Malware, ransomware and email fraud in schools

Malware

Software that runs on a machine without the user intending it — arriving through an attachment, a download, a compromised website or a device plugged in from home. Once it runs with a user’s permissions it can reach whatever that user can reach, which in a school office is usually a great deal.

The controls that matter are unglamorous: updates applied rather than postponed, accounts that are not administrators by default, and backups that have been tested by restoring something.

Ransomware

Malware that encrypts files and demands payment. For a school the damage is immediate and operational — the MIS, the shared drives, the attendance and assessment records all become unreadable on a Tuesday morning.

Two things decide how bad it gets. Whether you have a backup that is isolated from the network, so it cannot be encrypted alongside everything else, and whether anyone has ever restored from it. An untested backup is a belief, not a control.

Business email compromise

The one most likely to cost a school money, and it involves no malware at all. An attacker gets into an email account, or convincingly imitates one, and asks for something ordinary: a change to supplier bank details, an urgent transfer, a copy of a staff list.

It works because it arrives in a real thread, in the right tone, often from a real address. The counter is procedural rather than technical — any change to payment details is verified by phone on a number already held, never on a number in the email, and no single person can both change bank details and authorise a payment.

What it costs

The cost a school plans for is the ransom or the fraudulent transfer. The costs that dominate are the days of senior staff time, the systems rebuilt, the notification to every affected family, and the period where the school is operating on paper.

There is a regulatory cost too, but it is rarely the main one. The Data Protection Commission’s interest is less in the fact of a breach than in whether the school had reasonable measures in place and whether it notified within 72 hours.

What to have written down

• A Data Breach Response procedure that names who is called, in what order, and who notifies the DPC.
• Payment verification rules in the finance procedure, including the call-back on a known number.
• An Acceptable Use Policy covering devices, passwords, multi-factor authentication and removable media.
• A backup arrangement that someone has tested by restoring, with the test recorded.
• Staff training on what a suspicious request looks like, with completion recorded per person.

The common thread is that none of these help if they are written down somewhere nobody can find on the morning they are needed.