With universities becoming more concerned about their networks’ cybersecurity, attackers find ways to breach these systems by targeting inattentive students, staff and professors.
Experts from Russian cybersecurity firm Kaspersky highlight intensified phishing campaigns with fraudsters exploiting the names of some of the worlds’ biggest universities.
As the seasonal change marks the start of a new school year for many markets around the world, this aptly dubbed “back to school season” is traditionally a profitable time for fraudsters as millions of students are getting ready to make tuition payments, or purchase school supplies and new books.
University-specific phishing pages are usually well-crafted and mimic official university webpages or online learning management systems. Once users visit false pages, they are duped into sharing personal information like account credentials, IP addresses or location data.
The importance of universities’ corporate account safety is often underrated when referring to organisations’ data protection. Famous educational institution names, some with critical research centers operating in various fields from political economy to nuclear physics, are used as a lure to distribute phishing pages.
And with governments and large corporations often purchasing research studies from these universities, it makes the sensitive data they possess extremely valuable for attackers.
By accessing students’ or employees’ accounts, the attacker may access personal information of their victims but also their educational plans, payment information and timetable of classes. This carries the risks of online threats transitioning to real life stalking and abuse.
“Education becoming more digitalised is a beneficial shift. Not only do learning management systems allow students to maximise their academic progress in the most efficient way, but also more people across the world get a chance to learn from the best professors at the biggest universities. This also widens the spectrum of threats student face. Scammers are luring students to give away their personal credentials to access data containing not only unique expertise but also private and potentially compromising information,” comments Olga Svistunova, a cybersecurity expert at Kaspersky.
Kaspersky recommends the following measures to safeguard systems and young people against education fraud:
- Check before clicking: It’s always advisable to hover over the link to preview the URL, and look for misspellings or other irregularities.
- Introduce some form of two-factor authentication for information systems, especially web-based ones, and particularly for access to student records, grades and assessments. Set strong and appropriate access controls, so that it is not easy for a hacker to move laterally through the system.
- On campus, have two separate and secure wireless networks, one for staff and one for students, and if possible, a third for visitors.
- Introduce and enforce a robust staff password policy and encourage everyone to keep their access credentials confidential at all times. Never use the same password for several websites or services, because if one is stolen, all your accounts are under risk. To create strong hack proof passwords without having to face the struggle of remembering them, use password managers, such as Kaspersky Password Manager. It’s available for purchasing on its own, but it’s also included as part of Kaspersky Total Security.
- Use a reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Endpoint Security for Business.
Edited by Staff Writer.
expertstrides