Securing K-12: Building a Safer Learning Environment for the Nation's Schools
Tanium’s Doug Thompson explains how the education sector can respond to a new CISA report.
Tanium’s Doug Thompson explains how the education sector can respond to a new CISA report.
Ransomware’s new favorite victim is educational institutions. Ransomware attacks, that exploit targets utilizing malicious software code, have increased tremendously over the past few years. In addition to targeting business sectors, cybercriminals are now attempting to ambush the security posture of educational sectors. Educational institutions are an easy prey for ransomware attackers as they lack the fundamental elements of a secured network.
The HECVAT (Higher Education Community Vendor Assessment Tool or Higher Education Community Vendor Assessment Toolkit) is a security framework and template that higher education institutions can use to measure the security risks associated with potential or existing vendors. HECVAT is excellent for higher ed institutions because many third-party organizations tend to have structures and follow practices that lend themselves to increased cybersecurity risk.
Sometimes in the comms team here at Netskope I hear fantastic tales that are not yet approved for public consumption. The frustration is very real when I hear of a creative customer implementation that cannot yet be told to the wider world. But today I have contrived a clever way to be able to share one of these stories with a veil of anonymity, ahead of a bigger effort to craft a case study for full public consumption.
HECVAT (Higher Education Community Vendor Assessment Toolkit) is a security assessment questionnaire that measures the cybersecurity risk of third-party vendors for higher education institutions. It helps universities ensure that their third-party vendors have implemented proper security practices and policies, which are measured against a comprehensive list of security controls, to protect the large amounts of sensitive data and personally identifiable information (PII) they manage.
Schools and non-profits share the same problem when it comes to cybersecurity budgeting: limited resources which forces a choice between staff with the right expertise and effective tools that work for the organisation.
Although cyberattacks on higher education institutions date back years, there has been a spike in university cyberattacks over the last two years. Cybercriminals had taken advantage of the rapid transition to hybrid learning that higher education institutions have been forced to implement before they had time to strengthen their cybersecurity, which has left most of them exposed. This is yet another example of accelerated adoption of new technologies before security measures are in place.