Cyber security expert, Diwakar Dayal the Managing Director and Country Manager for India and the SAARC region at SentinelOne brings 25 years of experience having held leadership roles in security MNCs to his current role. Diwakar or Diwa as he is known in the industry has a successful track record of having led high-growth security products, platforms, services, and solutions businesses for global organizations. Diwa brings more than 25 years of experience in the cybersecurity space to his role as the Managing Director and Country Manager, of India and SAARC regions at SentinelOne since February 2021. He is responsible for defining and leading business operations and sales and drives the go-to-market strategy while ensuring further development of SentinelOne business across the region. He is working towards establishing SentinelOne India as a leader in Endpoint Security including EDR, XDR, and beyond. Prior to this, Diwa was the Managing Director and General Manager at Qualys where he was heading the business operations, sales, strategy, and GTM for APJC. At Tenable as its Managing Director and Country Manager, Diwa was responsible for setting up the organization’s business in India and establishing a strong foundation. He built a significant mind share, wallet share, and market share for the organization.
With the COVID pandemic receding, students are back in schools in India. In the last two years, the Indian education sector has widely adopted online teaching to overcome the disruption caused due to the pandemic. As education institutions reopen, many believe that both online and offline education will coexist. And cybersecurity threats for both forms of teaching remain high. Just like developed economies, the Indian education sector has been the victim of virulent cybersecurity attacks. In fact, some reports suggest that India is the biggest target of cyber threats to educational institutions and online platforms followed by the US, UK, Indonesia, and Brazil in 2022. On the back of rising cyberattacks, the apex regulator of higher education in India, the University Grants Commission (UGC) had asked colleges, institutions and universities to strengthen the cybersecurity infrastructure.
On a global level, key statistics for 2022 showed that in July 2022, the education sector experienced double the number of weekly cyberattacks when compared to other industry averages.
Education is the most targeted industry with an average of 2,297 cyberattacks against organizations each week in the first half of 2022; a 44% increase compared to the first half of 2021.
Cybersecurity in K-12 and higher educational organizations is complicated by multiple factors, including a large and disparate attack surface, varying degrees of cybersecurity awareness among users, restricted budgets, and the need for strategic oversight at the management level. On top of that, schools sit on a honeypot of valuable personal data belonging to students, staff and even parents that are attractive to threat actors. In a developing nation like India, most educational institutions don’t have a specific cybersecurity framework due to a lack of awareness, making the matter worse.
In this post, we review the risks facing the education sector and discuss recent policy initiatives and cyberdefense solutions to help schools, colleges, and universities better manage their cybersecurity challenges..
Edtech penetration & digitalisation heighten risk:
The pandemic brought many substantial changes to the Indian education sector. When the country was gripped by the pandemic, the education sector leveraged technology to transform physical classes into virtual ones. Thus e-learning became a reality with the help of cloud-based platforms. Be it government institutions or private ones, virtual learning became the norm with millions of students accessing these platforms daily. Multiple edtech start-ups also leveraged advanced technologies such as AR/VR to impart teaching. While such digital transformation solved the problem of access, threat actors started searching for weak links for malicious cyberattacks. Notably, digital platforms used by students stored their personal data relating to teaching, learning, progress, and other related information.
Threat actors, therefore, are leveraging these tools as springboards to access student data. In particular, student tracking software is a direct gateway for actors to obtain students’ personally identifiable information (PII).
The data breach reported by one of the largest edtech firms in India is a case in point. According to reports, customer data got leaked through one of the company’s vendors, who was engaged in managing the Customer Relations Management (CRM) system. This data breach, which happened in 2020, exposed the names and classes taken by students and email addresses and phone numbers of parents and teachers among others. Similarly, many ransomware and malware attacks were orchestrated against several colleges in India in the past two years.
Cybercriminals Hone in on School Data Stockpiles:
Schools and colleges hold large amounts of sensitive data not only of their students but also of parents and staff. Sensitive data such as addresses, birthdays, loan applications, and tuition-fees-related banking information are held by educational institutions.
Unfortunately, where there is data online, there is cyber risk.
In the short term, the consequences of exposing PII stored by the school could lead to a variety of cyberattacks including data breaches through phishing, ransomware attacks, Distributed-Denial-of-Service (DDoS) attacks, and even hacktivism through “zoom-bombing”, “meeting invasions”, and email spamming. In 2020, around 1,000 schools, colleges and universities were hit by spear phishing attacks. Spear phishing is a personalised phishing attack that targets a specific organisation or individual. Similarly, many educational institutions faced cyber breaches through business email compromise (BEC) attacks. Identity theft is another form of cyber risk that is seen in some instances.
In terms of long-term consequences, stolen PII can be misused in ways that could affect a future college, loan, or even job application, ruining a student’s career.
Attention & Action Taken by the Indian government:
The Indian government has formulated the National Cybersecurity Policy to devise a strong security framework. Also, a draft National Cyber Security Strategy, 2021 is under active consideration of the government. As per the existing policy, All India Council for Technical Education (AICTE)- the apex body for technical education- has devised a strategy for colleges across the country. According to AICTE’s guidelines, students and faculty are advised to use their own accounts and maintain cyber sanitization as per Institutes’ instructions. Students and faculties are suggested to maintain required account management policies and not tamper with their own requirements. In case of any misconfiguration, students are advised to inform institutes. Moreover, students and faculty should not make any type of user account bypassing techniques and follow all rules as per IT Act, of 2000.
Similarly, the Ministry of Home Affairs is implementing a cybersecurity education scheme for school students of classes 6 to 11 and above with an aim to deal with cybercrimes. Schools are organising workshops, seminars, and interactive sessions under this programme in their bid to spread awareness.
Conclusion
A comprehensive and coordinated strategy is the need of the hour for protecting the data, services and users within educational organizations. As the threat environment evolves, the complexity of the threat along with the squeeze on resources means authorities need to be aware of the risks they face along with the current government guidelines. Partnering with external cybersecurity providers and deploying a modern, trusted security solution can help address these challenges within the school’s budget.