Cybersecurity Guide for the
Education Sector
Sophos’ expert threat analysts and world-leading threat intelligence
help you to identify and respond to advanced threats faster, 24/7.
The education sector remains a prime target for cybercriminals because of its sheer size and thelarge attack surface that offers the potential for significant financial gains. The number of devices
and diversity of operating systems in the network, the increased use of e-learning tools leading
to new vulnerabilities, and the varying degrees of technical knowledge in students, teachers, andadministrative staff that loosen up cybersecurity in favor of usability are all the factors that affectthis industry which is usually understaffed and underfunded.
Sophos secures educational institutions against a wide range of cyberattacks, including humanled threats that technology alone cannot prevent. From managed detection and response (MDR)
to endpoint and network security, Sophos enables organizations to optimize their defenses andfrees IT teams to focus on the business.

A Sophos Whitepaper. March 2023

Cybersecurity Guide for the Education Sector

Cybersecurity Challenges in the
Education Sector
The cybersecurity challenges for the education sector continue to grow as theindustry undertakes technological advancements, with more institutions turning tohybrid and remote teaching modes that increase vulnerabilities in the system. Besides
this, cyber threats in this sector continue to grow in both volume and complexity.
A 2022 Sophos survey of 320 IT professionals working in lower education and
410 in higher education revealed that 56% of lower education and 64% of higher
education organizations were hit by ransomware in 2021, compared to 44% of

56% of lower education
64% of higher education

organizations hit with ransomware in 2021

$1.58M of lower education$1.42M of higher education

average cost to remediate following an attack>1 Month

26% of lower education and 40% of higher
education organizations took over a month torecover following an attack

94% of lower education
97% of higher education

organizations hit by ransomware said it
impacted their ability to operate
A Sophos Whitepaper. March 2023

education respondents a year before. Education experienced the highest impact
of ransomware on its ability to operate and its revenue/business compared toother sectors. The ransomware remediation costs in lower and higher education
organizations were high: US$1.58M and US$1.42M, respectively.
Compounding the problem is the sector’s slow ransomware recovery: 40% of higher
education and 26% of lower education institutions took over a month to recoverafter being hit by ransomware. Besides the high level of ransomware attacks, thesector witnessed an increase in the broader threat environment: close to half of theeducation respondents reported an increase in the volume, complexity, and impact
of cyber attacks on their organizations.

50%of IT pros in education sector observed anincrease in the complexity of attacks

62% in lower education
61% higher education

data recovered after paying the ransom

72% in lower education
74% in higher education

attacks on organizations resulted in data being encrypted

2%of education sector organizations recovered
ALL data after paying the ransom

Source: Sophos’ global survey on The State of Ransomware 2022

Cybersecurity Guide for the Education Sector

Behind these statistics are several changes in the threat landscape:The professionalization of cybercrime
Over the last year, one of the most significant developments has been thedevelopment and professionalization of the cyber threat economy. Criminalgroups increasingly specialize in a particular component of an attack, forexample, initial access, ransomware, information-stealing malware, and more,
and offer it as a service to other criminals. These ‘as-a-service’ models lower theskill threshold required to conduct an attack, increasing the volume of adversaries
and threats.
These specialist services provide execution guidance and resources for theircriminal customers, enhancing the effectiveness of the attacks. Illustrating thispoint, in March 2022, an associate of the Conti ransomware-as-a-service grouppublished an archive that included a rich trove of documentation and guidance
designed to instruct an “affiliate” attacker in the steps required to conduct a
ransomware attack.

The cybersecurity challenges for this sector don’t end here. The education sector
must cope with threats like data theft of personal details of students, faculty, andother staff; espionage of valuable research and intellectual property data; DDoS
attacks disrupting the continuity of operations; and phishing attacks that trick a
student or faculty and redirect them to a wrong website, among other challenges.

Sophos Security for the Education Sector
Sophos delivers advanced cybersecurity solutions that enable educational
institutions to manage and reduce cyber risk. Our adaptive cybersecurity ecosystemprovides a complete portfolio of market-leading services and products that elevate
our customers’ defenses against even the most advanced threats, all powered by
the unparalleled threat, AI, and security operations expertise of Sophos X-Ops.

Sophos delivers leading cybersecurity outcomes for over
530,000 customers globally.

Attackers are also adopting many of the behaviors of legitimate IT service
providers, including asking ransomware victims to ‘rate their service’ once they
have decrypted the files post-payment.
The evolution of attacker tactics, techniques, and procedures

No vendor has been named a Gartner Leader in endpoint
security more times than Sophos.

Adversaries frequently exploit weaknesses in organizations’ security posture to
avoid being stopped by security solutions. These include:Ì Exploiting unpatched vulnerabilities – This was the number one method
adversaries used to penetrate organizations in attacks that Sophos’ incident
responders were brought in to remediate last year, used in 47% of incidents.
Ì Exploiting legitimate IT tools – Many of the top tools used by IT professionals
are also abused by adversaries, including PowerShell, PsExec, andPowerShell, to exploit stolen access data and credentials. By posing as
legitimate users, attackers hope to trick their way into an environment.

A Sophos Whitepaper. March 2023

The highest rated and most reviewed MDR Service,Endpoint and Firewall on Gartner Peer Insights.

As of August 1, 2022

Cybersecurity Guide for the Education Sector

Sophos Adaptive Cybersecurity Ecosystem

Managed Services
Sophos MDR

Sophos Central

Sophos Rapid Response

Sophos XDR

MobileServers

Virtual Machines

Containers

Cloud Environments

Sophos Endpoint

Sophos Firewall

FirewallSophos Server Protection

Sophos Switch

SwitchSophos Cloud Native Security

Sophos Mobile

Sophos Zero Trust Network

AP

Sophos Cloud
Workload Protection

Sophos Email

Network
Security

Sophos Encryption

Sophos Wireless

SD-RED

Sophos Cloud Series Firewall

Sophos Phish Threat

Cloud
Security

Endpoint
Security

Email
Security

Endpoint Security

Network Security

Cloud Security

Email Security

Identity
SOAR
Threat Intel

Sophos X-Ops

SIEM
ITSM

Sophos AI

Sophos Labs

Data Lake

A Sophos Whitepaper. March 2023

Security Operations

RMM/PSA

Third Party Integrations

Open APIsPC

Self Managed

Cybersecurity Guide for the Education Sector

Use Cases
Sophos can help address the most common cybersecurity challenges facing the
education sector.

Stopping advanced human-led attacks, including
ransomware
Sophos MDR is a fully-managed, 24/7 service delivered by experts specializing indetecting and responding to cyberattacks that technology solutions alone cannot
prevent. Our expert team stops advanced human-led attacks on your behalf,
neutralizing threats before they can disrupt business operations or compromise
sensitive customer data.

“The pen testers were shocked they couldn’t
find a way in. That was the point we knew we
could absolutely trust the Sophos service.”
University of South Queensland“Since implementing Sophos, we’ve managed tofree up significant operational hours that haveallowed our teams to focus on initiatives thathave increased our student satisfaction.”With Sophos MDR, our expert analysts detect and respond to threats in minutes –using your preferred technology – whether you need a full-scale incident response or
assistance making more accurate decisions.
We use:Ì Sophos' award-winning solutions, including our
endpoint, firewall, cloud, and email protection
Ì Products from other vendors such as Microsoft, CrowdStrike,
Palo Alto Networks, Fortinet, Check Point, Rapid7, Amazon Web
Services (AWS), Google, Okta, Darktrace, and many othersÌ Any combination of our technology and other vendors’ technology
Sophos MDR protects your organization from advanced attacks that technology
solutions alone cannot prevent while increasing the return on your existing
investments. As the world’s most trusted MDR provider, we have unparalleled depth
and breadth of expertise in threats facing the education sector. Leveraging thisextensive telemetry, we can generate ‘community immunity,’ applying learnings
from defending one education customer to all other customers in the industry,elevating everyone’s defenses.

MOST TRUSTED#1 Provider

TOP RATEDBEST PROTECTION

4.8/5

38 mins

Gartner Peer Insights

to detect, investigate, respondHighest-rated andmost reviewed
MDR solution as ofAugust 1, 2022

Our analysts areover 5X faster than
the fastest inhouse SOC teams

London South Bank University“The Sophos team acts as our goalkeepers,
sitting behind us with their skill sets and giving
us reassurance that they have our back.”
Inspire Education GroupA Sophos Whitepaper. March 2023

More organizations
trust Sophos for
MDR than any othervendorAs of September 2022

Cybersecurity Guide for the Education Sector

Securing branch and remote sites
Schools and colleges have moved beyond conventional classrooms to technologydriven “digital classrooms.” The remote learning mode requires cloud-hosted
collaboration tools, interactive displays like whiteboards, learning and assessment
tools, and more, made available at high speed and performance. School districts
and universities must securely connect different departments and sites to secure
the exchange of personal data and digital teaching content, financial transactions,and more. The continued growth of new devices accessing the network – privateand school-issued, must be managed and keep pace with upcoming educational
technologies and apps on the network.

Sophos can help educational institutions to connect remote and branch sites; delivercritical cloud and SaaS applications like Dropbox Education, G Suite, ClassDojo, andothers; and share data and information between sites with Sophos Secure Accessportfolio. It includes Sophos ZTNA to support secure access to applications, Sophos
SD-RED remote Ethernet devices to extend your network to branch locations andremote devices safely, Sophos Wireless access points for easy and secure wirelessnetworking, and Sophos Switch for secure access on the LAN. Everything ismanaged through a single cloud-based security platform – Sophos Central.

Sophos Central

Cloud Managment and Orchestration
Sophos ZTNA

Campus/School
Segmented Wi-Fi

CLOUD and SaaS APPS
Sophos Mobile

SophosIntercept X
with ZTNA

Sophos Wireless

Sophos Firewall

INTERNET

DISTRICT HQ

Sophos Firewall

Sophos SD-RED

PoE Switch

IoT Devices
Sophos Intercept X for ServerInternet and Broadband Services 3G/4G/DSL/Cable
SD-WAN and SASE Overlay

A Sophos Whitepaper. March 2023

Remote researchequipment

REMOTE LOCATIONS

Digital highlighters, interactive
whiteboard, security systems, etc.

Cybersecurity Guide for the Education Sector

Securing the endpoints of students and staff

Securing your network

Get complete protection for all your endpoints – Windows, Mac, Linux, and virtual
machines – with Sophos Intercept X Endpoint, our market-leading EDR solution.

Sophos Firewall includes features purpose-built for the education sector to offer
robust protection from the latest threats while accelerating your important SaaS,
SD-WAN, and cloud application traffic. Recognized as a Gartner Customers’
Choice for Network Firewalls 2022, Sophos Firewall tightly integrates a full suite ofmodern threat protection technologies that are easy to set up and maintain.

With cybersecurity, there is no silver bullet or single protection capability to stop
every threat. Each attack combines a different set of tactics, techniques, andprocedures (TTPs), and as a result, there is no ‘one size fits all’ protection solution.
To optimize your defenses, you need layered protection: multiple sophisticatedsecurity capabilities, with each playing its part in defending against advanced
attacks. Sophos Endpoint is packed with these layers of protection, including:Ì Credential theft protection that prevents unauthorized system access.
Ì Exploit protection to stop the techniques adversaries use.
Ì Anti-ransomware protection, which identifies andblocks malicious encryption attempts.
Ì Tamper protection that prevents adversaries from turning
off defenses so they can deploy their payloads.
Combining multiple layers of protection technologies enables us to optimize ourcustomers’ defenses. Testament to the quality of our defenses – and the power oflayered protection – we stop 99.98% of threats up-front (AV-TEST average score)and recently earned perfect scores in SE Labs endpoint protection report.

Ì Powerful Web Filtering Policy
Utilize built-in policies for CIPA compliance and other education-specific features
for SafeSearch and YouTube control.
Ì Child Safety and ComplianceGet compliant immediately with our built-in policy settings and essential features
to monitor activity online.
Ì Context-aware Keyword Filtering
Identify problematic behavior like bullying before it becomes a real issue.
Ì Chromebook Support
Adds to our extensive user authentication options to enable full user-based policy
and reporting on every platform.
Ì Top-Rated Protection from Threats
Ensures you are not wasting time cleaning up malware outbreaks or recoveringfrom ransomware.

A Sophos Whitepaper. March 2023

Cybersecurity Guide for the Education Sector

Securing research and personal data of students and staff
Schools and universities hold vast volumes of research data, with multiple
departments requiring access to data. Furthermore, they collect and process
personal and sensitive information about prospective and enrolled students andstaff, including their financial and health records, legal guardianship, payment
information, etc.
With thousands of users – students and faculty, connecting to their online portals
across a multitude of devices during all times of the day, educational institutions
need to adopt a zero-trust approach of trust nothing, verify everything to secureaccess to their sensitive data and critical intellectual property. Sophos’ Zero Trust
Network Access continuously validates user identity, device health, and compliance
before granting access to applications and data.

The unique integration of Sophos Endpoint and Sophos ZTNA allows them to sharestatus and health information to automatically prevent compromised hosts fromconnecting to networked resources, preventing threats from moving laterally andgetting a foothold on your network.
Data on users’ endpoints operating on Windows, Mac, Linux, and virtual machines
can be secured with Sophos Endpoint protection. It stops the latest cybersecurity
threats to endpoint devices, such as ransomware, file-less attacks, exploits, andmalware, even when they have never been seen before. DLP capabilities detectsensitive data and prevent leaks via email, uploads, and local copying.

Sophos Central

ZTNA Policy, Management, ReportingYour Public Cloud Apps

Sophos ZTNA Client

Continuous User Verification
and Device Validation
Data Center Applications

User Identity and Device Health

Sophos ZTNA Gateway

Intelligent Access Enforcement

A Sophos Whitepaper. March 2023

Cybersecurity Guide for the Education Sector

Identifying risky users in the system

Ensuring child safety and compliance

Sophos Firewall helps you identify top-risk users based on recent web activity,
threat, and infection history. A user’s risk score can help you detect unintentional
actions due to a lack of security awareness or a rogue or negligent user, indicating
potentially problematic behavior early on. Sophos Firewall can log, monitor, or evenenforce policies related to keyword lists related to bullying, radicalization, or selfharm (for example). You can schedule reports to identify users at risk and get details
about their activities, including what and where they are posting or what sites they
are visiting.

Sophos Firewall provides built-in features and policy settings that help organizations
become compliant with local regulations quickly and easily. Sophos Firewall includes
built-in policies for CIPA and pre-defined activities like “Not Suitable for Schools” aswell as features like SafeSearch, YouTube restrictions, and keyword filtering to enable
child safety online.

Decrypting TLS/SSL traffic to maintain a safe learning
environment

The cloud is making classrooms innovative and genuinely collaborative. It offers easy
access to students and faculty to resources across multiple platforms, anywhere
and anytime. Educational institutions save significant money by shifting to the cloudas the costs of hardware and licenses are eliminated. However, the cloud is also an
important target for cybercriminals looking to exploit less established cybersecurity
practices than in traditional on-premises environments.

Tools that facilitate the exchange of resources and collaboration between teams arein high demand in schools and colleges. But nearly all of them, including the internet
search engines like Google and SaaS applications like G Suite, Office365, andDropbox, use encryption security protocols. Encrypted network traffic while offering
protection, blinds network security and application monitoring tools. Cybercriminals
use encryption to conceal malware, sneak hijacked data, cloak data exfiltration
operations, and hide command-and-control traffic.
You cannot secure what you cannot see. Educational institutions must be able tosee the encrypted traffic to control it and maintain a safe learning environment.
Without visibility into encrypted traffic, web filtering solutions cannot detectand block inappropriate web activity. Students can bypass proxy servers to use
unapproved apps and view content that may be harmful without being detected.
Unfortunately, most firewalls lack scalable TLS crypto capabilities and cannot
inspect encrypted traffic without causing applications to break or degrade network
performance. Sophos Firewall, with its new Xstream SSL inspection engine, fully
enables TLS Inspection without compromising performance, protection, privacy,
and user experience. It offers flexible policy tools to make intelligent decisions about
what should and can be scanned, offloading where appropriate with a much higher
capacity for concurrent connections.

A Sophos Whitepaper. March 2023

Securing resources in the cloud

Sophos Cloud Native Security provides complete multi-cloud security coverage
across your environments, workloads, and identities. It protects your cloudinfrastructure and data with flexible host and container workload security for
Windows and Linux. Multi-layered technologies protect against ransomware andother advanced attacks, including cloud-native behavioral and exploit runtime
detections that identify threats such as container escapes, kernel exploits, andprivilege-escalation attempts. It also makes it easy to keep on top of your cloud
spend. You can quickly identify if your account is being abused and eject theadversaries before they rack up a hefty bill.

Cybersecurity Guide for the Education Sector

Conclusion:
Cyberattacks like ransomware, exploits, and phishing can have a severe businessand reputational consequences for educational institutions. Protecting your IT
environments and sensitive data requires an integrated security approach.
Sophos protects your systems and data wherever they exist with our nextgen services and technologies while enabling you to consolidate your security
management with a single vendor. All Sophos solutions are controlled througha unified cloud-based management console, Sophos Central, which allows realtime information sharing between products, centralized management, automatedincident response, and deeper insights – all of which, working together, further
elevates your protection while enhancing the efficiency of your IT team.

To learn more about how Sophos secures educational institutions andto discuss your requirements, contact your Sophos representative orrequest a call-back from our security specialists.

Gartner does not endorse any vendor, product or service depicted in its research publications and does notadvise technology users to select only those vendors with the highest ratings or other designation. Gartner
research publications consist of the opinions of Gartner’s Research & Advisory organization and should not
be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect tothis research, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. andinternationally, MAGIC QUADRANT and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its
affiliates and are used herein with permission. All rights reserved.

© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-03-02 EN-WP (NP)

Gartner Peer Insights content consists of the opinions of individual end users based on their own
experiences with the vendors listed on the platform, should not be construed as statements of fact, nor dothey represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service
depicted in this content nor makes any warranties, expressed or implied, with respect to this content,
about its accuracy or completeness, including any warranties of merchantability or fitness for a particularpurpose.