Educational Services

An Island of Misfit Breaches

You may be wondering, “What is this Everything Else pattern that is top of the class in this sector?” It sounds like the kitchen drawer where all the odds and ends wind up, and in a way, it is.  If an attack doesn’t meet the criteria of one of the other attack patterns, it ends up here, with that olive pit remover you got from your Secret Santa. 

Phishing dominates the Everything Else pattern by a comfortable margin, not unlike many other industries. However, the Educational Services sector stands out by also getting a failing grade in phishing reporting practices. Of all industries, according to our non-incident data, only 24% of organizations had any phishing reporting at all, and none of them had at least 50% of the emails reported in phishing awareness campaigns.  It is exceedingly important to encourage your user base to let you know when your organization is being targeted.  If they don’t report it, you miss out on your early warning system.

Similarly, the presence of the Web Applications pattern is mostly because of the Use of stolen creds on cloud email accounts. Although we cannot say this is the organizations’ fault, according to our non-incident data analysis, Educational Services have the longest⁴⁰ number of days in a year—28—where they had credential dumps run against them.  The global median here is eight days. The overall number of credentials attempted is also one of the highest of all industries we analyzed for this year’s report (Figure 64).

Outside of those two patterns, sadly the news is still not great. Ransomware is really taking hold of Education vertical incidents, and has been responsible for 80% of the Malware-related incidents, up from 48% last year (Figure 65).  All of those Ransomware cases have also played a role in the increase we have seen in financially motivated incidents for the past two years.

One additional concern in this sector is the fact that according to our analysis, this is the only industry where malware distribution to victims was more common via web sites than email. This information doesn’t really seem to make sense until you consider malware being distributed via unmonitored email (such as personal mail accounts from students on bring-your-own devices connected to shared networks), and all of those infections obviously endanger the larger organization.