How to create a K-12 cybersecurity strategy

Quarterbacks have playbooks, teachers have lesson plans. IT departments? They have a cybersecurity strategy — at least, they really should.

Think about it: Trying to protect your school district without a cybersecurity strategy is like shopping for groceries without a list. Inevitably, you’ll forget something important. And, when that happens, you risk a whole lot more than a return trip to the grocery store.

Having a strategic plan in place is absolutely essential when it comes to mitigating cyber risk and protecting your digital ecosystem. However, getting started can be overwhelming. That’s why we’re here to break down all there is to know about strategizing your cybersecurity posture, navigating your threat landscape, and keeping student data safe in the cloud.

What is a cybersecurity strategy?

According to AT&T, a cybersecurity strategy is a high-level plan for how an organization will secure its assets and minimize cyber risk. Think of it as the blueprint for how your district will prevent sensitive information from falling into the hands of a threat actor, whether it be due to an accidental data leak or malicious cyber attack.

Notably, a cyber strategy isn’t set in stone. It’s meant to be a living, breathing document that adapts to the current threat landscape and your evolving cybersecurity requirements. Otherwise, your cyber defense policy would grow outdated as time rolls on, potentially exposing you to unseen risk.

The point of a cybersecurity strategy is to achieve “cyber resilience.” The National Institute of Standards and Technology (NIST) defines cyber resilience as the ability to anticipate, withstand, recover from, and adapt to a cyber threat. An organization can better protect sensitive information by taking a more proactive approach to data security. This not only puts you ahead of malicious cyber activity but can also help you maintain and even exceed minimum cybersecurity requirements, all while strengthening resilience.

All told, a proactive cyber defense strategy can help you:

• Prepare for a potential threat.
• Prevent accidental cyber incidents.
• Save your school district from reputational damage.
• Recover from a cyber attack.
• Detect malicious cyber activity occurring within your cloud infrastructure.

However, it’s not that simple. According to a recent Ponemon Institute study, which surveyed 577 U.S. IT and IT cybersecurity professionals, many organizations struggle to realize these benefits. The survey’s data indicates the following:

• 69% of respondents admitted their company’s approach to security is reactive and incident driven.
• 56% expressed concern that their IT security infrastructure contained coverage gaps, allowing attackers to get around network defenses.
• 40% do not track or measure the company’s IT cybersecurity posture.

How does this apply to the education sector? Well, many school districts share similar concerns. According to a recent report from the Cybersecurity & Infrastructure Security Agency (CISA), the majority of schools simply lack the resources or expertise to proactively address cybersecurity risk.

Why your school needs a cyber strategy

CISA’s research underscores the unsettling truth: Cybersecurity is a massive problem in the United States — especially for K-12 school districts. In fact, their data suggests that school-related cyber incidents increased three times over during the pandemic.

Threat vectors have become so numerous and treacherous that the Biden Administration recently unveiled a National Cybersecurity Strategy of its own. The goal of the national strategy is to “secure the full benefits of a safe and secure digital ecosystem for all Americans.” To do this, the federal government aims to make fundamental changes to how the U.S. allocates roles, responsibilities, and resources as they relate to cyber defense.

As an area of critical infrastructure, some K-12 experts are optimistic that the new National Cybersecurity Strategy will lay the foundation for much-needed improvements across the education sector. A key focus of the plan is to shift the cybersecurity burden away from under-resourced individuals (like school administrators) and toward major technology companies (such as edtech vendors). This will be important for school districts, as third-party vendors were responsible for more than half of all K-12 data breaches between 2016 and 2021.

More importantly, third-party vendors are also responsible for some of the devastating data breaches in K-12 history. For example, a January 2022 cyber attack on Illuminate Education — one of the biggest edtech providers in the country — led to the exposure of 820,000 current and former New York City Public School students.

A December 2021 ransomware attack against Battelle for Kids resulted in a similar outcome. The records of nearly 500,000 Chicago Public School students and over 56,000 staff members were compromised in the incident. The Information included students’ names, birthdates, genders, and state ID numbers, among other sensitive details.

How to create a K-12 cybersecurity strategy

Cyber incidents like those above illustrate why schools simply cannot afford to take an ad hoc approach to cyber defense. The stakes are just too high.

Here are a few tangible steps you can take to harden your cyber resilience and develop a concrete cybersecurity strategy.

Set your goals

Ensure your IT department’s goals are aligned with your cybersecurity plan. In other words, keep cyber resilience in mind whenever your district makes an IT decision, as chances are those choices will have some impact on your data security.

Audit your threat environment

Know your risks so that you can better protect against them. Otherwise, you’re blind to the hazards that could put your students and their data at risk.

Familiarize yourself with a few common culprits:

• Ransomware
• Malware
• Phishing attacks
• Account takeovers

Remove risky third-party vendors

Reduce your attack surface by eliminating apps that don’t belong (or whose security policies aren’t up to your standard). Chances are that students or staff are using applications right under your nose without your knowledge or permission.

Gartner predicts that by 2025 60% of organizations will use cybersecurity risk as a primary determinant in conducting third-party transactions and business engagements. Schools should take an equally rigorous approach to vetting who they entrust with student data.

Review existing policies

Look for gaps in your current security policy. Add any new cybersecurity requirements that could bolster your defenses. For example, you may need to add a specific policy around how students can use their documents or who staff members are allowed to share information with.

Provide continuous training for your staff

According to CISA (and just about everyone), most districts are woefully understaffed. Those that do employ cybersecurity professionals may only retain their services part time. Even worse, their training may be outdated or not aligned with current requirements.

It’s best to regularly train staff, faculty, and students on digital literacy, including best practices for protecting their own information.

Monitor your cloud domain and automate risk management

Keep a close eye on your cloud data by using an automated monitoring solution, such as ManagedMethods.

Acting as an extension of your team, it can help you gain more visibility and control over how users and third-party applications are accessing your data. Better yet, you can easily and swiftly intervene when a threat is identified.

Choose a framework

A framework is like the lens you use to capture your cyber strategy. It provides the barebones guidance you need to build a strategic plan that works best for your district.

There are many standards to choose from, but we recommend the NIST Cybersecurity Framework. The NIST is the organization responsible for laying the groundwork on which many of the world’s foremost data security policies have been created.

Not sure how to get started? No problem! We’ve already done the homework for you. Check out our NIST Cybersecurity Framework Success Kit, where we’ve assembled all the resources and solutions you need to implement NIST best practices and better protect your school district.