Key Takeaways
- Perimeter‑based “castle‑and‑moat” security no longer works in education because learning now happens on diverse devices, cloud services, and remote locations.
- Credential‑based attacks (especially phishing) dominate; a single compromised password can expose tens of millions of student records, as shown by the 2024 PowerSchool breach.
- Insider threats are significant: over half of insider‑related data breaches in UK schools involve students, often exploiting weak passwords or excessive permissions.
- Zero Trust Network Access (ZTNA) follows the principle “never trust, always verify,” granting least‑privilege, per‑session access and continuously re‑evaluating trust.
- Implementing ZTNA can be done in phases: start with strong identity controls (MFA, removal of standing broad credentials), integrate with existing NAC/endpoint tools, then add continuous verification and tamper‑proof audit logs.
- Even with limited cybersecurity staff or budget, a phased ZTNA rollout reduces breach impact, helps meet GDPR requirements, and offers a force multiplier for stretched IT teams.
The Perimeter Is Dead: Why EdTech’s Old Security Model Is Failing
Traditional “castle‑and‑moat” security assumed everything inside the network could be trusted, relying on firewalls as the sole drawbridge. Modern education environments dismantle that assumption: staff use personal BYOD devices, students bring tablets and phones, guest devices connect daily, and learning increasingly lives in cloud‑hosted SIS, LMS, and remote‑access platforms. As a result, there is no single perimeter left to defend. Once an attacker steals a credential, they can move laterally with little resistance. Cloud adoption in education is exploding—the market was valued at $46.3 billion in 2024 and is projected to reach $316.7 billion by 2034, with SaaS comprising over 62 % of that growth. Trusting the network in this dispersed landscape is a gamble institutions can no longer afford.
Credential‑Based Attacks Have Made the Old Model Obsolete
The December 2024 PowerSchool breach illustrates how a single compromised credential—used on a portal lacking two‑factor authentication—exposed data from roughly 16,000 customers and about 50 million students, becoming the largest breach of minors’ data in U.S. history. No malware or backdoor was required; one employee’s password sufficed. Phishing remains the dominant entry vector: the UK Cyber Security Breaches Survey 2025 reported that 89 % of primary and secondary schools that suffered breaches cited phishing as the initial point of compromise. When millions of records can be unlocked with a stolen password, perimeter trust transforms from a strategy into a liability.
The Insider Threat Dimension: Students, Permissions, and the Access Problem
Insider risk in education is measurable, not theoretical. An ICO analysis of 215 personal‑data breach reports caused by insider attacks in UK schools (Jan 2022–Aug 2024) found that 57 % of incidents were caused by students, and students accounted for 97 % of all attacks involving stolen login details. Moreover, 30 % of insider incidents stemmed from students guessing weak passwords or finding them written on paper—simple opportunistic exploitation of poor access hygiene. A year‑9 student discovering a teacher’s credentials on a Post‑it note can instantly access sensitive systems, overturning the traditional trust model.
Overly Permissive Access Is a Systemic Vulnerability
The same ICO review showed that 17 % of insider incidents resulted from incorrect setup or excessive access rights to systems such as SharePoint. This reflects a systemic problem: staff routinely receive far more permissions than they need, and those rights are rarely reviewed. Overly broad permissions expand the blast radius of any compromised account—for example, a teacher’s account reaching finance systems or a student login browsing staff directories. Zero Trust’s core tenet of least‑privilege access directly counters this by granting users only the resources essential to their role.
What Is Zero Trust Network Access? A Practical Primer for Lean IT Teams
Zero Trust operates on the maxim “never trust, always verify.” No user, device, application, or network connection is automatically trusted, regardless of location. NIST SP 800‑207 outlines seven tenets, including securing all communications irrespective of network location, granting access per‑session, and enforcing dynamic, strict authentication before any access is allowed. In practice, this means eliminating standing permissions, rejecting implicit trust, and avoiding broad network tunnels that hand out unlimited access.
What ZTNA Means in EdTech Terms
Translating Zero Trust to a school or university yields concrete least‑privilege rules: teachers can reach only instructional systems, students only learning platforms, and third‑party vendors receive time‑bound, application‑specific access—nothing more. This approach dramatically shrinks the blast radius of a compromised credential, directly addressing scenarios like the PowerSchool breach where a single password unlocked everything. Automation tools such as Microsoft Entra ID, fed by HR data, can provision these fine‑grained entitlements automatically, providing a force multiplier for FE colleges that often lack dedicated cybersecurity staff (only a small fraction have such personnel, versus 92 % of higher‑education providers).
The Framework: A Practical Zero Trust Implementation Path for Schools and Universities
Adopting ZTNA need not be an all‑or‑nothing leap; a phased roadmap aligns with the CISA Zero Trust Maturity Model (Traditional → Initial → Advanced → Optimal).
Phase 1 – Identity and Access Controls: Enforce multi‑factor authentication everywhere, eliminate standing broad‑access credentials, and shift to per‑session access. For remote users, replace legacy VPNs that hand out network‑level keys with a business‑grade VPN supporting modern authentication and session‑based controls.
Phase 2 – Integrate with Existing NAC and Endpoint Management: Pair ZTNA with Network Access Control (NAC) to deliver continuous, least‑privilege verification—critical in BYOD‑heavy and remote‑learning settings. Improved visibility is essential; for example, the University of Manchester deployed Tanium’s Converged Endpoint Management after a May 2023 breach, gaining real‑time insight across nearly 40,000 endpoints and establishing the foundation for posture‑based access policies.
Phase 3 – Layer On Continuous Verification and Audit Trails: Zero Trust decisions are re‑evaluated throughout each session, confirming that user, device, and context still satisfy policy before every request. This continuous verification also yields detailed, tamper‑proof audit logs, serving both security monitoring and GDPR compliance—a non‑negotiable requirement given that the education and childcare sector accounted for 14.44 % of UK reported data breaches in 2023, with 36.94 % reported after the 72‑hour deadline.
Caveats and Counterpoints: Zero Trust Isn’t a Magic Wand
Zero Trust is not a plug‑and‑play solution. Many FE colleges lack dedicated cybersecurity staff, making an overnight, full‑spectrum rollout unrealistic; a phased approach is the only viable path. Legacy student information systems, learning‑management platforms, or network gear may resist easy integration with modern ZTNA tools, necessitating careful migration planning. Budget constraints are real—UK institutions spend an average of £2 million responding to a single ransomware attack—so ZTNA investment must be weighed against the cost of inaction, while recognizing that primary‑school budgets differ vastly from university finances. Overly restrictive controls can frustrate users, driving them toward shadow IT; thoughtful policy design and user education are essential to mitigate this risk. Finally, Zero Trust is a journey, not a product: with 78 % of UK schools having experienced at least one cyber incident, the goal is progressive risk reduction through the CISA maturity stages, not instant perfection.
Conclusion
The evidence is clear: perimeter‑based security is no longer fit for purpose in education. Attackers target credentials, exploit over‑permissioned accounts, and move laterally inside networks that still trust everything by default. Zero Trust Architecture offers a practical framework that, even in its early stages, can dramatically curb the blast radius of a breach. For IT managers in schools and universities, the sensible path begins with solid identity controls, moves to granular access management, and layers on continuous verification and auditability—step by step. The stakes—student records, institutional reputation, and soaring recovery costs—make the question not whether you can afford to start the Zero Trust journey, but whether you can afford not to.