Waltham Forest Council has become aware of a spate of phishing incidents affecting councils and schools in London. In each case hackers gain control of email accounts because people are asked to click a link to access information and enter their credentials. The hackers then access the victim’s email account and attempt to phish other organisations as well as commit financial fraud. A Waltham Forest school email account is known to have been compromised and used to send emails. 

 It appears likely that in all cases the email accounts were compromised because of a lack of multi-factor (or 2 step) authentication. Microsoft and Google provide this for free, and it is probably the single most effective protection you can enable.

 Cyber security is everyone's responsibility. Schools are considered a soft target by cyber criminals due to their stretched resources and the sensitive information they hold, including staff, pupil, and financial data. 

 Your school can easily reduce the risk of serious disruption or financial and reputational loss,  by taking a few simple precautions: 

 Guidance for ALL staff:

• Use strong passwords by creating passwords from three random words that are easy to remember but difficult for others to guess.
• Use  Multi-Factor Authentication (MFA) or Two-Step Verification on all accounts wherever possible, using applications such as Microsoft Authenticator or Google Authenticator
• Be vigilant for suspicious emails, links, or attachments, always verify the sender, be wary of messages that create a sense of urgency, and report suspicious emails immediately to your IT team

 Guidance for IT

• Enforce Multi-Factor Authentication (MFA) or Two-Step Verification on all accounts wherever possible
• Keep your devices secure by installing operating system, application, and security updates as soon as they become available.
• Ensure antivirus protection is enabled and up to date on all devices. Regularly check that antivirus definitions are current and that scheduled scans are running.
• Only download software and applications from official app stores or trusted vendor websites.
• Restrict and do not use administrator accounts for everyday activities, such as web browsing, reading emails, or accessing documents. Use a standard user account for routine tasks and only use administrative privileges when required.

Schools should ensure that they have access controls in place:

• Mobile phones - can access the internet and so you must have a policy on phone use in school which covers staff, visitors and students
• Controlled access to files - both on the school network and files on the Cloud. Ensure that there is an audit trail of who accessed what information and from where
• Cloud storage - where a school is using low cost Cloud storage make sure that it is set up as a school storage area as major suppliers provide security appropriate for a school. DO NOT use personal cloud storage spaces

The Technology and Cyber Security guidance goes into more detail and is aimed at school leaders and IT support. The National Cyber Security Centre provides specific guidance for the whole school community: Cyber Security for Schools. 

In November 2018, the DfE published draft non-statutory guidance on Cybersecurity & safeguarding for schools.