School Governance | Why cyber security is crucial for schools

The growing cyber threat landscape

The frequency and sophistication of cyber threats have been increasing, posing significant risks to schools. From data breaches to ransomware attacks, educational institutions are prime targets due to the sensitive data they hold, including personal information of students, staff, and parents. In their Annual Cyber Threat Report for 2022-2023, the Australian Cyber Security Centre highlights the increasing frequency, cost, and severity of cyber incidents, including those affecting educational institutions. In 2022-23, nearly 94,000 reports were made to Australian law enforcement through ReportCyber – around one every six minutes. This represents an increase of 23 per cent from the previous year.

Governance and cyber security

Leadership and accountability: Effective governance in schools involves ensuring that cyber security is a priority at the highest levels. School boards and executive teams must be accountable for managing cyber security risks and fostering a culture of security awareness. This includes allocating adequate resources for cyber security initiatives and ensuring continuous improvement in security practices.

Policy development: Schools must develop comprehensive cyber security policies that outline their approach to managing cyber risks. These policies should cover areas such as data protection, access controls, incident response, and staff training. Regular reviews and updates to these policies are necessary to adapt to the evolving threat landscape.

Risk management

Risk assessment: Conducting regular risk assessments is crucial for identifying potential cyber threats and vulnerabilities. Schools should evaluate the likelihood and impact of various cyber incidents and implement measures to mitigate these risks. This includes assessing third-party risks associated with service providers and contractors who have access to the school's IT systems.

Incident response planning: An effective incident response plan is vital for managing cyber incidents when they occur. Schools should establish clear procedures for detecting, responding to, and recovering from cyber attacks. This involves setting up an incident response team, conducting regular drills, and maintaining communication channels with key stakeholders.

Compliance

Regulatory requirements: Schools must comply with various data protection regulations, such as the Privacy Act 1988 (Cth), which mandates the protection of personal information from misuse, interference, and unauthorised access. Cyber security measures are integral to meeting these legal obligations and avoiding penalties.

Audits and assessments: Regular audits and assessments help ensure that cyber security measures are effective and compliant with regulatory requirements. Schools should engage independent auditors to evaluate their cyber security posture and identify areas for improvement.

Building a cyber resilient school

Cyber resilience refers to an organisation's ability to continuously deliver operations despite adverse cyber events. It encompasses more than just cyber security by including strategies to ensure that an organisation can prepare for, respond to, and recover from cyber incidents. This involves:

• Preparation: Developing and testing incident response plans, conducting regular risk assessments, and ensuring that all security measures are up to date.
• Response: Quickly identifying and mitigating cyber incidents to reduce their impact.
• Recovery: Restoring affected systems and data to normal operation as swiftly as possible.

Staff training and awareness: Human error is a leading cause of cyber incidents. Schools must invest in ongoing cyber security training and awareness programmes for staff and students. This includes educating them about phishing, safe browsing practices, and the importance of strong passwords and using multi-factor authentication.

Technology and best practices: Implementing advanced security technologies such as firewalls, anti-virus software, encryption, and intrusion detection systems is essential for protecting school networks and data. Adopting best practices, such as regular software updates and backups, further enhances cyber resilience.

Cyber security self-assessment tool

To help schools determine their current cyber security incident preparedness and resilience, Ideagen CompliSpace offers a Cyber Security Self-Assessment Tool. This tool allows schools to evaluate their existing cyber security measures, identify gaps, and develop strategies to enhance their overall security posture.

Conclusion

Cyber security is a critical component of governance, risk, and compliance in schools. By prioritising cyber security at the governance level, conducting thorough risk assessments, ensuring regulatory compliance, and building a culture of security awareness, schools can protect their digital assets and maintain the trust of their stakeholders. As cyber threats continue to evolve, a proactive and comprehensive approach to cyber security will be indispensable for the future of education.

How Ideagen CompliSpace can help

Ideagen CompliSpace has launched a new Cyber Security Module. This Module is designed to assist schools in strengthening their cyber defences and achieving cyber resilience. Key features of the Module include:

• Policies: The Module includes comprehensive cyber security policy and procedure documents based on the Australian Signals Directorate's Essential Eight and the National Institute of Standards and Technology’s Cybersecurity Framework. These documents cover key roles and responsibilities and the six core functions of cyber security: Govern, Identify, Protect, Detect, Respond, and Recover.
• Learning: Five learning courses delivered through CompliLearn help staff understand cyber threats and their responsibilities in protecting against them. This training equips staff with the knowledge and skills needed to recognise and respond to cyber threats effectively.
• Assurance: The Module provides tools and templates for risk management and compliance, including a Cyber Risk Register, Cyber Incident Reporting Form, Asset Register, and Cyber Security Audit Checklist. These resources help ensure that key elements of an organisation’s policies are implemented and maintained.
• Reporting: High-quality reporting capabilities enable schools to document and report on cyber security incidents and audits. This supports continuous improvement in cyber security practices and helps identify systemic issues.

By implementing this Module, schools can enhance their cyber security posture and ensure a robust response to cyber threats, ultimately fostering a safer and more resilient educational environment.

Get in touch with us at contactus.complispace@ideagen.com to learn more or visit Ideagen CompliSpace.