Today’s Lesson: Why Bad Actors Target the Education Industry
The education industry presents attackers with unique vulnerabilities they can exploit—ones that are less likely to be found in other large organizations. There are also key advantages to successfully compromising educational institutions that make them especially attractive targets for bad actors. Cybercriminals use impersonation and social engineering to target the human layer of campuses - students, faculty, and staff.
Everything from budgetary restraints and lean security teams to a high-flux user base presents interesting challenges for Security teams in the education sector. Let’s discuss the key vulnerabilities, the threat types that educational institutions face, and how they can better protect themselves from today’s targeted attacks and the evolving threat landscape.
Security Vulnerabilities within Educational Institutions
The university user base is made up of faculty, staff, students, and alumni, each presenting bad actors with different targeting opportunities. For starters, a large portion of the user base at educational institutions is in high flux. Educational institutions are more transient than your typical organization. Each year, there is a graduating class and an incoming class. This means there are lots of new mailboxes to manage and set up each year.
Faculty and Staff, Students, and Alumni
In addition, the user base is largely non-technical. Depending on their role, a majority of staff and faculty tend to be less likely to prioritize the asks of their security team. Once tenured and provided with the ultimate job security, faculty members are probably even less likely to pay attention to those notifications urging them to set up MFA. Faculty and staff are also used to responding to urgent requests and not hesitating to share their contact information. Once personal information is shared, bad actors can easily impersonate members of faculty and staff in social engineering attacks.
University students are asked to fill out forms all the time. Whether it’s applications for internships, scholarships, or forms for classes and events, there is no shortage of requests for their PII. Students are also more likely to share their information in exchange for free stuff like a t-shirt or a gift card. Once bad actors have extracted sensitive PII from students, they can use this to create fake identities.
Alumni accounts also present an easy target. Some educational institutions keep alumni emails active, meaning there is a high volume of inboxes going unchecked for months at a time. Bad actors can more easily compromise these accounts for longer periods of time without it getting reported to the organization.
Why Universities Make Attractive Targets for Bad Actors
There are several qualities that make universities both easier targets and attractive targets. Certain processes that might exist within larger organizations are sometimes lacking in a university setting, such as lenient practices with automated forwarding for inboxes. Attackers can set up mail forwarding for an inbox without alerting the school’s security team. Many educational institutions also have tighter budgets and constrained resources. This means there is less money allocated for necessary security tools and training, and security teams across the education sector tend to run lean.
University domains are high-reputation domains, making them enticing targets for an attacker. With a university email address, attackers can manage to get their email-based attacks into some of the most secure organizations. Compromising university website domains are also high value for highjacking traffic and hosting bad URLs.
Universities present cybercriminals with a wide range of applications and vendors to impersonate. Students have multiple email IDs, bring their own devices, and work across many cloud applications for daily work. All those email IDs and apps are potential entry points for compromise. Due to this, attackers have more opportunities to impersonate these brands in order to extract credentials from faculty and students. Large schools also work with hundreds of vendors–presenting more opportunities for vendor and supply chain attacks.
How Educational Institutions Will Need to Evolve Their Security
As the threat landscape becomes increasingly targeted, large university systems will need to adopt tools that can protect them against socially engineered attacks such as phishing and vendor email compromise. Because universities work with so many vendors and receive a high volume of invoices via email, they’re especially vulnerable to the growing threat of vendor and supply chain attacks.
Due to students' willingness to click links, fill out online forms, and share their PII, security teams will need to adopt a security platform that can detect language and weed out legitimate requests from the scams. With tools that can automate key processes and utilize NLU, AI, and ML, security teams will be better positioned to protect the faculty and student body against phishing and other types of socially engineered attacks.
Security teams should also adopt in-email contextual warning banners that can alert users to potentially dangerous emails while making it easy for the SecOps team on the backend to quickly remediate these types of threats across all user inboxes with one click.
How Armorblox Can Protect Educational Institutions from Targeted Attacks
More than 58,000+ organizations across industries and sizes trust Armorblox to secure their human layer against targeted attacks and data loss. Armorblox helps educational institutions communicate more securely over email using the power of Natural Language Understanding (NLU) and connects over APIs to understand the content and context of communications. Educational institutions use Armorblox to stop BEC and targeted email attacks, protect sensitive PII and PCI, and reduce phishing response times for user-reported threats.
Armorblox prevents your faculty and student email accounts from being compromised by cybercriminals and used to launch follow-on phishing attacks against stakeholders. In addition, it reduces the burden on strained IT and security teams with prebuilt detection policies and automatable response workflows.
Learn more about how Armorblox protects educational institutions like UCLA, Caltech, and Shady Side Academy.