Half of schools’ cyber security experts receive little or no training annually, despite the education sector being at most risk of cyber threats

London, Monday 03rd October 2022 – One-in-ten UK primary schools (11%) have taken no steps to minimise the impact of a cyber-attack, despite almost all (96%) understanding the risk they pose. Conversely, 89% of secondary schools have made attempts to address the cyber-attack threats they face.

The research, from RM’s Schooling Yourself on Cyber report identified some real concerns. While 64% of secondary schools claim to be members of the RPA with regards to Cyber, only 24% have completed the NCSC training, 5% have registered for Police CyberAlarm and 49% have a response plan. Those are three of the four mandatory requirements (the fourth being offline backup).

Elsewhere, the report shows that over half (53%) of primary schools striving for cyber security best practices focus on introducing new policies online and on-premise – rather than upgrading their technology software or hardware. While the majority (84%) of secondary schools prioritise their cyber security strategy in the same way, they are much more action-orientated overall – with over half (54%) upgrading software (54%).

More than any other nation, schools in England understand that the responsibility for cyber security sits with themselves. Although more than two-thirds (63%) of primary schools and over half (53%) of secondary schools in England believe cyber security practices should be initiated by the local authority, school trusts, or Academy Trust, that number increased to almost three quarters (73%) of schools overall outside of England.

Phishing remains the top concern

When it comes to specific worries, two-thirds of primary schools (66%) highlight phishing attacks as their single greatest concern. Similarly in the secondary sector, nearly all (99%) are concerned about phishing attacks. However, and perhaps pointing to a larger complexity of security threats, secondary schools listed ransomware (57%), information security (63%), and DDOS (35%) as leading threats.

Yet while the threat of a phishing attack is a concern to all schools, one-in-twenty (6%) primary schools and a third (34%) of secondary schools are unaware that most ransomware attacks begin with a phishing attack.

Worryingly, Multi-factor Authentication (MFA) sat very low on schools’ list of priorities. 97% of primary schools and 76% of secondary have not introduced MFA. What’s more, 57% of primary schools listed a lack of awareness as one of the most significant challenges to minimise cyber security risk, while nearly half (48%) also feel that money and budget is a major challenge, a similar figure (43%) for secondary schools.

Schools are left in want of security training

A lack of awareness and a lack of training seem to correlate. In fact, 56% of primary schools stated that the people responsible for cyber security receive training less than once a year, while almost one-in-five (18%) receive no specific training at all; DCMS’ latest cyber security breaches report revealed 41% of primary schools had identified a breach.

The attack threat for secondary schools is higher than amongst primaries, so while 42% claim that those responsible for cyber security receive training more than once a year, only 43% have received training once a year or less.

On the flip side, pupil training in secondary school appears to be more regular according to half (48%) of secondary schools. Meanwhile, primary schools regularly train a mere one-in-twenty (5%) pupils.

Disparities between primaries, secondaries and academies

Comparatively, academies offer more cyber security training to their staff than authority schools and seem to have a greater knowledge of cyber security and offer more training. In fact, academies are more than twice as likely to offer training across the board than state-maintained schools.

There are clear differences in the frequency of training between primary and secondary schools too. Only 11% of primary schools completed NCSC training and 25% review their advice. Secondary schools are much better at this – 24% have completed the training and 57% review the NCSC advice.

It may then come as a surprise that over four in ten (44%) primary schools offer parent training, 13% more than secondary. More disparities arise in the responsibilities category as over two-thirds (69%) of the SLT in secondary school’s report that there is an in-house technical support team responsible for managing cyber security, dropping sharply to 21% in primary schools. This points to why more primary schools (44%) rely on third-party providers, as opposed to 35% of those in secondary schools.