FE Week tells the inside story of the cyber attack that shut down one of Birmingham’s major colleges, and finds out what others can do to protect themselves from similar threats.

At around 3am last Saturday, an alert rang out around South and City College Birmingham’s key staff and managers that the server had crashed.

The news reached principal Mike Hopkins later that morning, while he was training to cycle this year’s Tour de France for the charity Cure Leukaemia.

“We went in to find out what’s going on, to see all hell was breaking loose,” he told FE Week. He called it a “very high-level, automated” attack, committed through an unknown “backdoor” into their system. The college believes it had something to do with administrator’s rights.

The hack was what is known as a ransomware attack – where criminals restrict access to computer services until the victim pays up – as it “effectively encrypted all our systems and files, everything”.

This meant staff could not access services such as human resources and finance, so: “We’ve had to adopt alternative arrangements of systems to raise orders, pay bills, etc.”

However, it has not affected the college’s banking, and payroll has been adapted. No ransom has been demanded yet, but Hopkins has been told the perpetrators usually demand £2 million in the cryptocurrency Bitcoin.

One of the first things they had to do was secure their computers from being infected, as “turning one on would have caused real difficulty”.

SCCB is one of the biggest colleges in England, with eight campuses and centres across Birmingham, so it was a “weekend’s job,” Mike said, of staff racing around unplugging every machine.

Apart from that, there was “nothing at all we could do but shut down the college”.

Without access to emails, social media was relied on to get the word out for its 13,000 students to not come to lessons on Monday morning and to stay at home for a week.

1/3 TEMPORARY CAMPUS CLOSURES❗️The college has suffered a major ransomware attack on our IT system, which has disabled many of our core systems. Our campus buildings will therefore be CLOSED TO STUDENTS for a week from Monday 15 March to allow our IT specialists to fix the issue.

— @southandcitycol (@southandcitycol) March 13, 2021

Online provision has been able to continue as the college can access Microsoft programmes such as Office and Teams, and now their emails.

This week, the college has called in IT security specialists IP Performance and education technology experts Jisc to establish what has happened.

Action Fraud, the National Cyber Security Centre, the Information Commissioner’s Office and funding bodies have also been contacted.

The college is still not entirely sure how the hackers got in, and whether any information has been stolen. “The key to begin with,” Mike said, “is making sure we get to the bottom of exactly what they’ve done where they have got into, and that you don’t leave a backdoor in”.

‘It’s an absolute pain in the backside with Covid’

From Thursday, a number of students came back on to campus, including those on practical programmes, those who cannot access IT due to a language barrier and some vulnerable learners.

A full return to face-to-face provision may not happen for many weeks, Hopkins warned. The college is continuing to give students laptops and internet dongles to rent but will be increasing the numbers of students back each week.

Hopkins praised neighbouring Birmingham Metropolitan College (BMet) for allowing SCCB to use its facilities for accountancy exams scheduled for this week.

“If anybody thinks that colleges can’t and don’t work collaboratively, here is one of the best examples you can possibly get that we do.”

Hopkins is not sure when his college will return to “normal,” as having asked this question on Tuesday, he was told “how long is a piece of string?”

Firstly, the college has to establish what has happened, and each of their “tens of thousands” of machines has to be checked for infection – this first stage is expected to take until Easter.

“It’s an absolute pain in the backside with Covid,” Hopkins said, and their onsite coronavirus testing centre had to be put on hold and students were instead sent testing kits to use at home.

However, as an experienced college leader, Hopkins refuses to be intimidated by the attack: “I have this fundamental view there’s no such thing as insurmountable problems.”

One downside is “I’m not sure there is anything to be learned from it,” Mike said, as after having analysed attacks at other institutions “we thought we’d done everything that we could”.

“But you can’t stop everything because the very nature of the college is that we’ve got, like most colleges, an array where our staff and students can access their user areas remotely.” He did, though, believe this attack was “different”, owing to the possible use of administrator’s rights.

“Covid, in some sense, has helped us because there has already been that massive shock to the system, so people are used to dealing with difference and are certainly used to working at home.”

Colleges ‘sometimes don’t have a clue about their IT systems’

While Hopkins and his team were able to act quickly on their breach, other colleges have in the past been caught quite unprepared for a possible cyber attack.

Eighty per cent of further/higher education institutions identified a cyber security breach or attack in 2019, according to figures published by the Department for Digital, Culture, Media and Sport.

Stefan Drew, a marketing consultant to colleges, with experience working on related IT systems, cites one college he worked with where the staff did not know where their server was: not IT, not marketing and not the web developer.

“I actually found it, in the end, in a basement of the college on a table. It was above the line where it had flooded a month or two before.

“That shows you how, really, people don’t have a clue what’s happening in their IT systems sometimes.”

He puts this under-preparedness down to a lack of knowledge and accountability for colleges’ computer systems.

For instance, there is a “naivety” among colleges that think they would be better off designing a website in-house, rather than commissioning a dedicated company.

So, “when somebody in the college designs this bit of software, with no experience whatsoever, it’s designed with all the individual’s idiosyncrasies. If they leave, someone looks at it and says: “I haven’t got a clue what they did with this, let’s start again”.’

Meanwhile, a website designed by professional developers will be regularly tested, including by so-called ethnical hackers – who attempt to break into cyber systems to help inform the owner and others.

The plug-ins on a website, of which enquiry forms are examples, are also tested; but Drew warns that if these are not regularly updated after being installed, they can be used as a backdoor into a website.

“If you’ve got a backdoor into the website, the next question I ask is, what does that website connect to, and can that be a backdoor into other systems?”

Gathering data from the management information systems (MIS) is one risk he poses.

A good example he found was where a college’s website could read the MIS system, but as “read-only”, so information cannot be sent out of the system.

Outdated software can also be a problem once a system has been hacked: another college Drew worked with was using a little-used content management system for its website, for which he could only find seven developers that could help if things went wrong. This means that the college “is over a barrel” paying for help if the website breaks.

Plus, the system could be easier to hack into as it would be tested less frequently. Furthermore, if servers are not backed up “regularly”, he says, the data could become corrupted, or recent data could be lost if a back-up from before it was inputted needs to be used.

Drew recommends colleges have a process for checking their IT systems and for ensuring that process works as well.

Penetration testing, where companies are hired to try and hack into systems on a regular basis, is also recommended as although it is “not that cheap, it’s cheaper than having some hacker get in and hold the college to ransom”.

Ten tips to avoid cyber attacks

To help colleges avoid falling victim to hackers, FE Week asked Midlands-based IT experts Infuse Technology for their top tips on preventing cyber attacks…

1. Define a starter process

Ensure that the appropriate and necessary permissions are granted for new employees and foster a culture of information security awareness.

2. Define a leaver process

This should include removal of all access rights in a timely manner for departing employees, including cloud access.

3. Patch your servers and PCs

‘Patching’ repairs a vulnerability or a flaw that is identified after the release of an application or software – they are intended to fix bugs or flaws that create security vulnerabilities.

4. Two-factor authorisation (2FA)

Two-factor or multi-factor authentication requires users to provide a secondary form of verification in addition to a primary form, such as a fingerprint or one-time passcode, before accessing accounts.

5. Implement an effective disaster recovery strategy

Failure to prepare for the worst can lead to irreversible damage.

6. Utilise device management to safeguard sensitive data

Limiting access to devices that hold sensitive data can reduce the risk of a cyber attack. As part of this, appropriate staff training and preventative measures should be put in place.

7. Review data storage

Whether your data is stored manually on premises, or stored digitally in the cloud, ensure employees are storing and sharing data in a secure, confidential way.

8. Remove generic accounts

Eradicate generic accounts whereby the password does not change, or multiple users have access.

9. Minimise access privileges to data

Review who holds login privileges, ensuring access is only granted to those who require it as a necessity.

10. Defend your email

Ninety-five per cent of threats infiltrate systems via email – one of the best defences in minimising such threats is by educating staff, ensuring they select strong passwords and know how to spot the signs of a phishing attack

The skills minister stands accused of issuing misleading information about the new level 3 adult offer after FE Week analysis found the majority are too small to be classed as full level 3 qualifications.

Of the 387 courses included in the scheme for 24-year-old learners and above, 207 (53 per cent) are not in the existing 19-to-23 adult entitlement and are therefore not defined by the Department for Education as “full”.

And of all the courses, 136 (35 per cent) are below an indicative 360 guided learning hours, according to the government’s database of qualifications.

The “diploma in probation practice” from SFJ Awards for the public services sector is the smallest qualification, with just 60 guided learning hours, followed by the “certificate in understanding substance misuse” course offered by TQUK for the health and social care sector, which has 65 hours.

Another qualification for health and social care, the “certificate in peer support worker – theory and practice”, offered by OCN NI, is the third smallest, with 85 guided learning hours.

Despite this, the DfE has repeatedly said the policy will enable eligible adults to achieve “their first full level 3 qualification” since prime minister Boris Johnson announced it last September.

In answer to multiple parliamentary questions, skills minister Gillian Keegan says the offer involves “fully funding adults’ first full level 3 qualification”.

And the DfE’s webpage for the National Skills Fund, which will fund the new offer, says it will allow adults to “achieve their first full level 3 qualification”.

Tom Bewick, chief executive of the Federation of Awarding Bodies, described this as “manifestly misleading”, considering more than half of the qualifications are not full level 3s.

He said ministers “should know better” and added that if his members were communicating in this way they would “have the chief regulators’ across the UK come down on them like a ton of bricks”.

The DfE refused to comment on the claim that Keegan’s and their own communication about this offer is misleading but did defend the inclusion of the 180 short courses that do not meet their “full” test.

“What matters the most is how this offer will help more adults to get ahead in the workplace or get a new job,” a spokesperson said.

“All of the vocational and technical courses on offer have been identified as ones that can help adults progress in the labour market, regardless of whether they are included in the 19-to-23 legal entitlement and technically labelled a full level 3 or not.”

They added that further information for providers will be set out in “due course”, including details about how learners might be able to access a number of the shorter qualifications “without exhausting their eligibility”.

The new level 3 adult offer is set to roll out in just two weeks’ time. This is the first draft of the list, which is expected to expand over time as the government allows mayoral combined authorities and awarding bodies to make requests for other qualifications to be added.

It builds on a similar policy that has been in place since 2013 which allows adults up to the age of 23 to be fully funded for their first full-level 3 qualification from the adult education budget. Those aged 24 and over have since had to take out an advanced learner loan to pay for the course.

The current entitlement for those aged 23 and below spans 1,178 qualifications which are all classed as “full” level 3 courses.

FE Week’s analysis shows that 180 (15 per cent) of them are being used in the new level 3 adult offer. The DfE has said the 207 shorter qualifications included in the new level 3 adult offer but which are not in the existing entitlement will be made available for 19-to-23 learners.

 

‘Too much’ about the level 3 adult offer has ‘been about spin than substance’

The new policy has been controversial since its announcement. FE Week was first to reveal that key economic sectors such as hospitality, tourism and media have been excluded as they were deemed a low priority with low wages.

Employers have since branded the process for adding qualifications to the list “bureaucratic” and “frustrating”.

Independent training providers have meanwhile been given just a four-month window to start and complete the courses through the offer, while colleges have warned of a slow start owing to a lack of detail from the DfE and strict eligibility rules.

Bewick said that from the very start, “too much about the lifetime skills guarantee has been more about spin than substance”.

“It’s time to drop the propaganda slogans and adopt a more realistic approach about who and what this offer is for,” he told FE Week.

“If they [the DfE] trusted learners and the sector more, we wouldn’t need such a restrictive and nonsensical list. We’d give adults real entitlements to learning and let them decide. Instead, we have this bizarre situation where Whitehall is trying to second guess what the post-Covid labour market will do.”

College leaders have endorsed a move by the Education and Skills Funding Agency to rebuild relationships with annual “strategic conversations”.

The new meetings, which will get under way next month, have been described by principals as “helpful” and “much better than the current poor, reactive approach” taken by the ESFA.

David Hughes, chief executive of the Association of Colleges, said the conversations will “help shift the focus in the agency away from the colleges they believe are in trouble to a more open discussion with all colleges”.

Announcing the meetings on Wednesday, the ESFA said the idea followed Dame Mary Ney’s review of financial oversight in colleges which recommended the agency builds a more “nurturing” relationship with the sector.

Ney’s report, published in July 2020, warned that dealings with colleges had become “largely focused on financial failure, which inhibits colleges being transparent with government”.

The ESFA said it will lead these new conversations, which must be attended by each college’s leaders including the principal and chair as well as an FE Commissioner official. They will begin as the current FE Commissioner Richard Atkins leaves his post at the end of March.

The meetings will “look holistically at the college’s strategy”, according to the agency, and will focus on “current and future plans that the college has and provide us with an opportunity to hear directly from colleges about their successful initiatives, as well as discussing risks and challenges, and possible solutions”.

The ESFA has insisted this is not another form of intervention. A spokesperson said they will not be a funding requirement and they “do not expect” to publish the outcomes of individual conversations.

The first of these voluntary conversations will start in the summer term, from late April 2021, the ESFA said, with the first full cycle completed by May 2022.

Meetings will be held either at colleges or virtually, depending upon Covid-19 restrictions.

The ESFA said the content of the agenda will be “jointly shaped with each college, and as the programme rolls out, we will be in touch to agree a meeting date with each college and to agree the agenda”.

Ian Pryce, chief executive of the Bedford College Group, said the meetings are “long overdue”.

“Proper meetings, preferably visits in future, are much better than the current poor, reactive approach to monitoring,” he added. “Relationships will improve, problems will be picked up earlier.”

Luke Rake, principal of Kingston Maurward College in Dorset, said the move seems “entirely sensible to me and fully endorse this. Proactive and forward-thinking meetings to ensure good solutions for students is helpful.”

Hughes said the meetings were a “good idea” as “we are keen to see more strategic engagement between ESFA and colleges, which ensures Dame Mary Ney’s ambition of a nurturing relationship as well as a vehicle for colleges to highlight barriers they face due to policy or funding rules”.

He added that including the chair in the meetings “makes sense, particularly as ESFA promises to make these meetings a two-way sharing of information and to distil key messages so that they can improve policy making, rules and regulations”.

John Laramy, principal at Exeter College, said: “I welcome the idea of a yearly ‘strategic’ conversation and hope this is the first step in forming a new partnership between colleges and the ESFA, as ultimately we all want the same thing ̶ brilliant colleges making a difference to individuals, businesses, our communities and ultimately UK plc.”

And Sam Parrett, chief executive of London South East Education Group, added: “It can only help improve the sector if the key organisations involved in the oversight, regulation and operational leadership of colleges meet regularly to discuss the complexities and challenges involved in running colleges in these challenging times.

“Transparency is key to ensuring that there is a line of sight from the data that is submitted in a transactional and contractual relationship to the discussion that builds trust and confidence in the system leaders and ensures there is a supportive relationship between the ESFA and colleges.”

The new conversations will involve all further education colleges, including specialist designated institutions, land-based colleges and sixth-form colleges.

Independent training providers are not included.

When asked why ITPs have been excluded, an ESFA spokesperson said: “ITPs by their nature are different from colleges, both in terms of their funding relationship with government and their business models.

“We are developing further our approach to working with ITPs and they continue to be a key part of the post-16 skills landscape.”

The cap on apprenticeship starts for small employers will be reset to zero next month, the Education and Skills Funding Agency has announced.

It means that any non-levy paying business can start up to 10 new apprentices from 1 April 2021 regardless of the number they currently employ. The cap will be kept under review during the next financial year.

The move, revealed during today’s Association of Employment and Learning Providers spring conference, comes a week after an FE Week investigation found small employers were being blocked from new cash incentives for hiring apprentices after reaching the current limit.

AELP managing director Jane Hickie said the reset should be a “significant improvement” on the current situation but warned that without “transparency around levy funding, it’s difficult for us to judge whether the ESFA has been unduly cautious on changing the cap arrangements”.

Non-levy-paying businesses have been capped on the number of apprentices they can put through the digital apprenticeship service since January 2020 – starting with a limit of three before increasing to 10 in July – to ensure the overall apprenticeships budget is not overspent.

The digital service was launched in April 2017 but was only for levy-paying employers to manage and spend their apprenticeship funding.

Small employers will fully transition onto the service next month, meaning that all apprenticeship starts must now go through the system rather than procured non-levy contracts held by training providers.

Announcing the cap reset, the ESFA’s head of apprenticeship operations Jason Poole said: “The cap is there to help with the overall spend controls that we need to have in place for the whole apprenticeship programme.

“As we’ve moved away from individual provider contracts, we still need a way to be able to monitor and manage the flow of funding.

“As we are now moving from the beginning of next month to have all new starts on the service, I am really pleased to confirm that from April 1, we will be resetting that total.

“There are quite a lot of employers now who have started to use those reservations and an increasing number that have got up to their limit of 10.”

Apprentice “reservations” made by small employers before April which convert to starts beyond next month will not count in the new 10 pot. 

As Poole pointed out, the cap was first imposed owing to concern that the amount of money not being spent by levy payers wouldn’t be enough if the government allowed small employers to have as many starts as they wanted.

But, as providers and employers told FE Week last week, in the past year starts have dropped dramatically across England because of the pandemic and the overall apprenticeships budget is expected to be underspent this year.

Commenting on the cap reset, Hickie said: “This should be a significant improvement on the current situation.  For some months, AELP has been pressing the government to act on the employer frustrations being relayed to us by apprenticeship providers and today’s announcement should relieve the pressure. 

“Without transparency around levy funding, it’s difficult for us to judge whether the ESFA has been unduly cautious on changing the cap arrangements but there is no doubt that previous limits looked strange against Rishi Sunak’s measures to try and incentivise employers to offer more apprenticeship opportunities to young people.

“All the feedback suggests that the Plan for Jobs incentives will have by far the biggest impact among non-levy employers and so today’s changes make obvious sense.”

Poole also announced that the reservation period for employers who do not pay the apprenticeship levy is being extended from three to six months from 1 April 2021.

This means that these employers will be able to reserve funds up to six months before an apprenticeship is planned to start.

 

New “strategic conversations” that require all college leaders to meet with Education and Skills Funding Agency and FE Commissioner officials once a year will begin from next month.

The meetings, which must be attended by the principal and chair, will be held with individual colleges annually to “look holistically at the college’s strategy”.

The ESFA has insisted this is not another form of intervention. It is not clear at this stage if a record of the meeting will be kept and published by the agency.

Announcing plans for the meetings in its weekly update today, the ESFA said they will be a “strategic conversation that rises above the normal day to day dialogue”.

“It will focus on current and future plans that the college has, and provide us with an opportunity to hear directly from colleges about their successful initiatives, as well as discussing risks and challenges, and possible solutions.”

The new conversations follow Dame Mary Ney’s review of the financial oversight of colleges, which recommended a more nurturing and pro-active relationship between government and colleges.

In its response to the Ney review, the ESFA did promise an action to introduce annual “strategic conversations”. This pledge was then reaffirmed in the recent FE white paper.

The meeting will be led by the ESFA, with an FE Commissioner representative, and include the “principal, the college chair, other governors and other college senior leaders as appropriate”.

The first of these conversations will start in the summer term, from late April 2021, the ESFA said, with the first full cycle completed by May 2022.

Meetings will be held either at colleges or virtually, depending upon Covid-19 restrictions.

The ESFA said the content of the agenda will be “jointly shaped with each college, and as the programme rolls out we will be in touch to agree a meeting date with each college and to agree the agenda”.

FE Week has asked the ESFA if the meetings are a funding requirement and what happens if a college refuses to take part.

The new conversations will involve all further education colleges, including specialist designated institutions, land based colleges and sixth form colleges.

Full graded Ofsted inspections will not return until the new academic year, with the watchdog instead looking at bringing in a “sensible and proportionate next step” as part of its phased return in the summer term.

Department for Education guidance states routine, graded Ofsted inspections “will resume in the summer term”, with the inspectorate “discussing the form and timing of inspections in the summer term”.

However chief inspector Amanda Spielman today confirmed that full inspections will not be returning this academic year.

Addressing the Association of School and College Leaders virtual conference, she added: “But I can tell you that what we’re discussing is a sensible and proportionate next step before returning to our normal inspection programme in the autumn.”

Ofsted has been conducting a new form of remote monitoring inspections of schools and colleges graded “inadequate” or “requires improvement” since January 25, after U-turning on plans to conduct inspections in-person.

But these visits for FE providers have now stopped so that the watchdog can focus on face-to-face new provider monitoring inspections, which recommenced on Monday.

As more normal service resumes within education, Spielman said she wants Ofsted to “play its part in helping schools and colleges get back on track through inspections”.

But she warned them against conducting ‘mocksteds’ or using inspection consultants in a bid to prepare.

“I want us to help not hinder and I certainly don’t want hard-pressed teachers spending time on fruitless exercises to prepare for Ofsted… just do the best for your pupils and students, in other words what you always do”, she added.