The following article talks about how a school thwarted a cyber attack, more through luck than judgement.  Our advice is for the whole organisation to be cyber aware and review how your organisation might respond when attacked.    The article gives ideas on how to begin making a cyber ready plan.

In October 2020 Kellett School was subject to a ransomware denial-of-service (DoS) attack orchestrated by a Russian criminal hacker group.  After the attack, a post mortem diagnostic showed that they had most likely got into the school's system through a member of staff clicking on a link in a phishing email, which, because staff had admin rights to their school devices, installed malware on the school system.  The full article can be read here:

 https://www-tes-com.cdn.ampproject.org/c/s/www.tes.com/magazine/leadership/data/how-our-school-fought-back-after-cyberattack?amp

Things to note from this attack:

• Staff had been given admin access to to their school devices so that they could download any software from home that they needed during the period of home learning.
• There were no protocols in place to ensure that access to the school network was limited to current staff.
• There were no additional controls in place to the creation and deletion of admin accounts.
• Staff had not been made to change their passwords for years.
• Shutdowns and updates on school devices had not been forced
• Staff had never been trained in cyber-awareness

Recommendations:

• Senior Leadership makes cyber security part of the organisational culture
• Everyone in the organisation should understand cybersecurity.  The organisation should make use of complex passwords.
• Policies and procedures should be correctly followed.
• There should be cyber insurance and emergency support in place
• There should be an incident response plan
• There are recommended experts on stand-by for help

Further resources can be found in our Information Security best practice area: 

https://dataprotection.education/index.php/best-practice-library/best-practice/information-security

and our Cyber Security checklist:

https://dataprotection.education/component/tjucm/itemform/cyber-security?id=90881&cluster_id=114

What to do in an attack:

Tell someone!  Report to IT. Report to SLT. 

Unplug the computer from the internet by removing the ethernet cable or turning the Wi-Fi off.

If you are a victim of a ransomware attack we would recommend reporting this to Action Fraud: https://www.actionfraud.police.uk/ as well as your data protection officer so they can advise about the data loss.  Most cyber crimes like these will also need to be reported to the ICO by your data protection officer.

Isolate the infected device and pass to IT 

Always ensure there are backups you can restore from.

Remember – ‘Hackers don’t break in they login’!