Waltham Forest Council has become aware of a spate of phishing incidents affecting councils and schools in London. In each case hackers gain control of email accounts because people are asked to click a link to access information and enter their credentials. The hackers then access the victim’s email account and attempt to phish other organisations as well as commit financial fraud. A Waltham Forest school email account is known to have been compromised and used to send emails. 

It appears likely that in all cases the email accounts were compromised because of a lack of multi-factor (or 2 step) authentication. Microsoft and Google provide this for free, and it is probably the single most effective protection you can enable.

As a reminder, cyber security is everyone's responsibility. Schools are considered a soft target by cyber criminals due to their stretched resources and the sensitive information they hold, including staff, pupil, and financial data. 

Your school can easily reduce the risk of serious disruption or financial and reputational loss, by taking a few simple precautions: 

Guidance for ALL staff:

• Use strong passwords by creating passwords from three random words that are easy to remember but difficult for others to guess.
• Use  Multi-Factor Authentication (MFA) or Two-Step Verification on all accounts wherever possible, using applications such as Microsoft Authenticator or Google Authenticator
• Be vigilant for suspicious emails, links, or attachments, always verify the sender, be wary of messages that create a sense of urgency, and report suspicious emails immediately to your IT team

Guidance for IT

• Enforce Multi-Factor Authentication (MFA) or Two-Step Verification on all accounts wherever possible
• Keep your devices secure by installing operating system, application, and security updates as soon as they become available.
• Ensure antivirus protection is enabled and up to date on all devices. Regularly check that antivirus definitions are current and that scheduled scans are running.
• Only download software and applications from official app stores or trusted vendor websites.
• Restrict and do not use administrator accounts for everyday activities, such as web browsing, reading emails, or accessing documents. Use a standard user account for routine tasks and only use administrative privileges when required.

The Technology and Cyber Security guidance has been shared previously with schools and goes into more detail. It is aimed at school leaders and IT support. The National Cyber Security Centre provides specific guidance for the whole school community: Cyber Security for Schools. I have asked representatives from Technology Services to answer any questions you may have at our September forum.