In the fall of 2021, the Center for Internet Security’s Multi-State Information Sharing and Analysis Center (MS-ISAC) reported an expected 86 percent increase in cybersecurity incidents targeting K-12 school systems over the course of one year. Public and private schools provide a broad surface area for exploitation and are often the target of malicious hackers looking for financial gain or to steal the sensitive personal data of teachers and students.
Countering these ransomware attacks with proper cyber hygiene practices can be especially difficult if there is little or no room in the IT budget, or if curriculum leaders lack involvement in the effort to enhance cybersecurity.
As a result, there are a few helpful benchmarks that can assist IT administrators in their ever-evolving quest to bolster cybersecurity measures and limit schools’ exposure to pervasive attacks.
Beef Up Cybersec Skillsets
Ransomware has hit the education sector hard. Schools with lackluster protections make cybercriminals salivate. They also suffer incredible losses when both finances and instruction times are interrupted, as schools often must shut down completely to restore frozen data. And it’s all taking place while communities are also demanding even more visibility into the data schools have on their children, their schoolwork, their families, their records, etc. As a result, school administrators in charge of K-12 cybersecurity deal with myriad challenges while navigating how to best secure the sensitive data of both students and staff.
Attacks on unprepared systems often come down to a lack of detection and accidental data leaks due to improper storage of documents on school-provided cloud drives. In an ever-changing world, the internal and external portfolio of aggregate skill sets provided by IT talent must evolve over time. Continuing to evaluate where these gaps are on an annual basis provides systems with the balances needed between agility and financial efficiency. By being proactive regarding the auditing of vendors and managing the access and permissions of learning management apps used in schools, administrators can create a more robust security posture for their school.
Cultivate a Security-Centric Culture
Creating security benchmarks for K-12 requires a willingness to act and promote a culture that takes cyberthreats seriously from the top down. Building a frictionless experience is a paradox and the world of education provides a variety of constituencies that range from small children to highschoolers and teachers who bring a range of different needs and areas of protection to the table.
This means that for an IT department to be successful, it must take on the accountability for managing cyber safeguards and involve leadership in its conversations surrounding specific risks. By creating a healthy culture of discussion between the superintendent, board, and educators, IT can promote a holistic way of working within a more formalized governance, risk, and compliance program (GRC). In recognizing security risk management as everyone’s responsibility, district stakeholders and administrators can work together to decide how to best handle the risk at hand with minimal impact on instruction time.
Must-Have Layers of Protection
The ongoing lack of cybersecurity awareness has led to an overly reactive security culture. Benchmarking is about moving to a proactive posture and one that actively establishes practical defenses against attackers.
Establishing such defenses requires securing data through:
- Multi-factor authentication – require additional steps to successfully login
- Identity and access management systems – better control user access
- Endpoint protection – consistently protect desktops, laptops and mobile devices
- Backup and recovery – create, store and proactively test data availability
- “Fire drill” testing – implement ongoing testing to verify resilience
- Ongoing training – continual education and awareness keeps security at the forefront
The Center for Internet Security is a critical resource that allows institutions to implement a standard, secure baseline for cyber assistance that ranges from firewall configurations to endpoint security that can help better protect schools from the most common threats they face today and tomorrow.
Additionally, building content awareness, including knowing what data exists, how it’s shared and where it’s located, helps create a layer of resilience against ransomware through the tightening of access and making informed decisions during an attack. Establishing monitoring systems and training staff and students on proper internet hygiene also helps reduce weak entry points and the risk of malware corruption.
With good internet hygiene, passwords can be strengthened and a powerful, foundational approach to cybersecurity can be nurtured and expanded. As user traffic continues to expand well beyond the traditional model of network security within school grounds, safeguarding that access is clearly key.
That said, securing your digital environment while striking the right balance in authentication security does not have to be an overly time-consuming or cost-prohibitive process. With identity and access management (IAM), the entire education ecosystem can benefit from consistent, automated management while simultaneously advancing single sign-on and meaningful insights to classroom analytics. Additionally, utilizing IAM can safeguard learning environments for all users while maximizing instructional time to accelerate learning.
The massive uptick in ransomware attacks not only spawns a renewed emphasis on identity-centric security, but it also stands as an opportunity for IT, curriculum, and board members to work together to innovate and protect at the same time – all guided by bolstered benchmarks that can make a true difference in the wake of growing cyber challenges.
- 3 ways to avoid summer learning loss - April 19, 2024
- High school students say AI will change the workforce - April 18, 2024
- Motivating students using the Self-Determination Theory - April 17, 2024
