How Varonis Helps Schools Secure Data

Discover how schools, school districts, and universities rely on Varonis to secure data.
Megan Garza
4 min read
Last updated May 24, 2024
graduation cap for schools with Varonis branding, data security

Educational institutions manage and protect the personal data of thousands of students, making them prime targets for ransomware and other cyber threats.

Today’s threat actors know that schools tend to have insufficient cybersecurity resources and that the recovery time from an attack can take months. Attackers count on K–12 and higher-ed institutions having no choice but to give in to the attacker’s demands or halt learning, significantly impacting the school’s reputation.

That’s why schools, school districts, and universities rely on Varonis.

Education and data security

With Varonis, security teams in the education sector can automatically identify and classify sensitive student, faculty, and staff data, including PII and PHI, across cloud and on-premises data stores and limit who has access. As a result, institutions can drastically minimize their blast radius and reduce the likelihood of a data breach, all without manual effort or impact on everyday business functions. 

Montrey Jackson, Director of Infrastructure and Security for The Westminster Schools, relies on Varonis to protect sensitive information such as social security numbers and passwords.

“Personal data has to be protected at all times,” he said. “Varonis helped in a big way; we’re able to get alerted when files were being shared outside of our organization that contained sensitive information.” 

We’re not sitting at a computer 24/7 so automation helps us a lot, setting up remediation on those items so we don’t have to do it manually. We’re able to sleep at night because we know that we have a tool in our environment like Varonis. 

Montrey Jackson, Director of Infrastructure and Security for The Westminster Schools

 

Varonis’ behavior-based threat models detect the early signs of ransomware automatically. Alerts trigger automated responses, like terminating an affected user’s session or changing a password, to help stop an attack in its tracks. And if a threat lurks in your environment, Varonis has you covered. 

World-class Proactive Incident Response 

Steve Pinkston, Coordinator of Enterprise Directory Services for Gwinnett County Public Schools, said Varonis’ Proactive Incident Response team has been instrumental in protecting their environment. 

“The incident response team has been very valuable to us,” he said. “We can call them in a time of need — as well as the proactive part — so that when things do occur, Varonis alerts us. And that’s something that we don’t get from other companies.” 

As districts move to cloud or hybrid environments, it becomes more challenging to determine where sensitive data lives, who has access, or if it’s under attack.

A U.S. public school system needed help to answer critical questions about user activity and access. They turned to Varonis to identify who was accessing their data and where users were over-permissioned so they could safely lock down access. 

Varonis does all the aggregate work for me of classifying data in our file server, SharePoint, OneDrive, and our entire Microsoft 365 environment, and making sure our information is secure,

Security System Admin, U.S. Public School System

 

“We’re finally comfortable knowing where we have sensitive data, having gone through the entirety of our SharePoint, OneDrive, and primary file server and classified everything that needs to be classified.” 

Automated outcomes 

Data is growing out of control and is stored everywhere — in SaaS apps, emails, cloud infrastructure, databases, and on-prem storage — and manually labeling sensitive data doesn’t scale.

With districts' budgets and staff stretched thin, automation helps schools save precious time. Institutions need security solutions that can implement access changes automatically without interrupting day-to-day operations.

“We’d have to dedicate a full-time staff member to doing what Varonis is doing today,” said Beau Monday, the Chief Information Security Officer at Punahou School. “With the millions of files that we have in Google Drive, I don’t know how any single person could make sure all those permissions are appropriate.” 

As more schools shift to virtual class options, many districts increasingly rely on collaborative SaaS apps such as Google Drive. This presents a considerable challenge: enforcing data security for thousands of students in the cloud and on-prem.

The IT director for Midwest School District said, “Without a solution like Varonis, the only way to know about issues would be to log in as that person using their credentials and do a manual investigation. Obviously, that would be pretty disruptive and not realistic with thousands of users.” 

Ensure compliance with data privacy requirements. 

Educational institutions need to monitor how sensitive and regulated student data protected under FERPA and HIPAA is accessed and shared so they can prevent unauthorized access, ensure data meets privacy rules, and quickly run reports to prove compliance. Varonis provides a complete audit log of data activity to help satisfy auditors and meet breach notification requirements. 

“Everybody across our school district, from the board to our senior executive team, is excited about what we’re doing,” said Cody Henschel, Director of Information Technology for Saanich School District.  

For a reasonable investment, you can bake Varonis into your systems and transform your existing team into security experts.

Cody Henschel, Director of Information Technology for Saanich School District

 

One U.S. university reached out to Varonis when they discovered a student using Google Drive to distribute copyrighted material. The college’s IT team needed to determine who was responsible and stop the activity. However, with tens of thousands of students and no visibility into user activity, they had no way of finding the proverbial “needle in a haystack.” 

With Varonis in place, the college dramatically decreased its exposure, locked down file shares, and remediated over-privileged settings. 

“Once I got behind the wheel and started exploring Varonis, I began to appreciate how much it could do for us,” the university’s IT specialist said. “The most important thing Varonis does is uncover issues we didn’t know about and offer fixes.” 

Don't wait for a breach to occur. 

As ransomware and cyberattacks on schools continue to increase, it’s vital education IT professionals have a partner they can trust. Student sensitive information at stake includes personal details, academic records, financial information, and sometimes even health records. 

Varonis’ data-first security approach mitigates risk for K–12 and higher-ed institutions and protects sensitive data from threats.

Learn more about how Varonis can secure your student information with a free Data Risk Assessment to gain actionable recommendations and a clear path to remediation. 

What should I do now?

Below are three ways you can continue your journey to reduce data risk at your company:

1

Schedule a demo with us to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.

2

See a sample of our Data Risk Assessment and learn the risks that could be lingering in your environment. Varonis' DRA is completely free and offers a clear path to automated remediation.

3

Follow us on LinkedIn, YouTube, and X (Twitter) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

do-your-gdpr-homework-and-lower-your-chance-of-fines
Do Your GDPR Homework and Lower Your Chance of Fines
Advice that was helpful during your school days is also relevant when it comes to complying with the General Data Protection Regulation (GDPR): do your homework because it counts for...
banks-secretly-and-silently-struggling-with-ransomware
Banks Secretly and Silently Struggling with Ransomware
“You’re almost certainly not going to hear about successful ransomware attacks on banks,” says Fraud Prevention Expert, Ross Hogan in an interview with Banking Exchange. “It is probably one of the...
[transcript]-ofer-shezaf-and-keeping-ahead-of-the-hackers
[Transcript] Ofer Shezaf and Keeping Ahead of the Hackers
Inside Out Security: Today I’m with Ofer Shezaf, who is Varonis’s Cyber Security Director. What does that title mean? Essentially, Ofer’s here to make sure that our products help customers...
how-to-create-a-good-security-policy
How to Create a Good Security Policy
CIOs have taken note of the nightmarish scenarios data breaches can bring – remember Sony and Target? To combat this ticking time bomb, they’ve beefed up their security budgets. The Computer...