The Register Home Page

back to article Schools are swotting up on security yet still flunk recovery when cyberattacks strike

Schools and colleges hit by cyberattacks are taking longer to restore their networks — and the consequences are severe, with students' coursework being permanently lost in some cases. fed up uni students looking at failing laptop Ransomware attack forces Brit high school to shut doors READ MORE New figures from the Office of …

  1. VoiceOfTruth Silver badge

    Schools in the internet age

    Schools used to be a place to learn. Now they are a place of cybersecurity. Perhaps it is time they go back to the pre-internet age, and keep records on paper.

    >> more teachers are receiving cybersecurity training, yet institutions struck by attacks are increasingly struggling to recover

    Yes, because the training is not worth tuppence. Keep your systems up to date. Check. Change your passwords. Check. Don't open attachments. Check.

    >> defense

    defence. 0/10, A dunce's spelling mistake, Smith.

    >> It looks like more lessons on cybersecurity awareness for teachers are required.

    Od do away with cyber and stick to paper. A teacher's job is not cyber security, so I don't expect them to get A+ in that.

    1. MachDiamond Silver badge

      Re: Schools in the internet age

      "Change your passwords."

      If you have a good password(s), why change it? A better call is to not reuse passwords for critical things and especially never reuse passwords for social media and retail sites that seem to be hacked daily.

      Every student should be taught to get in the habit of keeping copies of their coursework on their own computer so it can be resubmitted rather than relying on any online service to store it for then. There are stories of Masters and Doctorate candidates that have lost thesis materials they had been working on. If they know the subject, they could do it over at the cost of another year's fees/tuition which might be substantial.

      Training is good if it's useful information. Learning to identify things they have no control over and what they'd have to do when it goes Tango Uniform is important. Teachers can't delete attachments from students if that's how they are receiving coursework from them. Schools are also keen on flooding them with all sorts of notices that could easily go in the body of an email though they choose to attach them with nothing in the body of the mail to say what it is.

      1. Grogan

        Re: Schools in the internet age

        There is no reason to change a good password that isn't compromised. I never liked password expiry and forced changes. My next password is likely to be a variant of "fuck you" adjusted to fit their policy, if forced to change it (likely weaker than my previous one). I refuse to set a password I can't remember.

        1. VoiceOfTruth Silver badge

          Re: Schools in the internet age

          >> There is no reason to change a good password that isn't compromised.

          How do you know it is not compromised? You shouldn't assume that it has not been.

  2. Anonymous Coward
    Anonymous Coward

    Teachers are receiving cybersecurity training

    What good is teacher cybersecurity training if your entire totally unified, software-defined architecture can be compromised by clicking on a malicious URL or opening a malicious email attachment.

    > Teachers described student coursework and lesson plans as "gone forever"

    Whatever happened to restoring from last-nights tape back-ups?

    > Schools that maintain current, accessible backups can restore systems more quickly and avoid ransomware demands

    That's interesting to know /s

    > Staff practices also contribute to the problem. One in five incidents resulted from employees sending work data to personal devices ..

    Have the manufacturers of the devices design an OS that can't be compromised by clicking on a malicious URL or opening a malicious email attachment /s

    1. 42656e4d203239

      Re: Teachers are receiving cybersecurity training

      >>What good is teacher cybersecurity training if your entire totally unified, software-defined architecture can be compromised by clicking on a malicious URL or opening a malicious email attachment.

      Fair.

      >>Whatever happened to restoring from last-nights tape back-ups?

      Unfair. Tape infrastructure is expensive and of limited use (data egress fees apply for several Tb of data) if everything is on "someone else's computer".

      >>Have the manufacturers of the devices design an OS that can't be compromised by clicking on a malicious URL or opening a malicious email attachment /s

      Whilst a valid point (and one you made already) that doesn't even address the statement from the article "One in five incidents resulted from employees sending work data to personal devices" - the answer there is to stop staff from accessing school networks/resources on personal devices. Its not hard. The two big ecosystems typically used by schools can do that with a simple setting (I know its simple, I have used it sucessfully and so it must be simple!)

      As an employee one should never have/access work data on a personal device. If work want you to access that data they should provide the hardware with which to do it.

      1. MachDiamond Silver badge

        Re: Teachers are receiving cybersecurity training

        "Unfair. Tape infrastructure is expensive and of limited use (data egress fees apply for several Tb of data) if everything is on "someone else's computer"."

        Last night's tape backups can also be compromised if some ransomware has a trigger delay.

        Tape is cheap. Backups are cheap and it's a lesson you learn the first time a drive goes down and you are paying for data extraction. Egress fees are only if you've outsourced your backups to somebody and aren't doing them in-house. I'm not sure people are looking at recovery costs when it comes to their online backup contracts, only upload speed and capacity. They are probably not looking at how long it would take to download the data if they have a need.

  3. Diogenes8080

    So the dog ate everyone's homework?

  4. Roland6 Silver badge

    Schools - performance/league table required?

    From the article it would seem in comparison schools are doing well…

    Marks & Spencer time to restore business months

    Jaguar Land Rover: months and still not out of the woods.

    …

  5. JT_3K

    Let's unpick this a bit.

    Schools got turned in to "acadamies" which ballooned in to "multi-academy trusts", mostly under the disastrously wasteful Building Schools for the Future campaign - and don't get me started on the to-this-day impact of Blair's Wonga-economics and lack of controls. The Local Authority who has the non-academy schools and the trusts (who are now allowed to be run as businesses) are viewing IT as a cost-centre with the LEA often outsourcing their IT to the likes of Capita or similar.

    Where they're outsourced, they've got punitive clauses for leaving sites without a mouse, or not responding to a dead classroom display but the outsourcer are playing a game to achieve maximum profit whilst knowing they will get stung for missing some targets but not caring about performance overall. Both options are largely staffed by a rotating door of the cheapest possible entry level first-line hands-and-eyes who are simultaneously stretched thin and run ragged, having to cover multiple sites. The only end-user difference is that where they're insourced it's the same story, but with no "senior escalation" path or strategic IT leadership.

    The trusts are thus the worst. Paying a pittance, they expect an overstretched hands-and-eyes level junior without mentoring to play architect or believe a supplier can be courted by a non-IT "business manager" to deliver an effective IT experience. It's all just cables and wires after all, Microsoft 365 comes with inherent backup, we bought a shiny firewall from the vendor, and we're safe because Windows has an antivirus program like 1997 on every PC. Kids can't complain when they get the blunt end - it's a captive audience and worst case they'll have to re-do their coursework when/if it goes missing with no pain to the trust's profit margin. Teachers will complain with issues but they're largely replaceable and there's some churn and supply-teacher-overhead built in to the profit model.

    So when the juniors and the vendors are left to move from the legacy Microsoft Tenant to the trust that's bought them's shared Microsoft Tenant and collate on-prem storage with legacy SharePoint storage on to the new Tenant, there's no risk...to the trust. It doesn't matter that the juniors have lost a lifetime of curated and polished cumulative teacher resources by the whole of the Science team, or the Y10 coursework for the new Y11 students. The teachers can just recreate this year, it'll be good to have a fresh start with modern resources. The kids can just re-do it - I mean they probably all have copies at home anyway as they've all got a laptop each because they spend all their life on TikTok, right? Doesn't matter that the teachers have been given 135 pages of CYA policies to read, signed and tested by the legal manager and 16hrs of safeguarding training by the safeguarding lead as well as a predictive grading sheet for 260 children they've barely met by the deputy headteacher and the Head of Year has agreed a parents evening for Y8 in the second week whilst the new head of their department has instigated a mark-every-word policy, they can just recreate every lesson from scratch.

    And we wonder why there's a young person's mental health crisis, and a crisis in teaching. Don't worry though, it's been nearly 14 months with the current one so it's about time she was shuffled to another role as she's probably just at the point where she understands it. As to the kids, let's just slap a glossy "Mental Health Awareness" week together instead of stopping looking at education as a way to funnel taxpayer money to private businesses and fixing the root causes. Don't worry about the junior IT guys, there's an endless supply of them and the NHS will pick up their pieces.

    /rant

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like