Talk to an expert

Industry

Technology and security for education and research

Education networks are open by design, serve populations that change every year and are run by small teams. Onion Infosec provides the engineering, operations and security capacity those teams lack.

Talk to an expert
Sector
Education
Segments
Universities and research institutions, Schools and school groups, Education technology, Online learning providers

01Context

Educational institutions run open networks for populations that change every year.

They hold research worth stealing and personal data worth protecting, often including data about minors.

Security and IT teams are small relative to the number of users and devices. Students bring their own equipment, departments run their own systems, and academic culture values openness over control. Security measures have to work within those conditions to be adopted at all.

02Technology

What the sector builds and runs.

Learning and student systems
Learning management, student information, admissions and examination platforms, with integrations and single sign-on between them.
Campus IT and networks
Wireless and wired networks for personal devices, lab and classroom endpoints, and identity lifecycle for the joiners and leavers of every term.
Research computing and cloud
Cloud and high-performance environments for research, including controlled enclaves for sensitive data sets and grant-mandated controls.
AI in teaching and administration
Tutoring and support assistants and administrative automation, with clear rules on student data, age-appropriate use and academic integrity.

03Risk

The risks that matter most.

Ransomware against administrative systems
Student information, admissions and examination systems are time-critical, which makes them targets for extortion.
Research data theft
State-aligned actors targeting research output, collaboration platforms and the accounts of individual researchers.
Account compromise at scale
Large, transient user populations with reused credentials, shared devices and accounts that outlive enrollment.
Third-party learning tools
Classroom and learning applications adopted by individual departments, handling student data without central review.

04Regulation and assurance

What you may need to demonstrate.

FERPA governs student records in the United States and COPPA covers online services for children. GDPR applies in Europe, with added protection for children’s data. Federally funded US research often requires NIST SP 800-171, fee payments bring PCI DSS into scope, and ISO 27001 or the CIS Controls serve as general baselines. Regional examples include the DPDP Act in India, which sets conditions for processing children’s data.

  • FERPA
  • COPPA
  • GDPR
  • ISO 27001
  • NIST SP 800-171
  • PCI DSS
  • CIS Controls
  • DPDP Act

Which of these apply depends on where you operate and what you do. We scope against your actual obligations.

Framework library

05Where we usually start

Services that matter most here.