Can you ensure that the personal information of your children is safe with the educational institutions?
Personal Information refers to “any data about an individual who is identifiable by or in relation to such data”. Some of the attributes of personal data can consist (individually or collectively) of name, date of birth, age, sex, parent/ guardian details, address, educational history, phone number and other contact information. Educational institutions gather a lot of personal information on the children and their parents including parent’s profession, place of work, present and permanent address etc.
During the course of the term, these institutions need to share personal information about the students with many Third Parties, be it other such institutions for participation in events, with the Hospital they are associated with to address medical emergencies, with the Third Party who takes measurements of school children to stitch their uniforms, a trip that the institution plans with a Transport Third Party, or with the school buses which are outsourced to a Third Party. With information flowing to so many entities, are the institutions doing enough to safeguard the privacy of the students and the parents who are with Third Parties? Not enough!!
2023 is the year of Cyber-attacks, as per Microsoft Digital Defense Report 2023, “The first quarter of 2023 saw a dramatic surge in password-based attacks against cloud identities, especially in the education sector”. Globally, education was a hard target by cyber attackers and it will continue to remain that way if swift action is not taken to be well-prepared to face such attacks and survive.
Educational institutions hold information about research on a technology or can have Intellectual Property (IP) whose value can be in millions. A large institution is likely to hold a lot of confidential information.
“80% of lower education providers and 79% of higher education providers reported that they were hit by ransomware in the last year, up from 56% and 64%, respectively” – Sophos, The State of Ransomware in Education 2023.
Third Party Risk Management (TPRM) is crucial in the education sector as educational institutions hold confidential information and share a good amount of such information with their Third Parties. Managing this information can be challenging as these Third Parties may not have an IT infrastructure and a low-security posture. The lack of a well-defined TPRM program can potentially lead to data leaks, unauthorized data exposure and data exfiltration.
Defentrix can support educational institutions in defending their security and privacy from their Third Parties
- Build a Third-Party Risk Management (TPRM) program supported by the top management to manage all Third Parties
- Create a customized baseline security standard enabling you to vet the security posture of Third Parties
- Identify security and privacy risks you are exposed to and provide guidance on remediation
- Equip with skills and required tools to manage the program
- Provide services where you allow Defentrix to own the responsibility of managing the entire program
- Enforce the right security language in the contracts to protect yourself from liability and indemnity
