Threats and risks for digital security in the educational environment

Although technological measures such as encryption, firewalls, IDS, SIEM, and MFA are crucial for securing digital systems, they are not sufficient on their own. The greatest security risk often comes from the users themselves—their lack of knowledge and failure to follow basic rules, carelessness or inattention, and lack of confidence in their ability to recognise threats.

Therefore, educating all participants in the educational process—students, teachers, administrative staff, and even parents—is a key component of protecting personal data and systems.

1. Regular Education for Teachers, Students, and Parents on Digital Hygiene

Digital hygiene includes a set of basic habits that users should adopt to behave responsibly and safely online:

• using strong and unique passwords,
• regularly updating devices and software,
• recognising phishing messages and social engineering attempts,
• protecting personal information on social media,
• safely using public Wi-Fi networks.

Example: 

In Slovenia, the Ministry of Education, in collaboration with SI-CERT and ARNES, organised a national campaign called Varni na internetu (“Safe on the Internet”), which includes educational brochures, videos, and workshops for schools and parents.

The following link is available in Slovenian only. Participants may use free AI-powered translation tools to access the provided materials.

Varni na internetu – Education and Tools

2. Introducing a Curriculum on Digital Literacy and Security from an Early Age

Learning about digital security should start in primary school, with age-appropriate content that introduces students to concepts such as:

• digital identity,
• digital footprint,
• privacy and security,
• cyberbullying, phishing, social engineering,
• fake news and data manipulation.

The goal is to help children develop critical thinking and responsible behaviour toward digital technologies.

3. Workshops and Simulations of Security Incidents

Practical experience helps users be prepared for real threats and have a clear plan for managing cyber incidents. Training should include:

• phishing attack simulations,
• exercises responding to ransomware and other cyber incidents,
• scenarios involving data theft or improper sharing of information.

In such workshops, organisations and participants learn to recognise threats, know whom to contact, and take steps to prevent or mitigate damage.

Example: 

In the United Kingdom, schools often collaborate with the National Cyber Security Centre (NCSC), which offers free cyber incident simulation toolkits and organises educational events for children and teachers.

NCSC – CyberFirst Schools Program

Conclusion

Technology can protect systems, but only education can protect users. Investing in continuous education on digital security and privacy is key to creating a cyber-safe educational environment.

Education should not be a one-time activity but a continuous process that evolves and adapts to new threats and technologies.