  Universities hold and process a vast amount of valuable user and research
data. This makes them a prime target for cyber criminals. Additionally,
universities and other educational settings, such as schools and college IT
systems, have become a prime target for some of their own students -- often
motivated by an opportunity to cause damage to networks and websites, and/or
improve their grades.
  This paper provides a focused assessment of the current cyber security threat
to universities, colleges, and schools (`the education sector') worldwide,
providing chronological sequencing of attacks and highlighting the insider
threat posed by students. Fifty-eight attacks were identified, with ransomware
being the most common type of external attack, and hacking motivated by
personal gain showing as the most common form of internal attack. Students, who
have become a significant internal threat by either aiding or carrying out
attacks are not a homogeneous group, as students may be motivated by different
factors, therefore calling for targeted responses. Furthermore, the education
sector is increasingly reliant on third party IT service providers meaning
attacks on third parties can impact the university and its users. There is very
little research analysing this problem, even less research analysing the
problem in the context of schools. Hence this paper provides one of the first
known assessment of the cyber attacks against the education sector, focusing on
insider threat posed by students and offering recommendations for mitigating
wider cyber threats.
