Education Industry

Recent Cyber Attacks

  • In January 2023, the Los Angeles Unified School District (LAUSD) was hit by a cyberattack that forced the district shut down its operations for several days.
  • In February 2023, the University of California, Berkeley was hit by a cyberattack that exposed the personal information of over 500,000 students and employees.
  • In March 2023, the Seattle Public Schools was hit by a cyberattack that disrupted its online learning platform.
  • In April 2023, the Portland State University was hit by a cyberattack that stole the personal information of over 100,000 students and employees.
  •  In May 2023, the University of Washington was hit by a cyberattack that disrupted its research activities.
  • In June 2023, the California State University, Long Beach was hit by a cyberattack that stole the personal information of over 50,000 students and employees. 

Introduction:

Careful Security was contracted to conduct a risk assessment for a University.


The Challenge:
The University with its complex IT infrastructure and diverse range of business processes, needed to identify potential cybersecurity risks and hidden vulnerabilities. They required a comprehensive cybersecurity risk assessment that was thorough and based on globally recognized standards.

The Transformation:Careful Security embraced this challenge, utilizing the robust NIST Cybersecurity Framework (CSF) and NIST Privacy Framework to conduct a comprehensive risk assessment. We analyzed critical business processes, sensitive data repositories, servers, and software infrastructure uncovering hidden vulnerabilities. We scanned the perimeter from the outside and detected the presence of legacy systems that could become an easy target for cyber threats. Our final deliverable was a detailed security roadmap, outlining strategic steps to remediate the risks identified.

The Result:
Our thorough assessment and actionable recommendations helped instill a culture of cybersecurity awareness and resilience within the university, laying the foundation for ongoing cybersecurity vigilance.

At Careful Security we are proud to play our part in securing institutions of learning, ensuring that the pursuit of knowledge continues unabated, undeterred, and unquestionably secure.

  • Limited Resources: Many educational institutions have limited budgets and resources to dedicate to cybersecurity.
  • Lack of Awareness and Training: Staff and students might not be fully aware of the best practices for maintaining cybersecurity.
  • Diverse User Base: Educational institutions have a wide range of users, including students, faculty, and administrative staff, each with different levels of technical proficiency.
  • Outdated Infrastructure: Many institutions operate with outdated systems and software, which can be more vulnerable to cyberattacks. 
  • Bring Your Own Device (BYOD) Policies: Institutions often allow students and staff to use personal devices for academic activities, increasing the risk of a security breach.
  • Compliance with Legal and Regulatory Requirements: Ensuring compliance with various legal and regulatory requirements related to data protection can be challenging.
  • The Family Educational Rights and Privacy Act (FERPA). FERPA is a federal law that protects the privacy of student education records. It requires educational institutions to take reasonable steps to protect the security and confidentiality of student records.
  • The Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a federal law that protects the privacy and security of health information. Educational institutions that provide health care services to students are subject to HIPAA requirements.
  • The Gramm-Leach-Bliley Act (GLBA). GLBA is a federal law that applies to financial institutions, including educational institutions that process student financial aid information. GLBA requires these institutions to protect the security and confidentiality of customer information.
  • The Cybersecurity Act of 2015. The Cybersecurity Act of 2015 is a federal law that requires critical infrastructure entities, including educational institutions, to develop and implement cybersecurity plans.
  • State laws. In addition to federal laws, educational institutions may also be subject to cybersecurity requirements imposed by state laws.