With the proliferation of threats across the cyber landscape, cybersecurity in schools is more critical than ever. Your district’s people, funding, and reputation could be at risk if school data breaches aren’t addressed. Is your district equipped?
Cyberattacks in schools have increased each year since 2016, and data tells us this isn’t going away soon. In 2021, for example, there were nearly 1,400 publicly reported cyberattacks in schools, nearly doubling the number of incidents reported just two years earlier in 2019 — and things aren’t looking much better for the future. And this only represents publicly disclosed incidents. Many school districts might seek to avoid disclosing a breach in fear of publicizing vulnerabilities and eroding confidence in their capabilities. This suggests that the actual numbers related to cyber incidents in K-12 are likely somewhat worse.
School districts naturally have a lot of sensitive information in their systems, which makes them a popular target for cybercriminals. Information such as student records, employee information, proposed plans, lawsuits, and health data are valuable to cybercriminals, who sell or use this information for illegal purposes, such as identity theft. Based on the most recent K-12 cybersecurity report published by the organization, K12 SIX, data averaged over the last six years shows more than one K-12 cyber incident per school day impacting public schools.
School districts naturally have a lot of sensitive information in their systems, which makes them a popular target for cybercriminals.
Unfortunately, these issues aren’t resolved by simply upgrading your system software. Many districts lack the resources and awareness needed to build a strong cybersecurity program. The solution involves investing time and resources into making sure all of your district’s systems are secure and your staff is properly trained. Here are the most significant threats, what’s at stake, and what districts can do about them.
Ransomware and phishing attacks plague K-12 districts
A wide variety of cyber incidents affect U.S. school districts, including student data breaches, data breaches involving teachers or community members, ransomware attacks, business email compromise scams, denial of service attacks, website and social media defacement, and online class or school meeting invasions. However, the top cyberthreats to school districts continue to be ransomware attacks and phishing.
Ransomware is software designed to deny access to a computer system until a ransom is paid. Since cybercriminals can get rich quickly using this method, ransomware has become increasingly popular. Ransomware technology has evolved over the years to be easier to use and requires minimal or no computer skills. K-12 districts are often eager to add new technology yet fail to vet vendors who can be vulnerable to these attacks. As the most frequently experienced type of cyberattack reported by public K-12 school districts, this is a top risk to address.
Phishing is a tactic used to trick users into providing confidential information such as passwords and network credentials or installing malicious software through downloads or attachments. Attacks can appear to come from a variety of sources, including government agencies, fake businesses, or even parents of students. Like many people, busy school administrators, teachers, and even board members can easily fall for these scams, which look more real every day. One recent example of a successful phishing attack in K-12 is that of a district whose staff was receiving fraudulent emails to update their passwords in the district’s employee portal. Cybercriminals then used that information to change direct deposit bank account information for the staff’s payroll, resulting in tens of thousands of dollars lost to fraud.
Other cyberattacks to watch for are online payment or fundraiser scams like fake GoFundMe accounts. Many cybercriminals use fake social media accounts that appear to be affiliated with the school district to promote these scams. Having departments and school organizations follow the district’s social media policy can help differentiate and identify this suspicious activity since official accounts won’t ask for sensitive information. Implementing commonsense, baseline cybersecurity controls and trainings for teachers, administrators, students, and board members — anyone with access to personal or organization data — can help combat these common threats.
Implementing commonsense, baseline cybersecurity controls and trainings for teachers, administrators, students, and board members — anyone with access to personal or organization data — can help combat these common threats.
What’s at stake?
If your school district doesn’t take actions to address cyberthreats, it can face numerous financial and emotional consequences such as:
1.Poor reputation and loss of enrollment
Your school district relies on the trust and support of its community and parents, but cyberattacks often cause a loss of confidence in the district’s ability to keep students and staff digitally and personally protected. This could result in parents transferring their children to another school district that may be taking more concrete action against cyberattacks. This loss of enrollment can have a significant impact on your district’s funding.
2.Fines
A lack of response can lead to fines for failing to meet industry or legal standards, such as the Family Educational Rights and Privacy Act. Your district should review and take steps to evaluate its risk through assessments in order to identify and eliminate vulnerabilities.
3.Added stress
Stress levels are already high enough in resource-strapped public school districts without adding worry about data breaches. Stress can stem from not knowing how to address cyberthreats, where to start the process of securing your systems, feeling overwhelmed by the amount of information and options out there, having a lack of resources to increase cybersecurity, or the fear of experiencing a data breach plus the bad publicity that often follows it.
Steps your district can take
While this can seem overwhelming, there are actions you can take to get started now:
1.Conduct an overall risk assessment
The Cybersecurity & Infrastructure Security Agency (CISA) recommends investing in the most impactful security measures to begin building toward a mature cybersecurity program, starting by mitigating known explored vulnerabilities. An annual risk assessment will identify any vulnerabilities that could result in a potential cyberthreat and provide solutions to strengthen these areas. Your district’s network security includes physical, cloud-based, and third-party storage systems that contain sensitive information about students, staff, and the district. A strong network should have multiple layers of security in order to prevent access to the information it holds. This is especially critical for your school district’s network security, which is the main defense to prevent cyberbreaches and loss of data. Given the ever-changing landscape of technology and the opportunistic nature of cybercriminals, consider assessing all your district’s systems annually to ensure they are in good shape and your risk is low.
2.Establish a training program
Your district’s employees are the first line of defense against cybersecurity threats and ensuring they’re properly trained can reduce the risk of data loss by 70%. To make sure new employees are equipped with this knowledge, add cybersecurity training to your onboarding process. But don’t just address it once. Implement annual training for all employees to reinforce best practices and offer instruction on new threats.
3.Have a plan of action
Your districts should have a clear plan about the everyday management of cybersecurity and be prepared to identify and handle a cyberthreat before it occurs. Think of this as your district’s playbook to address general policies and provide your course of action. The plan should act as a guide to help staff follow best practices and procedures. Additionally, your district should have plans in place on how to respond to an incident if and when it does occur, so that your efforts to recover are structured and coordinated.
4. Vet your vendors
Your district’s cybersecurity is only as strong as your vendors’ approach. Failing to properly vet the vendors you work with is a common oversight that could cost you. Make sure all your vendors can adopt your security protocols and habits laid out in your management plan and ensure they’re not at risk for a data breach themselves.
As threats continue to increase in number and become more sophisticated with K-12 school systems remaining a top target, cybersecurity will be a critical topic to address long into the future. Your risk of a school data breach only compounds the longer you delay action, so start taking measures today.
