This article is based on a presentation delivered by Netelligent to the South African School Principals’ Association (SAPA) in KwaZulu-Natal, aimed at helping principals understand the risks and – more importantly – ask the right questions.
Technology has become deeply embedded in the day-to-day running of modern schools. From student records and staff information to financial systems, communication platforms, and even classroom tools, schools today rely on technology more than ever before. With this increased reliance comes a growing responsibility and a very real risk. Cybersecurity is no longer just an IT concern. It is a leadership issue, and one that every school principal needs to understand.
Cybercrime – how big is the problem?
Did you know – if cybercrime were a country, it would be the third-largest economy in the world, with global damages estimated at over $10.5 trillion in 2025/20026 and expected to exceed $12 trillion by 2031. While these numbers may seem distant, the reality is that schools in South Africa are increasingly becoming targets. The reason is simple. Schools hold valuable information, often operate with limited security resources, and are perceived as easier targets than large corporations.
Are schools really a target?
A typical school manages a wide range of sensitive data, including student personal information, staff records, financial data, academic results, and communication systems. If compromised, this information can be used for fraud, identity theft, or extortion. At the same time, schools are constantly processing payments, paying suppliers, and managing salaries, making them attractive targets for financial cybercrime. Add to this the possibility of internal risks, such as students experimenting with systems or staff unknowingly exposing vulnerabilities, and it becomes clear that the threat landscape is broader than many realise.
In South Africa, schools also have a legal responsibility to protect personal information under POPIA, the Protection of Personal Information Act. This means schools must know what data they hold, understand how sensitive it is, and ensure that only the right people have access to it. It is no longer acceptable to simply rely on IT teams to handle security without clear policies and governance in place. Schools need structured data classification, clear access controls, and regular oversight to ensure compliance and reduce risk.
Understanding cybersecurity does not mean becoming a technical expert. Instead, it means understanding enough to ask the right questions and ensure your school is protected.
One useful way to think about cybersecurity is through the CIA principle:
Confidentiality, Integrity, and Availability
- Confidentiality ensures that sensitive information is only accessible to authorised individuals.
- Integrity ensures that data remains accurate and cannot be altered without permission.
- Availability ensures that systems and information are accessible when needed.
These three principles form the foundation of any effective cybersecurity strategy and help guide decision-making around how systems and data should be managed. All data sources within a school environment should be viewed through this lense – as a school principal, it’s important to determine if your data is confidential, has integrity and remains available when needed.
Make sure your staff and students are aware of cybersecurity threats:
Cybercriminals rarely attack systems directly at first – they target people. Why go to all the trouble of “hacking” when you can just ask nicely?
Within a school environment, individuals with financial authority or access to sensitive information are particularly vulnerable. Bursars, admissions staff, administrators, and principals themselves are often prime targets.
If an attacker gains access to one of these accounts, they can impersonate staff, redirect payments, or access confidential data. Phishing emails and spoofed communications are among the most common methods used, and they are becoming increasingly sophisticated.
It’s important to review your processes to ensure verification checks and balances are in place whenever dealing with sensitive information or financial transactions. Administators in a school environment who work with sensitive information or finance need to be sensitized to the risks and should always operate with extra caution.
The importance of MFA:
Basic controls such as multi-factor authentication, or MFA, are critically important to improve the security of user accounts. If a password is compromised, MFA adds an additional layer of protection that can help prevent unauthorised access.
Schools should ensure that every user has their own account, rather than shared logins, and that permissions are carefully managed and reviewed regularly. Password practices also matter more than most people realise.
Weak or reused passwords are one of the easiest ways for attackers to gain access, and simple measures such as password managers and regular password updates can significantly reduce risk.
Important considerations to improve email security in your school:
Email remains one of the biggest entry points for cyberattacks, particularly in schools. It is essential that proper email security measures are in place, including authentication protocols such as DKIM and DMARC, as well as staff training to recognise phishing attempts. Equally important is having clear processes for sensitive actions, such as changes to banking details, which should always be verified through an independent method rather than relying solely on email communication.
Ensure your backups will work when you need them:
Despite all preventative measures, no system is completely immune to attack. This is why backup and disaster recovery planning is critical. A widely recommended approach is the 3-2-1 rule, keeping three copies of your data, on two different types of media, with one copy stored offsite. This ensures that even if your primary systems are compromised, you have a reliable way to recover. However, having backups is not enough. Schools must also understand how quickly they can recover, known as the Recovery Time Objective (RTO), and how much data they can afford to lose, known as the Recovery Point Objective (RPO). These plans should be tested regularly. Immutable backup technology is a relatively new approach to protecting data from ransomware – ensuing that backup data cannot be overwritten or modified.
Choose firewalls, networking and endpoint technology that keep up with modern threats:
Modern cybersecurity also requires modern tools and a proactive approach:
Firewalls are no longer just about blocking access – they must be able to inspect encrypted traffic, monitor activity, and provide resilience in the event of connectivity issues. A basic Internet router is not enough to protect your environment from the multitude of threats that hit school environments daily.
Advanced firewalls have rulesets which specify the types of traffic, source and destinations that are allowed to traverse your Internet connection. They also scan all traffic with advanced security technologies to actively hunt for and weed out inappropriate content and cyber threats. It’s important ensure your IT team regularly review your firewall rules for relevance – firewall configurations must adapt as your school environment changes.
Endpoint protection (antivirus software installed on desktops and servers) has also evolved significantly. Traditional antivirus solutions are no longer sufficient on their own, as modern threats are designed to adapt and evade detection. Behavior-based security solutions are now essential to identify and respond to threats in real time. If devices are taken offsite, do they continue to update and provide protection for your school assets, do they continue to enforce your security policies offsite?
With BYOD (Bring your own device) being a common approach for many schools, it’s important to ensure that unprotected / unmanaged devices brought from home do not pose a threat to your environment. BYOD devices should ideally be separated from the main network by the firewall, wireless and network switching layer – to ensure additional security measures for the environment.
Have you heard of “Have I been Pwned”? – a great early warning detection system:
There are also simple steps schools can take immediately to assess their exposure. Services such as “Have I Been Pwned” allow you to check whether email addresses have been involved in known data breaches. This is a useful exercise for principals, bursars, and administrative staff, and can provide an early warning of potential risks.
Your role as a leader in your school:
Ultimately, cybersecurity is not just about technology. It is about leadership. As a principal, your role is not to configure systems or implement solutions, but to ensure that the right structures, policies, and accountability are in place. You set the tone for how seriously cybersecurity is taken within your school.
This starts with asking the right questions. We suggest you book time with your IT team and ask the following questions:
- Do we have a cybersecurity policy – and are we following it? Is it relevant?
- How are we protecting staff and learner data from breaches?
- What happens if we’re hit by ransomware or an outage? Do we have a plan?
- Can we detect if someone is trying to breach our systems right now?
- Have our staff and learners been trained to spot threats like phishing?
- Who is responsible for cybersecurity at our school?
- Do we have regular security audits or reports I can review?
- Do our backups work properly – are we confident of this? What is our RPO/RTO?
These are not technical questions. They are leadership questions, and they are critical to reducing risk.
Technology will continue to play an increasingly central role in education, and with that comes an ongoing responsibility to protect the systems and people that rely on it. Cybersecurity is not about eliminating risk entirely, that is impossible, but about understanding it, managing it, and ensuring your school is prepared.
At Netelligent, we have worked with many schools across South Africa for over two decades, helping them build secure, resilient, and future-ready IT environments.
If you are unsure about your school’s current cybersecurity posture, or would like some help improving your systems, feel free to connect with our team – we’re ready and able to help.
Protecting your school starts with awareness, and the right questions can make all the difference.