks, BECs accounted for 28% of all spear-phishing attacks aimed at educational institutions, while for all other verticals it was 11%. In addition, within education 57% of malicious emails came from internal – primarily students' – email accounts.

"We found that the students don't use email and administrators aren't always paying attention to those accounts," says Mike Flouton, vice president of Barracuda's email security business. "From an attacker's perspective, it's just much easier to go unnoticed."

The research, released today, is based on an analysis of more than 3.5 million spear-phishing attacks, including attacks against more than 1,000 educational institutions from June through September 2020. The point of the research, Flouton says, was to show the education community just how vulnerable it is to BEC attacks, along with the need to improve training and overall security awareness.

In the past 18 months, several BEC cases at school districts came to light. Most recently, a school district in Clark County, Nevada, refused to pay a ransom after a hacker stole private data on thousands of students. As a result, the student data was released on an underground forum.

Related Content:

Ransomware Strikes 49 School Districts & Colleges in 2019

2020 State of Cybersecurity Operations and Incident Response

New on The Edge: Tracking Down the Web Trackers

In another example, Manor Independent School District in Texas reported in January that a seemingly typical school-to-vendor transaction resulted in a loss of $2.3 million. And in April 2019, attackers used a fraudulent email to steal $3.7 million from Scott County Schools in Kentucky.

"K-12 schools are much more vulnerable than colleges and universities, as they have more reliance on email for work orders and communications … with a less mature security posture and less IT staff and … training," says Ruthbea Yesner, vice president, government insights, education and smart cities at IDC. "As a result, combined with online work because of the pandemic, we have seen a rise in ransomware and other attacks on schools. The dollar value may be lower as compared to a bank, but that's only because the hackers want to get paid and they know the capabilities of schools are limited. 

Tim Keeler, founder and CEO of privileged access security provider Remediant, points out how the education sector has become disproportionately vulnerable to BECs during the pandemic. Security teams at colleges had limited time to secure the perimeter as students, staff, faculty, and researchers were sent home to work remotely, he says. Similarly, K-12 schools were focused on setting up and enabling a blended remote/on-premises classroom and had limited time or appetite for security awareness training.

"Both colleges and schools make great targets for attackers looking for notoriety and media coverage as they are highly visible entities, yet are price-sensitive," Keeler says. "Unfortunately, the education sector has perpetually underinvested when it comes to security tools, best practices, and [full-time employees]."

BEC Prep Lesson Plan
The Barracuda report offers schools districts four tips to better prepare for BEC attacks:

1. Invest in protection against targeted phishing attacks: Attackers realize the education industry doesn't always have the same level of security sophistication as other verticals, and they take advantage of it. Schools, colleges, and universities need to prioritize email security that leverages artificial intelligence to identify unusual senders and requests. This additional layer of defense, on top of traditional email gateways, will offer substantial protection against spear-phishing attacks for both staff and students.

2. Deploy account takeover protection: Educational institutions are more susceptible to account takeover than an average organization because many don't have the necessary tools and resources to protect against this threat. Invest in technology that will let the organization identify suspicious activity and potential signs of account takeover.

3. Improve security awareness education: Educate users about BECs and other email threats. Ensure that staffers and students can recognize attacks, understand their fraudulent nature, and know how to report them. It's especially important now when remote learning has become such a big part of the education system and students and teachers rely on technology and email for both communication and educational purposes.

4. Set up internal policies to prevent wire transfer fraud: All organizations should establish and regularly review existing school policies to ensure personal and financial information gets handled properly. Help employees avoid making costly mistakes by creating guidelines and putting procedures in place to confirm all email requests for wire transfers and payment changes. Require in-person or telephone confirmation and/or approval from multiple people for all financial transactions. Remember: It's not always about the technology. Creating policies and procedures that people understand and will follow can go a long way to preventing attacks.

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Yenrab
50%
50%
Yenrab,
User Rank: Strategist
10/30/2020 | 9:56:42 AM
Whodda Thunk?
While I understand the concern, these are professional educators and are willing to learn nothing.  It's not worth the cost of the electricty to generate an email to those that are in charge of "edumacations" in this country and that is why they are such ripe targets.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
The Yellow Brick Road to Risk Management
Andrew Lowe, Senior Information Security Consultant, TalaTek,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14190
PUBLISHED: 2020-11-25
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
CVE-2020-29074
PUBLISHED: 2020-11-25
scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
CVE-2020-14191
PUBLISHED: 2020-11-25
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
CVE-2020-29070
PUBLISHED: 2020-11-25
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVE-2020-26212
PUBLISHED: 2020-11-25
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of ever...