Bibb County School District operates the public schools of the city of Macon in central Georgia. The district IT team serves the technical needs of about 22,000 students and 4000 employees.
Like many schools across the nation, Bibb County transitioned to primarily running classroom and administrative operations in the cloud, mainly to take advantage of the significant cost savings. While most district operations and communications are through Microsoft 365, the district has also implemented several other cloud applications for administrative and classroom functions.
Before Greg Hogan came on board, there was little focus on securing these cloud applications in the district’s IT infrastructure. As the Network Data and Security Coordinator, Hogan is directly responsible for changing that. “The focus was on transitioning to Microsoft 365 and getting everything functionally up and running,” explains Hogan. “Security was more of an afterthought, and that resulted in a lot of vulnerabilities.”
Hogan oversees all aspects of data flowing in and out of the network, and ensures the security of that data. He also handles the district’s content filters to make sure the content students access, online and in the cloud, is appropriate and safe.
Bibb’s cybersecurity tech stack includes iBoss as their content filter and ClassLink for Single SignOn. They also use Microsoft native security tools like Advanced Threat Protection, available as an add-on at the A3 level, to secure the information stored and shared in Microsoft 365. Hogan and a few IT administrators have A5 licenses for advanced data loss prevention and compliance controls. With these tools and best practices in place, he thought he had everything he needed.
THE CHALLENGE
Within a few months of Hogan taking on IT security at Bibb County, it was back to school time. On top of the daily technology needs and fires of operating a school district, Bibb County started getting hit hard with phishing emails.
45 user accounts were hijacked in just one day. Then, those 45 accounts started sending emails containing phishing links to others in the district. Because the emails were coming from legitimate employee emails, users were clicking on the links within them. Hogan recollects, “That was a big eye-opener for us. We didn’t have the visibility or the tools to quickly tackle the issue.”
“We didn’t have any insight into communications happening in the human resources department, such as if they were sending social security numbers via email and to who. We also didn’t have any insight into different departments paying for services through email with credit cards…Those were pain points that we honestly didn’t even know were there.” — Greg Hogan, Network Data and Security Coordinator
Hogan did his best with the controls available with Microsoft, but found that they were cumbersome and time-consuming to use. And some of the information and controls he needed simply were not available without a pricey add-on or upgrade.
Beyond thwarting malicious attacks, Hogan also needed to reign in compliance issues. One of the biggest causes of data loss is not malicious but comes from well-meaning users inside the organization sending sensitive information in unsafe ways.
“We didn’t have any insight into communications happening in the human resources department, for example, such as if they were sending social security numbers via email and to who,” explains Hogan. “Another example is that we didn’t have any insight into different departments paying for services through email with credit cards. We didn’t see or know any of that. Those were pain points that we honestly didn’t even know were there.”
THE SOLUTION
Greg Hogan discovered ManagedMethods while attending GAMEIS in 2018. “I was blown away when I saw the demo version at the booth,” recalls Hogan. “I was really impressed that that much data could be presented in such a way. And ManagedMethods is so awesome to offer the 30-day trial so I could really get a feel for how it works with our data and what our infrastructure looked like.”
Bibb County School District chose ManagedMethods because it is effective, deploys in minutes, requires no special training, is easy to use, and has no impact on network speed or end-users. Best of all, it is the most affordable cloud security solution on the market.
Hogan and his team are now able to detect, address, and prevent these types of threats using ManagedMethods. The platform provides Bibb School District with API-based cloud application security and enables the IT teams to gain visibility and control over the data that is stored and shared in Microsoft 365. ManagedMethods offers out-of-the-box and customizable account monitoring, and data loss prevention policies to cover security and compliance requirements.
ManagedMethods also provides school districts with an additional monitoring layer for student safety issues like cyberbullying and inappropriate content. Using ManagedMethods, district IT teams can quickly delete or quarantine content that violates student safety and appropriate conduct policies.
“Honestly, ManagedMethods is a solution that we didn’t realize we needed until we saw it in action,” says Hogan. “We assumed that the tools in Microsoft were all we had—and all we needed. It was wonderful to see a solution that could come in, take that same data, and make it better and easier to work with.”
You can’t put a price on the safety of your data and you can’t put a price on the safety of your students. We are responsible for the tools that students have. We give them laptops, internet, email, and cloud storage—and if we don’t do that responsibly we are not doing our jobs well.” — Greg Hogan, Network Data and Security Coordinator
THE RESULTS
ManagedMethods gives Hogan and the IT team insight into their information infrastructure and data in a way that is easy to understand, visualize, configure, and present. It helps him do his job better and keeps everyone safe.
The platform secures student and employee information from data loss, while also providing the team with deep insight into the behavior occurring in Microsoft 365 applications. Hogan explains, “ManagedMethods has freed up a lot of time because most of the reporting is done for you. ManagedMethods does all the heavy lifting to make my job easier, which is great.”
Bibb County’s superintendent was awarded National Superintendent of the Year in 2019. Less than four days later, the superintendent’s login activity spiked with 400 failed attempts in just a few hours, and over a few days it was astronomical.
“After the announcement, his account was a high target for hackers,” explains Hogan. “Using ManagedMethods, we were able to identify that, pull the data from the dashboard, and present the issue to him. The clear, visual representation of the data helped me better explain the issue and educate him and others on how to exercise caution.”
Hogan was also able to put student safety controls in place, such as a self-harm policy to alert the team if there are keywords in emails or documents that might indicate danger to a student. ManagedMethods also helped Hogan clean up content that presented possible copyright issues from the district’s OneDrive account and put compliance policies in place to keep it clean going forward. “ManagedMethods introduced the idea to check for those kinds of files and, in doing that, we were able to clean up a lot of material that shouldn’t have been saved in our OneDrive accounts. That was huge.”
“ManagedMethods makes my job easier in the sense that it gives me data I can present to someone else who may not have the technical expertise I have,” says Hogan. “It bridges that gap by giving us the data we need and presenting the data in a way that is easy for non-technical colleagues to understand.”
Greg Hogan’s advice to other school districts IT teams is to start by putting the best practices for the solution you already have in place. Use the tools you have to their fullest extent, and then bring in a product like ManagedMethods to show where you have security and compliance gaps. Having that extra layer of security on top of those best practices is important to avoid incidents.
Using ManagedMethods, Hogan can now rest easy knowing his data, users, and infrastructure are safe and secure, “You can’t put a price on the safety of your data and you can’t put a price on the safety of your students. We are responsible for the tools that students have. We give them laptops, internet, email, and cloud storage—and if we don’t do that responsibly we are not doing our jobs well.”
