Social engineering in K-12 for beginners

When you think about how technology is used, schools are a unique place. Where else do you have a pack of naive, inexperienced users interacting with technology connected to a wealth of personal information? These young users have a lot on their mind: learning, relationships, identity and more. Cybersecurity best practices likely aren’t always top of mind.

Combine this with budget and resource constraints, and schools become popular targets for cyber attacks. Social engineering attacks on K-12 schools are very common. So how can your school defend against them, especially as attackers evolve their tactics every day?

The first step is knowledge: what social engineering is, what it looks like, how it shows up in schools and how to defend against it. That’s what we discuss in our e-book, Social Engineering in K-12 for Beginners.

Don’t have time for a full read? Check out a recap below.

What is social engineering?

During a social engineering attack, cyber criminals use psychological tactics to trick a user into exposing information. It can take multiple forms, like these to start:

• Phishing: Attackers may impersonate school staff or vendors, mimic legitimate websites and use urgency to gain information.

• Malvertising: Malicious advertising uses online ads to deliver malware or compromise credentials.

• SEO poisoning: Attackers take out ads on search engines for certain terms to get their malicious websites on the top of search results.

How does social engineering show up in schools?

There are a variety of ways schools are impacted by social engineering. Here are some possible scenarios:

• A student clicks on a malicious ad promising them rewards for their favorite game (as long as they provide their login).

• A teacher gets an email from an attacker posing as their administrator and follows the instructions in the email.

• A student download software to help them study, not knowing their download is actually malware.

How can schools defend against social engineering?

There are two main angles to your defense:

• User education for both teachers and students, encouraging a culture where users are comfortable talking to IT if something goes awry.

• Tools and policies to prevent attacks before their start, like content filtering, multifactor authentication, single sign-on and device management.

With the right implementation, everyone wins:

• Teachers can keep the focus on learning.

• Students can learn and explore safely.

• IT admins can focus on other tasks without compromising their data.