Avoid incidents using these 4 cybersecurity for K12 essentials
If you are a leader or member of a K-12 cybersecurity IT team, you’re seeing that cybersecurity is a critical issue for your district. Your systems are collecting and storing more student information, and your district is using more technology.
What you may not know is that, according to The K-12 Cybersecurity Resource Center, there were 712 cybersecurity incidents in the public school system since 2016. In 2018, hackers mounted 122 attacks on 119 K-12 school districts…that we know of.
Cybercriminals are targeting K12 district systems in part because the education sector ranks last in cybersecurity preparedness out of all major industries. The lack of preparedness makes it easier for hackers to succeed in their attacks. Fortunately, you can use these four cybersecurity for K12 essentials to help upgrade that ranking and foil attacks.
1. Raise Awareness
Raising awareness is half the battle in K-12 cybersecurity. K-12 district IT teams aren’t incapable of protecting their systems. The problem is often that there isn’t enough focus on the issue of cybersecurity. Many teams don’t seem to be aware of the issue—or are simply trying to ignore it because it seems like an insurmountable challenge.
They know that they’re storing more sensitive data than ever before, but they may be caught in the “it won’t happen to us” mindset. A look at the statistics shows that cyberattacks can happen anywhere, and are extremely widespread. Attacks have happened to districts in the middle of Kansas, and to schools in the upscale community of Greenwich, Connecticut.
Other IT teams think that their next-gen firewall and/or content filter is sufficient to protect their data. Unfortunately, those two systems can’t provide cloud security in the modern K-12 environment.
Many districts use G Suite and Office 365. These cloud apps provide the benefits of accessibility and collaboration, but they also present unique K-12 cloud risks. When cybercriminals find ways past your perimeter security (i.e. firewall), their activities look like authorized access. This leaves your district’s data stored in cloud systems with no protection.
[FREE WEBINAR] JOIN US FOR BEYOND THE CONTENT FILTER: CYBER SAFETY & SECURITY FOR K-12. REGISTER HERE >>
For example, a hacker can send phishing and malware links in a shared document. They get past phishing filters because the body of the email looks innocent. But, the links in a document can cause the same devastation as those in the email itself.
Probably the most disturbing awareness issue is the idea in some districts that cyber insurance can replace efforts to increase a district’s cybersecurity preparedness. The truth is that, like any type of insurance, you should use cyber insurance to offset losses that you’ve already worked hard to prevent.
Raising awareness among K-12 District IT Teams, staff, teachers, parents, and students can get your entire community working together to prevent cyber incidents.
2. Use a Cybersecurity for K12 Framework
K-12 districts will get many benefits from using a well-designed cybersecurity framework. It provides an organized approach to cybersecurity that districts can incorporate into their existing programs. You can tailor the framework to meet your needs and it will help you to find areas where you should increase your defenses. Luckily, it’s not necessary for each district to develop its own cybersecurity for K12 framework.
In 2013, Executive Order 13636 established a call for an effort to share cybersecurity threat knowledge, and to create a framework for reducing risk. The National Institute of Standards and Technology (NIST) accepted the challenge. NIST published Version 1.0 of the NIST Cybersecurity Framework in early 2014. The agency continues to work with the private sector, educational institutions, and other government agencies to refine the framework.
Version 1.1 of the NIST Cybersecurity Framework was published in April 2018. The framework defines five steps an organization can take to avoid cyberattacks. Several states are currently working to incorporate the NIST cybersecurity framework into student data privacy and cybersecurity for K12 regulations. You can incorporate the cloud security you need into the framework to protect your district’s G Suite and Office 365 systems.
3. Upgrade Your Cybersecurity Infrastructure
Your cybersecurity infrastructure refers to the set of tools you use to protect your data. No single tool can achieve the complete cybersecurity for K12 coverage your district needs on its own. Therefore, using a multi-layered set of tools is the best practice for your district. You need to cover the following:
- Infrastructure Security: Traditionally, infrastructure security meant making sure your on-premise servers were secured from attack. If your district has fully migrated to using G Suite and/or Office 365, you’re able to outsource most of this. Or, like many districts, you have a bit of a combination of the two.
- Access Authentication: Access management is like putting a lock on your front door and giving a key just to the people who should have access to your house. This layer includes requiring strong passwords, enabling multi-factor authentication, and putting policies around login locations.
- Endpoint Security: Endpoints include laptops, computers, mobile devices, and servers. Today’s K12 IT teams are managing exponentially more endpoints than ever before mainly due to 1:1 and BYOD programs.
- Network Security: Securing your network with firewalls and gateways is still an extremely important layer in your cybersecurity infrastructure. Network security is often also referred to as perimeter security, which is focused on securing access past the perimeter of your information systems.
- Cloud Security: If your district is using Google G Suite, Microsoft Office 365, and/or other cloud-based EdTech apps, you need a cloud security layer. This is because cloud data storage and access happen outside of your perimeter, rendering network/perimeter security mostly useless.
- Incident Management & Response: Incidents happen even in organizations with tons of funding and cybersecurity management. Have a plan in place for when an incident does occur to detect and remediate, communicate to stakeholders, and improve your systems going forward.
When you have the right tools in place to address these six critical areas, you’ve established an infrastructure that will help to avoid cyberattacks.
[FREE WEBINAR] JOIN US FOR BEYOND THE CONTENT FILTER: CYBER SAFETY & SECURITY FOR K-12. REGISTER HERE >>
4. Provide Effective Training
90% of data breaches start with human error. This is easy to understand in a K-12 district. Your community doesn’t consist of IT wizards, and you’re working with a wide variety of stakeholders. The people using your systems likely include staff, teachers, students, parents, and contractors. Your users don’t study the latest cybersecurity research, which makes them vulnerable to initiating a cyber incident without knowing it.
For example, users in your community are more likely to click on a phishing link in an email or a shared document if they aren’t properly trained. Your users may use passwords like “123456” or fail to change their passwords on a regular basis.
Ongoing training and education on strong cybersecurity policies is the key to keeping security top of mind with your staff, faculty, students, and parents.
No one wants to leave their district and student data open to cyber incidents. Luckily, there are tools at your disposal to avoid becoming a statistic. Protecting your district data isn’t complicated; if you use these four essentials as a guide, you can establish the protections you need to foil many of the types of cyberattacks plaguing school districts. Or at least send the hackers off to look for an easier mark.
Learn more about cybersecurity for K12 essentials during our free, live webinar with Tim Miles, Director of Technology at Steamboat Springs School District. Together, we’re demystifying cybersecurity for K12 IT teams. Learn more and register today!
