Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:10 PM
Connect Directly

Cybercriminals Aim BEC Attacks at Education Industry

Heightened vulnerability comes at a time when the sector has been focusing on setting up a remote workforce and online learning amid the pandemic.

K-12 schools and colleges are more than twice as likely to get hit with a business email compromise (BEC) than companies outside of the education industry, new research has found.

According to Barracuda Networks, BECs accounted for 28% of all spear-phishing attacks aimed at educational institutions, while for all other verticals it was 11%. In addition, within education 57% of malicious emails came from internal – primarily students' – email accounts.

(Image: Barracuda Networks)
(Image: Barracuda Networks)

"We found that the students don't use email and administrators aren't always paying attention to those accounts," says Mike Flouton, vice president of Barracuda's email security business. "From an attacker's perspective, it's just much easier to go unnoticed."

The research, released today, is based on an analysis of more than 3.5 million spear-phishing attacks, including attacks against more than 1,000 educational institutions from June through September 2020. The point of the research, Flouton says, was to show the education community just how vulnerable it is to BEC attacks, along with the need to improve training and overall security awareness.

(Image: Barracuda Networks)
(Image: Barracuda Networks)

In the past 18 months, several BEC cases at school districts came to light. Most recently, a school district in Clark County, Nevada, refused to pay a ransom after a hacker stole private data on thousands of students. As a result, the student data was released on an underground forum.

Related Content:

Ransomware Strikes 49 School Districts & Colleges in 2019

2020 State of Cybersecurity Operations and Incident Response

New on The Edge: Tracking Down the Web Trackers

In another example, Manor Independent School District in Texas reported in January that a seemingly typical school-to-vendor transaction resulted in a loss of $2.3 million. And in April 2019, attackers used a fraudulent email to steal $3.7 million from Scott County Schools in Kentucky.

"K-12 schools are much more vulnerable than colleges and universities, as they have more reliance on email for work orders and communications … with a less mature security posture and less IT staff and … training," says Ruthbea Yesner, vice president, government insights, education and smart cities at IDC. "As a result, combined with online work because of the pandemic, we have seen a rise in ransomware and other attacks on schools. The dollar value may be lower as compared to a bank, but that's only because the hackers want to get paid and they know the capabilities of schools are limited. 

Tim Keeler, founder and CEO of privileged access security provider Remediant, points out how the education sector has become disproportionately vulnerable to BECs during the pandemic. Security teams at colleges had limited time to secure the perimeter as students, staff, faculty, and researchers were sent home to work remotely, he says. Similarly, K-12 schools were focused on setting up and enabling a blended remote/on-premises classroom and had limited time or appetite for security awareness training.

"Both colleges and schools make great targets for attackers looking for notoriety and media coverage as they are highly visible entities, yet are price-sensitive," Keeler says. "Unfortunately, the education sector has perpetually underinvested when it comes to security tools, best practices, and [full-time employees]."

BEC Prep Lesson Plan
The Barracuda report offers schools districts four tips to better prepare for BEC attacks:

1. Invest in protection against targeted phishing attacks: Attackers realize the education industry doesn't always have the same level of security sophistication as other verticals, and they take advantage of it. Schools, colleges, and universities need to prioritize email security that leverages artificial intelligence to identify unusual senders and requests. This additional layer of defense, on top of traditional email gateways, will offer substantial protection against spear-phishing attacks for both staff and students.

2. Deploy account takeover protection: Educational institutions are more susceptible to account takeover than an average organization because many don't have the necessary tools and resources to protect against this threat. Invest in technology that will let the organization identify suspicious activity and potential signs of account takeover.

3. Improve security awareness education: Educate users about BECs and other email threats. Ensure that staffers and students can recognize attacks, understand their fraudulent nature, and know how to report them. It's especially important now when remote learning has become such a big part of the education system and students and teachers rely on technology and email for both communication and educational purposes.

4. Set up internal policies to prevent wire transfer fraud: All organizations should establish and regularly review existing school policies to ensure personal and financial information gets handled properly. Help employees avoid making costly mistakes by creating guidelines and putting procedures in place to confirm all email requests for wire transfers and payment changes. Require in-person or telephone confirmation and/or approval from multiple people for all financial transactions. Remember: It's not always about the technology. Creating policies and procedures that people understand and will follow can go a long way to preventing attacks.

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
10/30/2020 | 9:56:42 AM
Whodda Thunk?
While I understand the concern, these are professional educators and are willing to learn nothing.  It's not worth the cost of the electricty to generate an email to those that are in charge of "edumacations" in this country and that is why they are such ripe targets.
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-17
All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
PUBLISHED: 2021-06-17
Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`Ch...
PUBLISHED: 2021-06-17
Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file.
PUBLISHED: 2021-06-17
An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. It allows an authenticated WebGUI user with privileges for the affected p...
PUBLISHED: 2021-06-17
In Fiyo CMS, the 'tag' parameter results in an unauthenticated XSS attack.