Cyber Insurance for Schools: How Risk Management and Mitigation Work Together to Protect Your Clients

While cyber attacks on schools are not new, school districts faced an 18% increase throughout 2020. COVID-19 and the sudden need for nationwide virtual learning—for students from kindergarteners to graduate students—sent hackers into a frenzy. Whether students are pursuing their education through remote learning or in-person classes, cyber insurance for schools has never been more important.

Since 2016, there have been 1,180 cyber incidents towards schools reported. The educational sector hosts a wealth of sensitive data on both students and employees, making them a lucrative target. In addition, many schools face limited cyber security resources and their data security is extra vulnerable.

The defense against cyber risks is two-fold:

1. Prevention in order to reduce the risk of falling victim to a cyber attack.
2. Mitigation in order to reduce the damages of a cyber attack, once it occurs.

While prevention is critical, cyber threats are so common and advanced that every school should make the assumption that they will one day fall victim to an attack. Cyber insurance for schools is the only way to ensure educational institutions can survive the fallout.

Three Cyber Risks to Know and Best Practices to Prevent Them

There are a number of public resources to help educational institutions get started, including a free cyber security self-assessment to help identify and prioritize cyber security controls.

While cyber threats are constantly evolving, here are the most common cyber risks that the educational sector is facing today:

Ransomware

• What to Know:
  These attacks encrypt data and make ransom demands in order to provide the encryption key. CISA and the FBI released a joint report in December 2020, outlining that ransomware attacks against K-12 institutions made up for 57% of reported ransomware incidents, as compared to 28%, from January 2020 through July 2020. These attacks can be exceptionally disruptive to a remote learning environment, which many schools are relying on through the COVID-19 pandemic.
• How to Prevent Them:
  Passwords should include a combination of upper and lower case letters, numbers, and characters to make a combination that is difficult to guess (even for a computer). Multi-factor authentication (MFA), which requires a second layer of credentials to verify a user’s identity, should also be implemented whenever possible.

Social Engineering/Phishing

• What to Know:
  This is often pursued through fraudulent emails, websites, or links that may appear legitimate to trick users into giving away sensitive data.
• How to Prevent Them:
  The best defense against social engineering attacks is knowing when you see one. This is why thorough and consistent employee training is crucial as there will always be new risks to be made aware of. A Cyber Insurance policy is a huge asset to schools looking for assistance in their employee training.Understanding how to identify a phishing attack allows users to avoid clicking on any potentially dangerous links or giving information to someone who shouldn’t have it.

  Before moving forward, users should:

  1. Check the subject line for potential “clickbait” warnings meant to scare users into acting quickly, such as warnings of an overdue bill or other account issues.
  2. Check for spelling and grammar errors as most legitimate businesses edit and proofread all content extensively before making it public.
  3. Check for a generic greeting such as, “Dear Customer,” or, “To Whom it May Concern” as a legitimate business will often address customers by name.

Video Conference Disruptions

• What to Know:
  These attacks occur when unauthorized individuals disrupt live classroom sessions taking place over video conferencing software. The invaders often verbally harass teachers and students, display pornography or violent images, or engage in doxing, which involves publishing personal information about an individual with malicious intent.
• How to Prevent Them:
  Preventing these attacks, like many other forms of cyber risks, requires a combination of technology and user awareness. These can be prevented by:
  1. Using only the most current and updated versions of software
  2. Use passwords or meeting codes for access
  3. Use a waiting room to vet participants before they enter
  4. Use participant names rather than aliases

How to Mitigate the Damages of Cyber Risks in Schools

Once a breach occurs, the manner in which the organization responds can have a profound effect on the extent of the damages. Here are the steps the educational sector should take, should they fall victim to a breach:

1. Identify the Breach
   Call your cyber attorney and have them coordinate your breach response by bringing in an expert IT Forensics firm. Many cyber attacks can continue under the radar without users realizing it for an extensive period of time. This is why it’s so important to know how to identify various forms of cyber attacks. In addition, it can often take an IT forensic expert to determine exactly how the breach occurred and what information was improperly accessed.
2. Respond Immediately
   The speed at which an organization responds to a breach has a significant impact on the extent of the damages. A breach response plan should be in place before a cyber incident occurs to ensure everyone knows their role and can act immediately when a breach is identified and the time comes.
3. Be Transparent
   Reputational damage and loss of public trust are very real and serious effects of a cyber attack. The public should be addressed and briefed on the cyber incident as soon as possible and it’s often best to enlist a public relations team to assist in doing so.

While these steps are effective, they can also be extremely expensive. The costs associated with a cyber attack will usually be too much for an educational institution to face alone. Cyber insurance for schools is the best way to ensure they’ll have the financial support and cyber response expertise needed when it comes time.

To find your clients the best available cyber insurance policy, register for our Cyber IQ Comparative Rate Platform where you can quote and compare multiple policies from multiple carriers in just minutes.