Schools Already Struggled With Cybersecurity. Then Came Covid-19

WIRED

by Lily Hay Newman

Schools Already Struggled With Cybersecurity. Then Came Covid-19

"The coronavirus pandemic has had major cybersecurity implications around the world. Tailored phishing attacks and contact-tracing scams prey on fear and uncertainty. Fraudsters are targeting economic relief and unemployment payments. The stakes are higher than ever for ransomware attacks that target health care providers and other critical infrastructure. For businesses, the transition to remote work has created new exposures and magnified existing ones.

School districts in the United States already had significant cybersecurity shortcomings. They often lack dedicated funding and skilled personnel to continuously vet and improve cybersecurity defenses. As a result, many schools make basic system setup errors or leave old vulnerabilities unpatched—essentially propping a door open for hackers and scammers. Schools and students also face potential exposure from third-party education technology firms that fail to adequately secure data in their platforms.

The pandemic amplified these risks, as school districts around the country transitioned to distance learning in the spring. Suddenly, millions of teachers and students relied on video chat software, lesson portals, digital message boards, and other online tools. If these systems are set up without proper authentication and controls, any of them can potentially become vectors for attack. And tools to access school networks remotely, including VPNs and Remote Desktop Protocol, can be abused by attackers to gain unauthorized access to sensitive systems. Last week, the Federal Bureau of Investigation issued a security alert about the threat of ransomware to schools amidst the Covid-19 crisis. "K-12 institutions have limited resources to dedicate to network defense, leaving them vulnerable to cyber attacks," the FBI warned, according to a ZDNet report."

Read more: https://www.wired.com/story/schools-already-struggled-cybersecurity-then-came-covid-19/