Hackers, fraudsters, and cybercriminals continue to target higher educational institutions as more schools transform their learning and course delivery to an online strategy. Even with onsite campus instruction returns, more universities continue to move all courseware, textbooks, and labs to an online digital experience. Creating this digital educational experience also creates more attack surfaces in business email compromises, phishing campaigns against university officials, and cyber threats against the student portal.
Higher education institutions throughout the United States are transforming, allowing students in-person classes and continuing usage of remote learning online classes. Email and onsite chat forums continue to be the primary communication between students and professors. Email is also a common vector for hackers.
A rise in phishing scams, credential stuffing attacks, and fraud.
The cost of cyber attacks against higher education runs into several millions of dollars. Institutions like the University of California, George Washington University, American University, biodefense George Mason University, and North Carolina A&T, just to name a few, suffered from email phishing attacks.
Challenges with the protection of the students and university systems
Leveraging next-generation education experience is essential for universities to reach students from around the world and onsite students with one system. Hackers attack these platforms to gain access to student records, research materials, financial information, and donor contact. Email continues to be the most effective way to attack students and faculty members.
In the first six months of 2022, there were an estimated 2,297 malicious email security incidents per week targeting education and research institutions.
Email phishing attacks from threat actors and malicious actors against students happen across several methods, including:
- Spear-phishing attempts
- Trap Phishing
- Vishing attacks
- Barrel-phishing attacks
- Social engineering email
Students, especially incoming freshmen, are particularly vulnerable to cyber-attacks. While email phishing frequently attacks the student, the contents inside the messages will vary.
Here are some examples of email phishing attacks impacting students and universities:
- “Hey, welcome to the campus; if you have not done, please purchase your parking pass here. Click on www.byuyoupass.org”
- “Tuition due? Pay here in minutes. Late on your tuition and need a loan to stay in school? Click here and fill out a quick application, and we will fund your loan in minutes, guaranteeing”
- “Forget to pay that parking ticket on campus?” No worry, click and pay instantly!”
- “Used books for sale, click here and save big!’
Social engineering, email-based impersonation attacks, and Vishing attacks are becoming a bigger problem for higher education.
Social engineering attacks for email, SMS, or voicemail prey on vulnerable students. Hackers will trove through social media sites looking for students and their email addresses. Many will use an impersonation attack method to intimidate the students.
“Jane, this is professor Allan from history 101. Your assignment was not turned in on time. I regret to inform you that I have given you an “F” for the assignment. If you want to discuss this further, please call me at 1 777-555-1212. This is my direct line.”
For any student, this type of message is both intimidating and concerning. Jane dialed her professor’s private number. “Professor, this Jane. I got your email. I did turn in my assignment. I don’t deserve an “F!”
The hacker receiving the phone continues to impersonate the professor. “Jane, are you calling your professor a liar? Do you want me to give you another “F?”
The student becomes a victim of several attack vectors in exchange with the hacker.
- Phishing – Luring her into a conversation
- Social engineering – Hackers discover the victim’s name and university through social media. By looking up the directory for professors, the hacker a commonly required class for all incoming freshmen.
- Double Barrel Phishing – Using a two-message attack vector, the hacker sent an initial message with a direct, informal tone attempting to lure the student into contacting them using an impostor phone number. The hacker became much harsher and more straightforward with the student during the voice call. This change of tone is standard in a double-barrel phishing attack.
What steps can higher education take to protect their email channel from hackers?
An email will continue to be the top method of communication with higher education and other industries. Protecting students and professors from phishing and ransomware attacks takes more than just technology. Through continuous security awareness training, on-campus events by email security vendors and industry executives will help draw attention to the severity of email threats and attacks.
With a limited IT and security staff at higher education institutions, the universities need security solutions to manage more efficiently while meeting HIPAA, PCI, and other compliance mandates.
Deployment of Trustifi holistic email security solutions
Universities and other higher education institutions have invested in email security solutions to help deal with the continuous attacks. Trustifi, a global cloud-based email security company, supports several higher education by consolidating several email security adaptive controls into one platform. This consolidated platform helps lower the cost of the solution while simplifying the management of email security controls into one console.
Comprehensive protection with Trustifi email security
Trustifi’s international experience in higher education is a proven leader in stopping real-world threats, phishing attacks, spear phishing emails, and business compromise email impostor accounts.
Many university systems have deployed email security solutions to protect the facility and students. Most online email systems, including Microsoft office 365 and Google Gmail, offer antivirus and antimalware solutions. Many email phish messages are still in the student’s email box. Trustifi cloud-based email security is often deployed with office 365 and Google Gmail security for an additional layer of protection.
Trustifi’s holistic email security platform alignment with healthcare security
Trustifi’s holistic email security service offers several capabilities for higher education, including one-click compliance for email encryption, data loss prevention, inbound and outbound phishing, malware protection, and email-managed detection and response offering.
- The Trustifi Inbound Shield™ is cloud-based, easy to install, and doesn’t require any architecture changes. You get peace of mind that your emails are protected from suspicious emails and zero-day attacks without any complex setup or concerns about missing email messages. Plus, it deploys in minutes, not days.
- The Trustifi Outbound Shield automatically scans with an enhanced security engine and encrypts outgoing email messages according to administrators’ policies, so any emails that contain sensitive information are automatically secured.
- The Trustifi One-click for compliance for encryption. With the One-Click Compliance tool, administrators can easily set the platform to screen emails to ensure they automatically comply with more than ten regulatory compliance guidelines, including HIPAA, PCI-DSS, GPDR, CCPA, NIST-800-53, FERPA, and ISO 27000 series.
- The Trustifi Data Loss Prevention. The system automatically scans outgoing emails and applies the rules set by your administrator, then finds the keywords and automatically encrypts and locks the relevant outgoing emails without any input from the user.
Simplifying the email protection experience
The need for greater email security to deal with phishing and ransomware has never been more critical than now. The need to make the user experience easier is also paramount. Every user capability, including sending and receiving messages, encrypting emails based on a DLP rule, and finding lost messages, is a positive strategy to change the current email security culture. If a user has difficulty encrypting statements, in most cases, they will still send the message in the clear.
Trustifi single console for ease-of-use management
Trustifi’s email security services feature a comprehensive suite of email tools for advanced threat protection, data loss prevention, and enterprise email encryption.
- Enables email authentication for both inbound and outbound emails.
- Protects against data loss from outbound emails.
- Enables rapid response to threats and sophisticated threats and attacks.
- Advanced Threat Protection against malware attacks
- Detection and prevention of email-borne threats and spam emails
- Spoofing, phishing, and fraud detection
- Email account compromise
- Zero-day threats
With Trustifi vendor consolidation and reduction of resource cost allocation, they align with the needs of higher education while not compromising on email protection, all with a single pricing model.
Trustifi continues to add capabilities to stop potential threats, including artificial intelligence, machine learning, and threat intelligence, into its platform to help future-proof protection for its clients without adding additional complexity when enabling these new services.
Trustifi offers consolidated solution pricing to support the higher education marketplace for better cost savings. Trustifi requires fewer security operations, time allocation, and management resources. The solution is API based, not an appliance requiring a complex re-configuration of your email flow. Trustifi installs in minutes and requires no maintenance or upkeep. Trustifi’s Email detection and response (EMDR) offers clients access to experts to assist with the implementation.
Culture
As a global cybersecurity provider of both inbound and outbound email protection, Trustifi currently supports customers from countries including the USA, Canada, Brazil, the Dominican Republic, the UK, the Netherlands, India, the UAE, China, Japan, Cyprus, the Philippines, and more. The company has also developed “One-Click Compliance” capabilities that cater to world security regulations, including PDPO for Hong Kong, POPI for South Africa, GDPR for Europe, and LGPD for Brazil.
