The education sector is especially vulnerable to ransomware attacks over holidays and weekends, according to a global survey by cybersecurity firm Cybereason. Over half (54%) of education information technology professionals surveyed said “it took us longer to assess the scope of the attack” over a holiday or weekend, while 42% said they take longer to respond to and stop holiday and weekend incidents compared to those on weekdays. The same percentage (42%) reported greater financial losses from holiday and weekend cyberattacks. Schools are also more likely than other sectors to spend more time recovering from a ransomware attack, Cybereason found. On average, 16% of cybersecurity professionals across industries, compared to 25% of those in education, reported taking one to two days to recover. While 13% of all industry cybersecurity professionals recovered in three to six days on average, 28% of school professionals said they needed that amount of time. To better protect schools from cyberattacks, experts have recommended districts vet new technologies, collaborate with instructional leaders, phase in multi-factor authentication and create a security team.
You've probably seen employees wearing security badges at their organization's offices. Can you think of how many different organizations' badges you can recognize? Can you recall the details of the badges you've seen?
There are several different details on badges that cybercriminals look for, such as an employee’s picture, the employee's name, and the color of the badge. As technology has advanced and image editing software has become more popular, cybercriminals can use these details to easily replicate the look of security badges.
Within hours, cybercriminals could recreate your badge with their own names and pictures. They can then use the badge to gain access to your organization's offices or buildings.
How to Protect Your Security Badge or ID
It's important that you are responsible for your security badge and that you practice proper badge use. If your organization has a formal policy about proper badge use, please refer to that policy.
Follow the tips below to protect your security badge or ID:
- Wear your badge at all times when you're inside of your organization's offices or buildings.
- Don't wear your badge while you are in a public place. When you wear your badge in a public place, you are also showing people where you work. If cybercriminals know your name and where you work, they can target you or your organization.
- If you've lost your badge or believe your badge has been stolen, immediately report it as missing.
- Never let other people use your badge, even if they have forgotten their own badge at home.
Next time you leave for a lunch break or leave your office, put your badge in your purse or pocket so that other people can't easily read the information on your badge.
Passwords have become an integral part of our daily lives. We use passwords to check our social media feeds, access our bank accounts, and log in to our work computers. In fact, studies have shown that the average person can have up to 100 different online accounts.
That’s a lot of passwords to remember! With so many login credentials to remember, you may be tempted to come up with short and simple passwords. Using a password such as “password1234” or “QWERTY” may not seem like a big deal, but a weak password can put you at risk of a cyberattack called "password spraying."
What Is Password Spraying?
Password spraying is a cyberattack that tests common weak passwords across multiple user accounts. By cycling through multiple accounts, cybercriminals can avoid being locked out of a single account due to failed login attempts. The process is usually automated and often goes undetected for a long time. Once cybercriminals gain access to a user’s account, they can steal sensitive information and plant malware.
The password spray attack isn't new, but it remains an effective hacking method that allows cybercriminals to gain access to organizations’ networks. In recent years, cybercriminals have modified the password spraying technique, attacking single sign-on (SSO) services and other cloud platforms. Due to these attacks, you may need more than just a password to keep your sensitive information secure.
How Can I Keep My Account Safe?
Follow the tips below to help protect your accounts and your organization’s network from password spraying attacks:
- Use multi-factor authentication (MFA) to add an extra layer of security to your account. MFA requires you to provide extra verification before logging in to an account, making it more difficult for cybercriminals to hack your account.
- Try safe passwordless authentication options, such as biometric authentication, voice recognition, or facial recognition technology.
Make sure that the passwords you use are unique and strong. Try using longer passphrases that you can remember, and don't use the same passwords for multiple accounts.
Most universities provide students with email addresses from the university’s official domain. For example, a student's email address could be firstname[at]harvard[dot]edu. Since these email addresses use real university domains, cybercriminals try to gain access to student email accounts so they can use them for their own malicious purposes.
To start the scam, cybercriminals use social engineering to gain access to a student's email account. If they are successful, the cybercriminals will send you a phishing email from the stolen email address. The university email address makes the email appear more legitimate. The email states that some messages are being blocked from your inbox and provides a link to a spoofed login page. If you click this link and enter your login credentials, cybercriminals can use your login credentials to access your sensitive information.
Don’t let a university email scam trick you. Follow the tips below to keep your sensitive information safe:
- Even if the sender’s email address is from a trusted domain, the email could be fake. Cybercriminals can gain access to trusted domains to make their scams more believable.
- When you receive an email, stop and look for red flags. For example, watch out for emails that were sent outside of business hours and emails that contain spelling or grammatical errors.
- Never click a link in an email that you aren’t expecting. If the email claims that you have an account issue, log in to the organization’s website directly to verify the claim.