Timothy Liu is the CTO and cofounder of Hillstone Networks.
I still remember the pain I felt when I heard about the New Haven school district’s $6 million hack in August 2023. It wasn’t as if I had not heard of hacks or breaches before. This time, however, it just felt wrong. It wasn’t governments attacking governments. It wasn’t cybercriminals trying to steal from the more affluent. It wasn’t political or an act of war. Why did I feel so upset?
Our children are our future, and when someone robs an educational institution, they are essentially robbing us of our future. How did we get here?
Covid-19 forced us to overtrust our technology even more than we should have.
Covid-19 changed everything, especially for educational institutions. Overnight, schools had to go from physical to virtual. The impact of Covid-19 on schools varied across regions and countries, and local circumstances, government policies and the severity of the pandemic often shaped responses.
Schools closed immediately, and they rapidly and widely adopted remote learning strategies. Teachers and students transitioned to online platforms, videoconferencing tools and digital resources to continue education remotely.
The sudden shift to remote learning posed challenges—including disparities in access to technology and the internet, varying levels of digital literacy among students and teachers, and the need for new approaches to engagement and assessment. There was also an accelerated adoption of educational technology (EdTech) tools. Institutions and teachers explored new digital platforms, learning management systems and online collaboration tools to facilitate teaching and learning.
These events brought tons of cybersecurity issues for educational institutions. Covid-19 ultimately helped the education sector land among the top targets for cybercriminals, as noted in the 2022 Verizon Data Breach Report. How did educational institutions become so vulnerable and targeted? I believe that we placed too much faith and trust in the past technology we use for education.
Please don’t place trust in past technology.
Many schools relied on flawed legacy systems and infrastructure that were not designed with modern security principles in mind.
• Dependency on VPNs. Virtual private networks (VPNs) have been used to secure remote access to corporate networks. However, VPNs can have limitations, including potential vulnerabilities and performance issues, especially as more organizations adopt remote work models.
• Perimeter-centric security. A strong perimeter assumes everything inside the network is trustworthy. However, with the rise of remote faculty and students, cloud services and the proliferation of mobile devices, this perimeter has become less defined and more challenging to secure.
• Inadequate user authentication. Many schools rely on username/password authentication. However, if credentials are compromised, attackers can gain unrestricted access to the network—potentially leading to data breaches and unauthorized activities.
• Insufficient access controls. Static access controls are not adaptive to the changing needs of users and applications. This lack of granularity can give users more access than necessary, increasing the risk of insider threats.
• Limited visibility and monitoring. Traditional firewalls may lack robust monitoring and visibility features. This makes detecting and responding to abnormal activities in real-time complex, leaving organizations vulnerable to advanced persistent threats and other sophisticated attacks.
Traditional security models often place too much trust in users and devices. This assumption may lead to overlooking internal threats or lateral movement by attackers who have gained a foothold within the network.
Entrust our future with zero trust.
Let’s flip the story around and stop trusting everything. Zero trust network access (ZTNA) is a security model that assumes no trust, even among users and devices inside the network. Instead of traditional perimeter-based security, ZTNA focuses on verifying identity and ensuring security at every access point.
Transitioning to a ZTNA strategy requires careful planning and implementation. Here are steps that educational institutions can take toward adopting a ZTNA strategy.
1. Identify resources and applications. This will help determine which users need access to these resources and what level they need. Leverage this first step to implement ZTNA in phases, starting with the most critical and easily identifiable resources. Expand the ZTNA implementation to cover additional resources as the inventory becomes more comprehensive.
2. Develop a ZTNA policy. Clearly define access policies based on the principle of least privilege. Limit access to only what is necessary for each user or system. Regularly reassess and update policies to align with the evolving network landscape. Also, note that a hard-to-deploy and hard-to-maintain solution negatively impacts CISOs and overburdens SecOps teams. To overcome the policy complexity challenge, centralized policy management with simple setup and deployment from a central console should be evaluated.
3. Upgrade legacy security solutions for ZTNA. Work closely with your existing security vendors and service providers to understand how to leverage existing solutions as part of your ZTNA strategy. Aim to minimize costs and accelerate your ZTNA transition process with the help of your vendors. For example, you can upgrade next-gen firewalls into the role of ZTNA gateways, and the VPN clients can be upgraded into ZTNA agents.
4. Monitor and manage the ZTNA solution. Ensure the solution is working correctly and that access controls are being enforced. Treat ZTNA implementation as an iterative process. Continuously gather feedback, refine policies and enhance visibility to adapt to changes in the network environment.
Conclusion
While implementing ZTNA without a preidentified set of resources presents challenges, a strategic and adaptive approach can help overcome these hurdles. Regularly reassessing and updating security measures based on evolving information and feedback is crucial for educational institutions. By following the above steps, educational institutions can begin the journey toward transitioning to a ZTNA strategy, enhancing their security posture and better protecting sensitive data and resources.
Let’s put (zero) trust into the education system to secure our future.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
