Connected cameras, sensors and other IoT devices can create cybersecurity risks if left unmanaged. For schools, regular updates, ongoing manufacturer support and integrated systems can help protect sensitive data and keep security front of mind.
IoT is often considered a cybersecurity “weak link”. For cyber criminals, they are a tempting route into an organisation’s IT estate in order to create havoc and extract valuable information. Schools, while they may not seem the most obvious target, are far from immune from this threat.
Last year, a survey found that educational establishments are more likely to suffer a cyberattack than private businesses. In Australia in 2025, there have been publicly reported cyberattacks on schools in New South Wales and Victoria. But schools don’t have the deep pockets of businesses – so why attack them at all?
Hackers attack systems for many reasons: to lock down and encrypt systems to extract a ransom, to steal valuable data, or even to hijack systems as a way to gain entry to other systems. Hackers often use inadequately secured IoT systems such as IP devices and sensors as the way in.
IoT comes with inherent risks
While your laptop or mobile device will let you know when a security update is ready to be downloaded and installed, IoT devices such as cameras and sensors often lack this functionality, or produce alerts that are more easily ignored. That’s if they receive security updates at all – they can be as neglected by manufacturers as well as the organisations that install them. Even if they are not, these devices can remain in place for a long time, beyond the manufacturer’s support period. They also often ship with default passwords that remain unchanged, so while a school might have a robust password policy for every laptop, IoT devices might still be using an “admin/password” login.
IT departments can often, quite by accident, deprioritise IoT updates in favour of more urgent tasks. Support requests from staff members will tend to take priority and unless IoT maintenance is scheduled, it can be quietly forgotten – with no consequences until a cyberattack takes place.
IT teams cannot let IoT security slip, and key to this is choosing the right manufacturer. Ongoing support in the form of expert guidance, the right technologies and tools, and products and services that reflect and support best practices, are all vital to good cybersecurity. The right choice of vendor can make as big a difference as a vigilant IT team.
The role of regulation
Schools cannot afford to let IoT security slide, but there are reasons beyond the increased risk of an attack. Regulations demand that schools must have good cybersecurity across their entire IT estate.
In Australia, this means meeting the requirements of the Essential Eight, a set of mitigation strategies designed to protect connected networks. Importantly for IoT, this includes patching, better authentication, and restricting administrative privileges. All of these are vital for IoT networks, to ensure that any security risks are mitigated and only the right people have access.
The Essential Eight provides guidance for different “maturity levels” for each area, and while the guidance is aimed at enterprises, it provides a good structure for any organisation that wants to protect itself against attack. It also provides a good way for IT teams to communicate how well they measure up – explaining every detail of a cybersecurity hardening plan might be tricky, but progress can be reported against Essential Eight requirements.
Schools also have an obligation to meet privacy regulations and protect any data they hold. Good security is a part of this to ensure only authorised people can access information on staff and students. The exact requirements depend on the type of school and state regulations, but the principles are broadly the same.
From connection to integration
One of the most effective strategies for better IoT security is to make IoT devices part of an integrated system. Many legacy systems are discrete and standalone – cameras, sensors, public address and access control systems may be connected to the network, but they do not work together and aren’t controlled through a single platform.
There are many advantages to integrating these systems and making them work together. The data they produce can be analysed for better building use. Threats can be identified more quickly and, if necessary, evacuation or lockdown protocols can be initiated. But one major advantage is cybersecurity.
An integrated system is one where out-of-date software and firmware can be easily flagged, and remotely updated, often automatically if required. Problems can be identified quickly and IT support requested where necessary. Rather than several systems that are easy to forget about, an integrated system is one where the IT team has visibility and control, making it far easier to maintain security.
Security must be top of mind
As schools make increasing use of connected devices, security needs to be a major consideration. Often, the focus will, understandably, be on value for money and longevity to make the most of investments. But cybersecurity must be a part of these considerations, with easy upgrades and better integration key to ensuring that school IoT is not a weak link, but a reliable part of the IT estate.
