Microsoft: BYOD, QR Codes Lead Rampant Education Attacks

The education sector is facing thousands of cyberattacks per week these days — especially universities, a good portion of which experience at least one incident per week.

Education was the third most targeted industry in second quarter of 2024, according to Microsoft's latest "Cyber Signals" report. This finding corroborates data from Check Point Software, indicating that the education and research sectors now face more than 2,500 attacks weekly, up 15% over the past couple of years.

The US has it the worst, but schools and related organizations across the world face the same sorts of risks. In Europe, for example, 43% of institutes of higher education report experiencing a cyber incident at least once a week, if not more often. Schools for earlier age groups faced significantly less frequent attacks (13% to 16%).

As Microsoft explained, education makes for a uniquely soft target, combining the vulnerabilities, blind spots, and legacy infrastructure issues endemic to various other major industries, but all in one package.

Education Sector Is an "Industry of Industries"

Schools — in particular, universities — tend to combine the functions of many kinds of organizations in one package.

A university is also a financial institution with lending capabilities (sometimes even more the latter than the former), and a healthcare and housing provider to its students and faculty. Schools at every level host payment processing systems, websites and email domains, and networks that, especially since the COVID-19 pandemic, can resemble Internet service providers. They employ food service and athletics staff, and host events. They might be in possession of potentially sensitive research data, and all of them have to manage the full spectrum of personally identifiable information (PII) belonging to usually thousands of people at once.

It follows, then, that educational institutions enjoy all of the cybersecurity challenges any other industry faces. New and legacy technologies commingle. Public schools struggle with funding. Cybersecurity talent is tough to find and retain. Students and teachers bring their own devices on and off campus every day, each one potentially carrying malware. And virtual learning extends the attack surface outward.

In some ways, these issues affect schools to a greater degree than they do other industries. For instance, bring your own device (BYOD) risk is one thing in a corporate environment, where employees can be educated in cyber-risk, but it's an entirely different beast at schools, where those devices belong to children.

Or, consider QR codes. According to Microsoft's telemetry, more than 15,000 malicious phishing and spam messages are directed to educational institutions every day, with so-called "quishing" on the rise.

In open and collaborative environments like schools, "defenses that typically would be in place to help reduce the noise and create more effective defenses don't always work," explains Corey Lee, security chief technology officer (CTO) for Microsoft's M365 Security.

Schools tend to pass around lots of QR codes, but lack the same rigor in vetting the messages they travel with. "A lot of that has to do with the fact that email filters are not the same in education environments. Post-detection and response capabilities aren't always the same in education environments. So when we have business email compromise attacks that use advanced lures like QR codes, it becomes very hard to detect and respond to," Lee says.

Taking Hackers to School

In 2021, Oregon State University experienced a cyberattack "unlike anything before," Microsoft wrote. In the aftermath, it established its own security operations center.

A number of universities have done the same, or more. Louisiana State University (LSU), the University of Cincinnati, and California Polytechnic State University all operate SOCs. In Texas, the state's Department of Information Resources (DIR) oversees a Regional Security Operations Center in collaboration with Angelo State University in San Angelo.

"Education, as a sector, doesn't necessarily have lots of advanced personnel just sitting around, not doing anything. Oftentimes, [security staff] wear multiple hats, and they're limited," Lee explains. Luckily, universities have a significant, untapped pool of potential talent waiting to be activated.

"The challenge oftentimes is being addressed by scaling through students — being able to activate students to help them join in on the fight and be effective and efficient security defenders for the school."

Student-staffed SOCs serve multiple functions at once: not only helping to protect universities, but also other nearby educational, government, or even private organizations, all while training a new generation of cybersecurity talent. As Lee says, "They're helping to address the security skill shortage, while defending home base."