How Varonis Helps Schools Secure Data

Educational institutions manage and protect the personal data of thousands of students, making them prime targets for ransomware and other cyber threats.

Today’s threat actors know that schools tend to have insufficient cybersecurity resources and that the recovery time from an attack can take months. Attackers count on K–12 and higher-ed institutions having no choice but to give in to the attacker’s demands or halt learning, significantly impacting the school’s reputation.

That’s why schools, school districts, and universities rely on Varonis.

Education and data security

With Varonis, security teams in the education sector can automatically identify and classify sensitive student, faculty, and staff data, including PII and PHI, across cloud and on-premises data stores and limit who has access. As a result, institutions can drastically minimize their blast radius and reduce the likelihood of a data breach, all without manual effort or impact on everyday business functions. 

Montrey Jackson, Director of Infrastructure and Security for The Westminster Schools, relies on Varonis to protect sensitive information such as social security numbers and passwords.

“Personal data has to be protected at all times,” he said. “Varonis helped in a big way; we’re able to get alerted when files were being shared outside of our organization that contained sensitive information.” 

Varonis’ behavior-based threat models detect the early signs of ransomware automatically. Alerts trigger automated responses, like terminating an affected user’s session or changing a password, to help stop an attack in its tracks. And if a threat lurks in your environment, Varonis has you covered. 

World-class Proactive Incident Response 

Steve Pinkston, Coordinator of Enterprise Directory Services for Gwinnett County Public Schools, said Varonis’ Proactive Incident Response team has been instrumental in protecting their environment. 

“The incident response team has been very valuable to us,” he said. “We can call them in a time of need — as well as the proactive part — so that when things do occur, Varonis alerts us. And that’s something that we don’t get from other companies.” 

As districts move to cloud or hybrid environments, it becomes more challenging to determine where sensitive data lives, who has access, or if it’s under attack.

A U.S. public school system needed help to answer critical questions about user activity and access. They turned to Varonis to identify who was accessing their data and where users were over-permissioned so they could safely lock down access. 

“We’re finally comfortable knowing where we have sensitive data, having gone through the entirety of our SharePoint, OneDrive, and primary file server and classified everything that needs to be classified.” 

Automated outcomes 

Data is growing out of control and is stored everywhere — in SaaS apps, emails, cloud infrastructure, databases, and on-prem storage — and manually labeling sensitive data doesn’t scale.

With districts' budgets and staff stretched thin, automation helps schools save precious time. Institutions need security solutions that can implement access changes automatically without interrupting day-to-day operations.

“We’d have to dedicate a full-time staff member to doing what Varonis is doing today,” said Beau Monday, the Chief Information Security Officer at Punahou School. “With the millions of files that we have in Google Drive, I don’t know how any single person could make sure all those permissions are appropriate.” 

As more schools shift to virtual class options, many districts increasingly rely on collaborative SaaS apps such as Google Drive. This presents a considerable challenge: enforcing data security for thousands of students in the cloud and on-prem.

The IT director for Midwest School District said, “Without a solution like Varonis, the only way to know about issues would be to log in as that person using their credentials and do a manual investigation. Obviously, that would be pretty disruptive and not realistic with thousands of users.” 

Ensure compliance with data privacy requirements. 

Educational institutions need to monitor how sensitive and regulated student data protected under FERPA and HIPAA is accessed and shared so they can prevent unauthorized access, ensure data meets privacy rules, and quickly run reports to prove compliance. Varonis provides a complete audit log of data activity to help satisfy auditors and meet breach notification requirements. 

“Everybody across our school district, from the board to our senior executive team, is excited about what we’re doing,” said Cody Henschel, Director of Information Technology for Saanich School District.  

One U.S. university reached out to Varonis when they discovered a student using Google Drive to distribute copyrighted material. The college’s IT team needed to determine who was responsible and stop the activity. However, with tens of thousands of students and no visibility into user activity, they had no way of finding the proverbial “needle in a haystack.” 

With Varonis in place, the college dramatically decreased its exposure, locked down file shares, and remediated over-privileged settings. 

“Once I got behind the wheel and started exploring Varonis, I began to appreciate how much it could do for us,” the university’s IT specialist said. “The most important thing Varonis does is uncover issues we didn’t know about and offer fixes.” 

Don't wait for a breach to occur. 

As ransomware and cyberattacks on schools continue to increase, it’s vital education IT professionals have a partner they can trust. Student sensitive information at stake includes personal details, academic records, financial information, and sometimes even health records. 

Varonis’ data-first security approach mitigates risk for K–12 and higher-ed institutions and protects sensitive data from threats.

Learn more about how Varonis can secure your student information with a free Data Risk Assessment to gain actionable recommendations and a clear path to remediation.