Everyday, fraud organisations are sending phishing emails to all kinds of recipients, even to school staff members. Phishing refers to the aim of an email that tries to trick you into providing sensitive information. This could be login usernames and passwords, account numbers, or even confidential files. When it comes to protecting this kind of information, it is very important to be vigilant with each email you receive. We have created the mnemonic PEGASUS to help you to remember each of the steps to identifying a scam email. If you would like to download or print the graphic below, please click here.

Work through the following steps and scammers won’t stand a chance!

Personal

How personal does the email sound? If the sender addresses you with a generic title at the start of the email and continues to use non-specific language throughout, then this email might not be a legitimate message for you. Most phishing emails are sent in bulk to thousands of recipients at a time, so you should look for content that would make the email specific to you or your school. Look for references to previous conversations, to you, or to your school – if you don’t find any, then this could be the first sign of a phishing email. However, this is not a firm rule because if you are being targeted personally, then the scammer may have done some research to convince you that they are genuine. Check against the rest of these steps to be sure.

Email Content

Similarly to the previous point, it is important to check the body of the email for red flags. If the sender is making an offer that is too good to be true, this could highlight the email as a concern. If they mention an invoice for a product or service that doesn’t sound familiar, or if they claim to be from a company that you don’t normally have contact with, then there is a good chance that they are trying to get information from you illegitimately.

Grammar

Since the first days of email fraud, a giveaway has always been in the spelling and grammar in the email. Scammers from all over the world will send phishing emails to recipients in many countries and will not always be successful in writing the emails using the correct language. Despite the variety of translation, spellchecking and grammar-checking tools available, this is still an indication to be found in scam emails today, so is always good to notice.

Attachments

If you receive an email that seems suspicious, then it is very important that you do not open any attachments. Files attached to suspicious emails can be seriously dangerous once they have been downloaded or opened. Certain attachments will contain viruses capable of causing damage to your computer and files, while others will even spread and affect other devices across the school. Even if they look familiar, such as a PDF or Word document, they can still be harmful, so it is always better to be cautious and avoid clicking on any attachments that come with unusual looking emails.

Sender

Have a look at the sender address of the email. Depending on how you access your emails, it might be listed at the top of the email, or you may have to click on the sender name to see the address in full. Does it look long or complicated, or does it have a spelling mistake? If so, then it could be from a fake source. Even if the domain is spelled correctly, it may actually be different, by having extra words or symbols included, such as @facebook vs @face-book. Click on the sender to see the email address in full and make sure that the domain looks legitimate. If this is not the case, then it could be a scam. This is particularly important for recognising a scammer who is targeting you or the school personally. Most reputable organisations will use the same domain for both their emails and their website, which means that if the part after the @ symbol doesn’t match up with the website address you would normally use for a particular business, then it could be fraudulent.

Urgency

A trick that scammers use to get us to give up our details is by making us feel under pressure to provide the information quickly. This might be by threatening you or saying that your account will soon be locked, or that you urgently need to pay an invoice. This is a very common way to tell that the email might not be all it seems. Disarm the sender by taking a moment to carefully check the email against PEGASUS. It is always better to be safe, so don’t let the emails trick you!

Sensitive Information

The clearest way to tell that an email is illegitimate is by noticing what the sender is asking of you. If you are being asked for sensitive information, such as passwords, account numbers, or sensitive information, then it is likely to be from a harmful source. Reputable businesses go to great lengths to make sure that sensitive data such as banking information is requested securely and that you feel comfortable submitting it. If you are typing important information into a form that feels unfamiliar, unprofessional, or otherwise strange, then take the time to check the website address at the top of your browser. As before, if anything is spelled wrong, or is different from a website you would normally use, then don’t trust it. Don’t even type into the form, as some websites can collect the information you type even before you submit the form.

What to do next

If you suspect that you have received a phishing email, do not click on links, do not open attachments, delete the email and if you have provided any information, change your password immediately, or ask us to. We are happy to confirm any suspicious emails that you receive, although if you follow PEGASUS this won’t be necessary, and you can simply delete the email.

It might seem like the simple task of checking your emails is fraught with danger, but most scam emails will give themselves away quite quickly. If you remember to be calm but cautious, then this article will have given you the tools that you need to protect your school and your files with confidence!

Above all else, schools should be happy, inclusive places that have a truly open, collaborative and community feel.

But, it would be irresponsible not to recognise the importance of keeping school data private.

Data privacy is a growing issue for schools, as education and research organisations are handling a greater amount of information, while at the same time being subject to a growing number of cyber hacks.

Disclosure of information is one of the most common threats, and it’s vital that schools take steps to protect their data and that of every student.

What are the threats to education data?

With e-learning platforms, virtual classrooms and BYO devices becoming the norm, the way school data is stored, accessed and shared is constantly changing.

While many of these advances are positive and make for a more collaborative and creative learning environment, there are also serious negatives that need to be recognised and addressed.

Data privacy is a hot topic for the education industry as more and more cyberattacks occur.

While the information schools store might look innocuous, it’s naive to assume that school data can’t be valuable to hackers.

Student names, addresses, academic and health records, and more, are all stored on school networks. With paper records, in dusty filing cabinets, a thing of the past, all of this personally identifiable information (PII) is on the school network and vulnerable to hacks.

In addition to phishing scams, that trick people into giving information, ransomware hacks are also on the rise. With students using their own devices, this type of infectious virus can more easily infiltrate a network if proper security standards aren’t used.

Get to know your data

It’s hard to protect something if you don’t know what that something is.

Doing a data audit – that is, a data inventory and mapping of all the processes that collate and use/store student information – will give you a good base from where to start.

Once you know the kind of data you have, you can start to discover platforms and IT vendor features that can help you better protect and use the information between staff and parents, or across your management networks.

How to improve your school security

The amount of data stored and used by schools can feel like an ocean of information. And how can something as small as a school protect something as large and ever-changing as an ocean?

Don’t panic. There are some simple ways to help improve the way you secure and protect your school data.

1. Talk to your people

The weakest link in data security is people. Sad, but true. Equipping your staff, students and teachers with the basics, about how to stay safe and secure online, can be a great step in stopping things like phishing scams and ransomware attacks. Conduct regular sessions with leaders who can pass on the correct information, and let your teams be part of a safe data solution.

2. Put policies down in writing

Allow and encourage your IT decision makers to create a set of guidelines and policies, around devices and access, that everyone in the school can see and understand. As well as making specific departments or leaders accountable, it also acts as a handbook of what to do when suspicious external sources request information they shouldn’t need.

3. Use a trusted IT vendor

Sounds like common sense, but when employing a third party IT vendor or support service, ensure you’re using trusted, reputable, global brands. These internationally recognised organisations can offer you the security options you need, and know what requirements your school legally and practically requires.

Anyone who has ever walked into a school – let alone works in one – would attest to the fact that schools are busy, busy places.

Put aside the day-to-day demands of running a building that potentially houses hundreds or more children and educators, but the added weight of responsibility of teaching, management and organisation is simply mammoth.

Aside from chaining the gates and locking the doors, school security might not always come at the top of the essential, daily To-Do list. But in the growing environment of cyber threats and attacks aimed at the education industry, it’s never been more vital to take the time and ensure you have an up-to-date IT system, that helps keep your school safe.

Need convincing?

Outdated systems are at risk

Given the choice when taking a flight, would you choose a brand new, state-of-the art aircraft, or an older, less sophisticated tin can with a few million kms under its wings?

It’s the same when you think about the IT system you’re relying on to store your valuable school data and keep your operations running. The older the system and software, the more gaps in the security standards.

It’s also true that the longer hackers have access to a certain system, the easier it is for them to identify how to circumvent any security measures.

Older technology can’t recognise new threats

Just because your current software and hardware still looks like it’s working, it’s unlikely that it’s able to offer you the protection you need against newer, more sophisticated threats.

Every time a hack is exposed, hackers learn how not to do it.

This is extrapolated by the fact that technology is an ever-developing part of our lives and new security measures may not be compatible with older machines and programs.

Legacy platforms can’t act as quickly to stop threats

While older systems will have some security functions and be able to monitor and track threats once they happen, they won’t have the kind of up-to-date intrusion detection facilities that newer platforms can offer.

These new functions not only pinpoint a threat but can stop it before it crosses into your network, preventing costly and time-consuming damage and disruption.

Costly crashes and lost time

Computers crashing feels like an outdated concept today, with sophisticated systems simply not getting overloaded as easily as they once did.

However, old models and outdated software are more likely to crash, resulting in lost data and valuable time.

Communication between both school and parents, and within the school itself, is essential to keeping the cogs turning. The longer, and more frequent, system crashes are, the more learning time is lost and communications missed.

Why your system needs an IT upgrade

Even thinking about updating your school IT system might feel like too big a job to tackle. But it doesn’t have to be hard – or costly.

For one thing, you don’t have to do everything at once.

Assessing what your school needs most, where systems could be working better, and teachers and students need greater support, will clarify what areas are most in need of an upgrade.

Even making small changes, where you are able to see the benefits quickly, can help make the changes easier.

Upgrading your school IT also doesn’t have to blow all of your budgets. Good, reliable, reputable vendors don’t mean huge bills, and some platform features are free to eligible schools.

School security and safety is, and should be, a primary issue. A reliable, up-to-date IT system will save time and money, and allow your school to focus on successful outcomes.