News

The City of London Police is warning schools across the UK to be vigilant against phishing attacks targeting school networks. Multiple schools have reported receiving suspicious emails containing malicious attachments that have infected their networks with malware.

Once infected, the school's email systems are used to send malicious attachments to other schools.




Help and Advice against Phishing:

Types of Cyber Attacks: Phishing

Read more …

NCSC Guidance Phishing Attacks: defending your organisation

The ICO has recently published a reprimand for a multi academy trust.  The reprimand was issued in respect of Articles 5 (1) (f) and 32 (1) (b).  An unauthorised third party utilised compromised credentials to access and encrypt their systems.

We have released a new document: Guidance for the use of school email and applying email retention in schools.

The US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) have announced the release of the Guidelines for Secure AI System Development.

The ICO has recently published some guidelines/tips for early years settings.  They have created five practical data protection top tips for nurseries, pre-schools, child minders and other early years settings.

The IAPP recently wrote an article about how organisations and lawmakers are striving to protect the online safety of children and teens in today's advance digital environment.  They find themselves working to solve a 'puzzle' that tries to balance varying legal jurisdictions and cultural considerations.

The Trust Initial Plan Checklist has been updated to include a notes area for each section. This will allow you to record any ongoing tasks or actions for each section.

We have previously reported how the Rhysida Ransomware has focused on attacking the education sector.  Recently the CISA, FBI and MS-ISAC have released a new joint Cyber Security Advisory to disseminate known Rhysida ransomware indicators of compromise, detection methods, tactics, techniques and procedures identified through recent investigations.

An updated version of the Data Retention Workshop Powerpoint slides has been uploaded to the Records Management Best Practice Area:

As a data protection officer we are seeing a rise in the number of cyber attacks on organisations.  We often find that the fact an actual crime has been committed is sometimes overlooked in the panic and need to recover data and get operations back up and running.  According to the National Crime Agency (NCA) cyber crime continues to rise in scale and complexity, affecting essential services, businesses and private individuals.  Cyber crime costs the UK billions of pounds, causes untold damage and threatens national security.

We are often asked to help and advise when it comes to redaction as part of a subject access request.

The National Cyber Security Centre looks back at it's key developments and highlights over the last year in it's 2023 annual review. The National Cyber Security Centre (NCSC), a part of GCHQ, is the UK’s technical authority for cyber security.

The British Computer Society (BCS) has recently published the biggest data leaks of 2023.  The leaks cover worldwide cyber attacks, but the lessons learned apply to organisations of all types all around the world.  The data breaches include The Guardian Newspaper, LastPass password manager, Royal Mail, MOVEit, Microsoft, The UK Electoral Commission.

An article by Computing magazine has reported that controls that Microsoft rolled out to protect Windows 11 from hackers seeking to exploit security vulnerabilities in hardware and device drivers are inadequate, security researchesrs at VMware claimed last week.

We launched our Schools Best Practice area at the beginning of this term which includes specific guides and support for schools.  There is also a specific area for Trusts and the Central Team.  The Trusts Central Team section is a specific area for additional requirements and guidance for the central team of a trust and should be used in conjunction with the other tabs in the best practice area.  

Several countries have pledged never to pay cyber criminal ransoms and to collectively work toward disrupting their financial systems.  The members affirmed their joint commitment to building their collective resilience to ransomware.  They will share data on ransomware perpetrators and techniques and establish a blacklist of information about digital wallets used to facilitate ransomware payments.

Google have recently published some guidance to help IT admins meet the DfE digital and technology standards in schools and colleges.  The guidance takes all of the standards in the Meeting digital and technlogy standards in schools and colleges document and offers advice around the use of Google products in applying the standards.

The NSA and CISA Red and Blue teams recently shared the top ten cyber security misconfigurations.  The schools we have worked with that have suffered a cyber attack often find that there are configurations, upgrades or user access controls that were missed.  This advisory highlights all of those and more - these are not in-depth configurations, but often ones that are set up incorrectly and then not checked or updated as time goes by. Although the advisory is aimed at larger organisations, we think it applied to all and will help towards becoming more cyber resilient.

During our data walks we are looking at data breach risks, in terms of 'Who has access to what data?'.  As part of our walk we may ask who has access to the school other than the employees and children attending, for example, Lettings.  As Lettings usually occur outside of the school working day, physical security can be overlooked or not thought about and so raises the risk of a data breach.  This article is launching our Lettings Checklist for schools which is shown at the end of this article.

Recently the ICO reprimanded a company that suffered a ransomware attack.  The attack resulted in a data breach - learning lessons from real-life incidents is a valuable way to promote knowledge sharing and improve.

The UK Online Safety Bill became law on Thursday 26th October.  The UK Government says the Online Safety Act will protect people, particularly children, on the internet.  The Act should make social media companies keep the internet safe for children and give adults more choice over what they see online.  Ofcom will immediately begin work on tackling illegal content and protecting children's safety.

Moving MIS is a daunting task and is no small undertaking for a school. Moving to the cloud from a legacy system means that there are cyber security benefits but may be something new to your organisation. There is often the assumption that the new MIS porvider will seamlessly migrate the data for you, however there is a considerable amount of work that the school must do beforehand in order to make this happen.  This article provides some practical guidance and considerations.

We previously reported on some schools that had sufferred ransomware attacks, namely Thomas Hardye in Dorset.  It has since been discovered the attack was by the hacker group that goes by the name "Rhysida".  
The attack methodology used was by exploiting a known vulnerability in PaperCut.  Other schools have reportedly suffered the same attack from the group.

Computing Magazine recently reported about the ICO reprimanding seven organisation for domestic abuse breaches in the last 14 months.  A collection of public bodies, charitable organisations, law enforcers and lawyers have made personal data slips when handling domestic abuse cases in the last year, showig abusers where to find their victim is hiding.

Here's a little-used function on the Knowledge Bank.

Did you know that you can record offline training events? For example group face-to-face training sessions? Here's how.

As we have seen an increase in the number of cyber attacks on schools we wanted to highlight a white paper that has been produced by the National Cyber Security Centre (NCSC), part of GCHQ and the National Crime Agencey (NCA).  The UK is currently a high value target for cyber criminals, not just in terms of business but against the UK citizens as well.

We've added a Data Protection Officer badge for your website, or to print out!

These can be used to demonstrate your commitment to compliance with data protection legislation and best practice.

The ICO have published a 10 step guide to sharing information to safeguard children or young people from physical, emotional or mental harm. 

The new guidance addresses concerns from organisations and frontline workers that may be scared to share information for fear of falling foul of data protection law.

We wanted to highlight an organisation called the National Cyber Resilience Centre Group which consists of nine regional centres in the UK that were set up to strenghten the reach of cyber resilience across the business community.

A coalitiion of police, government, large employers and organisations and academia are supporting the growth of the Cyber Resilience Centre Network.

The ICO has recently published new guidance about bulk email communications following a number of data breaches caused by the incorrect usage of CC and BCC (carbon copy and blind carbon copy). 

Emails sent to the wrong person or emails copied rather than blind copied to customers/parents are the most common data breaches seen and are often because someone is rushing or under pressure.