The worst time to work out who’s supposed to do what is during the incident itself. A cyber incident response plan only earns its name if it’s been read, agreed, and actually rehearsed before the day it’s needed.
Hackers are always finding new ways to break into accounts, and password attacks remain one of the most successful routes into school and trust systems. Password security isn't just an IT job: everyone with a login has a part to play.
This article explains what a cyber incident is and what you should do if your school or trust experiences one. A cyber incident isn't necessarily a full-blown cyber attack, but it should still go through your reporting and risk management processes.
Antivirus software used to be something you installed once and forgot about. That’s no longer good enough, not because the software changed, but because what it’s defending against did.
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.
Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.
Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.
Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.
Over the past two weeks, we've covered how attackers get in: phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.
The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.
Ransomware headlines tend to focus on big retailers, hospitals, and government agencies. But schools and colleges are an escalating, and in some ways more vulnerable, target, and a recent case shows exactly how indiscriminate the threat is.
A well thought-out plan gives you a structured approach to improving your security posture, identifying weaknesses, and ensuring a rapid response when an incident occurs. The goal is moving from reactive panic to proactive preparedness, and that starts with understanding exactly where you stand today, before building the plan and risk register that gets you further.
©2026 Data Protection Education Ltd.