Strategies for Digital Safety and Cybersecurity in Schools

Digital safety and cybersecurity have become crucial in the educational context due to the increasing reliance on technology in classrooms and the wider educational environment. 

Schools and educational institutions collect and store vast amounts of sensitive data, including personal details, academic records and health information. Ensuring digital safety is essential to protect this data from unauthorised access, breaches or misuse. A breach or cyber incident can severely damage an educational institution’s reputation, leading to a loss of trust among parents, students and the community. Effective cybersecurity practices help maintain this trust by demonstrating a commitment to protecting the school community. 

Cybersecurity laws and regulations for schools fall under broader data protection and cybersecurity frameworks. Schools, like other organisations, must comply with several key laws and guidelines to ensure that they protect personal data and maintain a secure IT environment. Some of the main cybersecurity-related legal requirements for schools in the UK include:

• Data Protection Act 2018 (DPA 2018) and the General Data Protection Regulation (GDPR) – schools must comply with the DPA 2018, which incorporates the GDPR into UK law. This legislation requires schools to ensure the security and confidentiality of personal data they handle, including student and staff information. Under the GDPR, schools are required to report certain types of personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach.
• The Education (Pupil Information) (England) Regulations 2005 – schools are required to manage and share pupil information in a secure manner, with clear guidelines on what information can be shared and how it should be protected.
• Computer Misuse Act 1990 – schools must ensure that their IT systems are secure and not used for unauthorised access or hacking. This law makes it an offence to access computer systems without permission.
• Network and Information Systems (NIS) Regulations 2018 – while primarily aimed at critical infrastructure, these regulations also apply to certain essential service providers, which can include educational institutions. Schools must ensure robust cybersecurity practices to protect against attacks that could impact the delivery of their services.
• Prevent Duty Guidance – as part of the Counter-Terrorism and Security Act 2015, the Prevent duty requires schools to have due regard to preventing people from being drawn into terrorism. This includes safeguarding students from online radicalisation and ensuring the secure use of IT systems.
• Safeguarding and child protection policies – schools must have safeguarding policies that include measures to protect children online. This includes implementing filters and monitoring systems to prevent access to harmful content and ensuring secure communication channels.
• Ofsted requirements – Ofsted, the regulatory body for schools in England, assesses how schools manage online safety. Schools must demonstrate that they have effective cybersecurity and online safety policies in place, including staff training and awareness programmes.
• Public Sector Network (PSN) compliance – if a school is part of the public sector network, it must comply with PSN security standards, which are designed to protect data and maintain the integrity of public sector IT systems.
• National Cyber Security Centre (NCSC) guidance – although this is not legally binding, the NCSC provides guidance for schools on cybersecurity best practices. Schools are encouraged to follow this advice to enhance their cybersecurity posture.
• Freedom of Information Act 2000 (FOIA) – schools are public bodies and must comply with FOIA, ensuring that they handle and store information securely. This includes managing information in a way that reduces the risk of unauthorised access.

Schools are required to take these legal frameworks seriously and implement robust cybersecurity measures to protect their systems and the sensitive data they handle. Non-compliance can lead to significant penalties, including fines from the ICO, reputational damage and legal action.

Understanding the Cybersecurity Landscape

Types of Threats

Schools face a range of cybersecurity threats that can jeopardise the safety of their data, disrupt educational activities, and compromise the privacy of students and staff. Here are some common threats:

• Phishing attacks – cybercriminals often use phishing emails to trick school staff and students into providing sensitive information, such as login credentials or personal data. These emails may appear to be from legitimate sources, like school administration or trusted vendors.
• Social engineering – social engineering attacks involve manipulating individuals into divulging confidential information. Attackers may pose as IT staff, administrators or trusted individuals to trick school personnel into revealing passwords or other sensitive information.
• Ransomware – ransomware attacks involve malicious software that encrypts a school’s data, making it inaccessible until a ransom is paid. Schools, which often have limited IT resources, are vulnerable to these attacks and may struggle to recover their data.
• Data breaches – schools store large amounts of personal information, including student records, staff details and financial information. A data breach can occur if unauthorised individuals gain access to this data, leading to identity theft, financial loss and privacy violations.
• DDoS (Distributed Denial of Service) attacks – DDoS attacks involve overwhelming a school’s network with traffic, causing it to slow down or crash. This can disrupt online learning platforms, communications and access to school resources.
• Malware – malware, including viruses, worms and trojans, can infect school computers and networks, leading to data loss, system outages and potential exposure of sensitive information.
• Weak passwords and poor authentication practices – many schools face issues with weak passwords and poor authentication practices. Without strong passwords and multi-factor authentication, unauthorised users can easily gain access to school systems and data.
• Unsecured Wi-Fi networks – schools often have multiple Wi-Fi networks for students, staff and guests. If these networks are not properly secured, they can be exploited by attackers to intercept data or gain unauthorised access to school systems.
• Inadequate cybersecurity training – a lack of cybersecurity awareness among staff and students can lead to accidental exposure to threats. Without proper training, individuals may fall victim to phishing, click on malicious links or use weak passwords.
• Outdated software and systems – schools often operate on tight budgets and may use outdated software and systems that lack the latest security patches, making them more vulnerable to cyberattacks.
• Third-party vendor vulnerabilities – schools often rely on third-party vendors for various services, such as learning management systems, student information systems and financial services. If these vendors have weak security measures, they can become a point of entry for cyberattacks.
• Mobile device vulnerabilities – with the increasing use of mobile devices for learning, schools face the challenge of securing these devices. Unsecured mobile devices can be a target for malware, unauthorised access and data theft.

These threats highlight the importance of having robust cybersecurity policies, regular training and up-to-date technology to protect school environments.

Impact of Cyber Incidents

Cyberattacks on schools can have significant and far-reaching impacts that affect not only the institution but also students, staff and the broader community. Here are some of the major impacts:

• Disruption of education – cyberattacks, particularly ransomware attacks, can lead to the shutdown of critical IT systems, disrupting access to online classes, educational materials and digital tools necessary for learning. In severe cases, schools may need to cancel classes until systems are restored.
• Financial costs – schools targeted by ransomware may face demands for payment to restore access to their systems. Even the cost of recovering from an attack alone can be substantial. Recovering from a cyberattack often requires significant investment in IT support, software upgrades and cybersecurity measures to prevent future incidents.
• Data breaches and privacy concerns – cyberattacks can lead to the theft of personal information, including student records, staff payroll data and health records. This exposure can have long-term consequences for victims, including identity theft and privacy violations.
• Impact on trust – a cyberattack can erode trust in the school’s ability to protect its community, leading to concerns about the safety and security of the school’s IT infrastructure. Repeated or high-profile cyberattacks can damage the reputation of a school, leading to a loss of confidence among students, parents, staff and the broader community.
• Administrative disruptions – cyberattacks can disrupt administrative functions such as grading, attendance tracking and communication, complicating the daily operations of the school.

Building a Robust Cybersecurity Strategy

Risk Assessment

Conducting regular risk assessments to identify vulnerabilities and threats of cyberattacks in schools is crucial for safeguarding sensitive data and ensuring the security of both students and staff. IT staff, school administrators, teachers, and possibly external cybersecurity experts should be part of this process. Define clear roles for each member, such as data collection, threat analysis and risk mitigation.

All digital assets should be identified, including hardware, and the types of data being processed should be listed, for example student records, financial information and emails. Potential threats should be identified, for example phishing, malware, ransomware and DDoS attacks, and consider insider threats from staff or students, either intentional or accidental. Environmental threats from natural disasters, power outages or other events that could disrupt IT systems should also be considered. Some other things to consider:

• Assess vulnerabilities such as outdated software, unpatched systems, weak passwords, unsecured applications, unsecured Wi-Fi, unencrypted communications and lack of network segmentation. Lack of cybersecurity awareness among staff and students, poor access control and inadequate training also need to be considered. Unsecured access to server rooms, data centres or devices can also be a risk.
• Estimate the probability of each threat exploiting a vulnerability and assess the potential impact on the school’s operations, reputation and legal standing. Combine likelihood and impact to prioritise risks. Use a risk matrix to categorise them, e.g. low, medium, high.
• Install firewalls, anti-malware software, encryption and multi-factor authentication (MFA). Develop policies and procedures for data handling, incident response and regular software updates. Secure physical access to sensitive areas, use surveillance systems and implement access controls. Regularly train staff and students on cybersecurity best practices.
• Maintain a risk register that logs identified risks, their assessments and the mitigation actions taken. Generate regular reports for school leadership outlining risks and the measures taken to address them.
• Use automated tools to continuously monitor the network for suspicious activities. Schedule periodic reviews to reassess risks and update the risk register. Conduct regular drills to ensure the effectiveness of your incident response plan.
• Encourage feedback from staff and students to identify potential vulnerabilities that may not have been considered and stay updated on the latest cybersecurity threats and trends that could impact the school environment. Regularly update security measures and training programmes based on new risks and vulnerabilities.

Security Policies

Establish clear goals for cybersecurity, such as protecting sensitive data, ensuring continuity of education and complying with legal standards. You should develop specific policies on:

• Data protection
• Access control
• Acceptable use
• Incident response
• Remote learning
• Legal compliance

You should deploy antivirus, anti-malware and firewall solutions across all devices and networks and implement encryption for sensitive data, both in transit and at rest.

Ensure that all software and systems are regularly updated to protect against known vulnerabilities and separate the network into different segments, for example administrative, student and guest, to limit access to critical systems.

Implementing Technical Safeguards

Network Security

Implementing strong firewalls to control incoming and outgoing network traffic, and preventing unauthorised access, is important when considering network security. Deploying updated antivirus and anti-malware software on all school devices is also important.

Using WPA3 encryption for Wi-Fi networks and using separate student and staff networks will provide additional security. Web content filtering can block access to inappropriate or harmful websites and Intrusion Detection and Prevention Systems (IDPS) monitor network traffic for suspicious activity and can block potential threats. Virtual Private Network (VPN) ensures secure remote access for staff working from home or remote locations.

Data Protection

Data protection in schools is a critical issue as schools handle vast amounts of personal information about students, staff and parents. Ensuring that this data is managed responsibly and securely is vital for protecting individuals’ privacy and complying with legal requirements. 

When thinking about data sharing and using third-party services, for example cloud storage and educational apps, ensure they comply with relevant data protection laws and have adequate security measures in place. Establish clear agreements outlining how data will be shared with external organisations, ensuring they understand their obligations to protect that data.

There should be a plan in place for responding to data breaches. This includes notifying affected individuals and relevant authorities promptly if a breach occurs.

Backup and Recovery

Establishing regular backup procedures and ensuring data recovery capabilities are critical components of digital safety for schools. Given the sensitive nature of educational data, it is essential to create a robust framework that safeguards information against loss, corruption or unauthorised access. 

Use local servers or external hard drives to create on-site backups. Ensure that these are stored securely in a physically safe environment. Implement cloud storage solutions for off-site backups. Cloud backups provide redundancy and are less vulnerable to local disasters.

For critical data, set up automated daily backups. Ensure that backups happen outside of school hours to avoid disruptions. Conduct full backups weekly, capturing all data, not just the changes. Between full backups, perform incremental backups to capture only the data that has changed since the last backup.

Educating and Training Students and Staff

Cybersecurity Awareness

Providing regular training and resources on cybersecurity best practices is essential for maintaining a secure environment in educational institutions. Develop a comprehensive curriculum covering key topics such as password security, phishing, data protection and safe internet use. There are various ways to provide training including:

• Interactive workshops – host live workshops and webinars with interactive elements such as Q&A sessions and case studies.
• E-Learning modules – provide online training modules that can be completed at the individual’s convenience.
• Simulations and drills – conduct phishing simulations and security drills to provide hands-on experience.
• Micro-learning – offer short, focused training sessions or tips delivered via email or internal platforms.
• Updates and refresher courses – regularly update training materials to reflect the latest threats and best practices. Offer refresher courses as needed.
• Gamification – incorporate game elements, such as quizzes and leader boards, to make learning more engaging.
• Recognition and rewards – recognise and reward individuals or teams who demonstrate strong cybersecurity practices.
• Provide resources and support – create a centralised repository of resources, including guidelines, FAQs and best practice documents.
• Helpdesk and support – offer access to cybersecurity experts for questions and support.

Creating a Cybersecurity Culture

Implement and enforce school-wide cybersecurity policies, such as acceptable use policies for technology and data protection guidelines. Start clubs or teams that focus on cybersecurity, where students can engage in projects, competitions and discussions.

Encourage students to share their knowledge and experiences with their peers to foster a collaborative learning environment. Organise events like cybersecurity awareness weeks or competitions to engage students and raise awareness. 

Invite cybersecurity professionals to speak to students about real-world applications and career opportunities in the field. Facilitate opportunities for students to gain practical experience and insights into the cybersecurity industry.

Engaging with Parents and the Community

Parental Involvement

Parental involvement in cybersecurity in schools is crucial for creating a safe online environment for students. 

Offer sessions to educate parents on cybersecurity practices and how to support their children in staying safe online. Provide resources and tips that parents can use at home to reinforce cybersecurity lessons. Provide parents with resources such as guides, checklists and articles on topics like strong password creation, recognising phishing scams and safe browsing habits.

Keep parents informed about the school’s cybersecurity policies and any incidents that might affect their children. Establish communication channels where parents can ask questions and get support on cybersecurity issues. Include parents in discussions about cybersecurity policies to ensure that they are realistic and address concerns from both the school and home perspectives.

You should implement systems for parents to provide feedback on existing policies and suggest improvements.

Community Partnerships

Community partnerships can play a significant role in strengthening cyber security in schools. Collaborating with local law enforcement and cybersecurity experts is a critical strategy for enhancing cybersecurity in schools. Such partnerships provide schools with the necessary resources, knowledge and support to protect their digital infrastructure and safeguard students and staff from cyber threats. 

By fostering strong collaboration between schools, local law enforcement and cybersecurity experts, schools can build a resilient defence against cyber threats, ensuring a safer digital environment for students and staff.

Monitoring and Responding to Cybersecurity Incidents

Incident Response Plan

Creating a clear incident response plan for addressing and managing cybersecurity breaches in schools is crucial for protecting sensitive information and ensuring the safety of students, staff and the educational institution as a whole. Here’s a structured approach to developing such a plan:

• Form an incident response team – include IT staff, school administrators, legal counsel, communications personnel and security experts. Define roles and responsibilities for each member.
• Develop and document policies – outline acceptable use policies, data protection policies and incident response procedures.
• Monitor systems continuously – implement security monitoring tools to detect unusual activities, unauthorised access and potential breaches.
• Report suspicious activities – establish a clear process for staff and students to report suspicious activities. This could include a dedicated email address, phone number or online reporting form.
• Isolate affected systems – immediately isolate compromised systems to prevent the breach from spreading. This could involve disconnecting affected devices from the network or disabling certain accounts.
• Short-term containment – implement temporary measures to contain the breach, such as blocking malicious IP addresses, resetting compromised credentials and enabling multi-factor authentication (MFA).
• Long-term containment – implement more permanent fixes, such as patching vulnerabilities, reconfiguring firewalls and updating security protocols.
• Identify the root cause – conduct a thorough investigation to determine how the breach occurred and what vulnerabilities were exploited.
• Remove threats – eliminate any malicious code, unauthorised access points or compromised accounts from the system.
• Update security measures – apply patches, update software and strengthen security configurations to prevent future breaches.
• Restore affected systems – rebuild and restore any compromised systems from clean backups. Ensure all systems are free of malware before reconnecting them to the network.
• Validate system integrity – test the restored systems to ensure they are functioning correctly and that no backdoors or residual malware are present.
• Monitor for recurrence – keep a close watch on the network for any signs of the breach recurring or any new suspicious activities.
• Internal communication – keep the IRT and relevant school staff informed throughout the incident response process.
• External communication – notify students, parents and stakeholders as appropriate. Be transparent about what happened, what is being done and what steps they should take.
• Legal and regulatory reporting – report the breach to relevant authorities, such as the Department for Education or other regulatory bodies, as required by law.

Continuous Monitoring

After a cyberattack, remnants of the threat, such as malware or backdoors, may still be present within the system. Continuous monitoring helps identify and neutralise these residual threats that might have been missed during the initial response.

Cybercriminals often launch secondary attacks after the initial breach, exploiting vulnerabilities that were introduced or exposed during the first attack. Monitoring ensures that any subsequent malicious activity is quickly detected.

Continuous monitoring allows organisations to assess whether their security measures are effectively mitigating risks post-incident. This ongoing assessment helps in ensuring that the defences are functioning as intended and that no new vulnerabilities have been introduced.

Case Studies and Best Practices

Successful Implementations

Schools around the world are increasingly focusing on enhancing their digital safety and cybersecurity measures to protect students, staff and data. Here are some examples of schools that have effectively enhanced their cybersecurity measures:

• Los Angeles Unified School District (LAUSD), USA – after experiencing a significant ransomware attack in 2022, LAUSD invested heavily in cybersecurity. The district developed a comprehensive incident response plan, increased their cybersecurity budget, and enhanced their network defences. LAUSD implemented mandatory cybersecurity training for all staff, emphasising phishing prevention and safe online practices.
• St. Paul’s School, London – implemented a robust cybersecurity framework that includes the use of advanced firewall protection, regular penetration testing and a strong incident response plan. These measures have significantly strengthened the school’s ability to prevent and respond to cyber incidents, ensuring the safety of their students’ data and online activities.
• London Grid for Learning (LGfL) – LGfL provides comprehensive cybersecurity services to over 3,000 schools across London and other parts of the UK. They offer services like malware protection, web filtering and cybersecurity training for staff. Schools using LGfL services benefit from collective security, where threats identified in one school can lead to protections being updated across all member schools. Their work has been pivotal in reducing cyber threats in London schools.

Lessons Learned

Schools often operate on tight budgets, which means that IT departments are typically underfunded and understaffed. This makes it difficult to implement comprehensive cybersecurity measures. 

Teachers, staff and students may lack basic cybersecurity knowledge, making them susceptible to phishing attacks and other social engineering tactics. 

By focusing on the most critical areas first, such as network security, data encryption and user authentication, and providing free training resources for staff, parents and students, cybersecurity can be a priority.

Schools can also form partnerships with other educational institutions to share resources, training and best practices.

For further reading about internet safety in schools, please see our knowledge base.

Resources and Tools

Educational Materials

In the UK, there are several recommended tools and platforms for cybersecurity training and awareness, catering to different needs such as individual learning, corporate training and specific certifications. Here are just a few examples:

• National Cyber Security Centre (NCSC) resources – this is a government-backed scheme to help organisations protect themselves against common cyber threats.
• CyberAware – provides guidance on how to stay secure online, targeting individuals and small businesses.
• Exercise in a box – a free tool to help organisations test and improve their cyber resilience.
• CybSafe – a behavioural security platform focused on improving security awareness, behaviour and culture within organisations. It includes personalised, adaptive training modules and risk assessments based on user behaviour.

Conclusion

In conclusion, implementing robust digital safety and cybersecurity strategies in schools is critical to protecting students, educators and institutional data from the growing threats in the digital landscape. By adopting comprehensive policies, educating students and staff on best practices, employing advanced technological solutions, and fostering a culture of vigilance and responsibility, schools can create a secure online environment conducive to learning. 

As digital threats evolve, continuous assessment, adaptation and collaboration with cybersecurity experts will ensure that schools remain resilient and safe, enabling them to focus on their primary mission of education.