Cybersecurity Among Essential Building Blocks for Strong School Security
Cybersecurity
On Thursday, January 13th Albuquerque Public Schools discovered a cyber attack that locked teachers out of their essential databases which gave them access to student information such as attendance trackers, emergency family contacts, and a verified list of authorized people who are allowed to pick up a student from school. In response to this, the school system cancelled classes for the rest of the week so as not to pose any real life threats to the faculty or students.
Just 10 days before this attack on APS, thousands of schools suffered a ransomware attack which caused outages for their websites. The ransomware attach actually seems to stem from the webhosting company that each of the affected schools used; this company, Finalsite, was hit by a ransomware attach which, in turn, affected all of the company's customers -- the schools. The company works with over 8,000 educational institutions in more than 100 countries around the world. Though this attack, thankfully, appears to have not impacted any of the schools' or colleges' data, this instance and the Albuquerque schools' hack highlight a major area of cybersecurity which is not always focused on as much as other arenas -- education.
Review your school's cybersecurity plan -- Before trying to make changes to strengthen your school's cybersecurity defenses, it is a good idea to check in and see where you're at currently. You can do this by asking some questions of yourself and your internal IT team -- these types of questions include What sort of data do we collect and where do we store it? Where are our backups and how secure are they? What can we add to our cybersecurity plan to make it stronger? What is the budget we can dedicate to cybersecurity? With schools in particular, that last question may need to be answered first, as budget can be one of the primary barriers to successful cybersecurity for most schools, as they typically have a limited budget to work with. Despite this, it is important to prioritize cybersecurity to protect student and faculty data and there are ways to tackle this without spending a lot of money. In addition to the tips below, it is helpful to start with a strong network firewall as this will provide a solid base for filtering in good traffic and filtering out bad traffic.
Train staff, students, and administrators on cybersecurity best practices -- In addition to the right software and hardware, people can be the best tools in defense of cybersecurity risks. Teach everyone at your school about common cyber attacks like phishing and ransomware and inform them of how to avoid these attacks. Equally as important as identifying and avoiding cyber risks is teaching students and teachers about the appropriate contacts at the school should they want to report a cyber issue or have a question regarding cybersecurity. This will help everyone feel comfortable having a place to go when cybersecurity is in question. Conversely, cyber unaware individuals or people who are careless when it comes to cybersecurity can be the greatest risk to an entity's cybersecurity. Even more reason to ensure all students, faculty, and administrators are trained in cybersecurity best practices.
Be wary of third party companies -- As we can see from the Finalsite attack, some threats to schools come from the third party companies they use for different aspects of operating. While contracting out a piece of the operations to a specialized company can be helpful in managing a school, it poses a risk to the school itself if the company being used is not cyber secure itself. It is important when looking to use third party companies for different facets of school operations, such as webhosting, to do your research and find a company with strong cyber defenses so that you put your information in the hands of a company that will treat it with safety in mind.
Reach out to local cybersecurity professionals -- It can be intimidating trying to protect your school's data on your own -- but you don't have to approach it alone. No matter where you are across the country, there are plenty of local cybersecurity professionals who can help you in creating a plan for your school or consulting about questions you have related to cyber vulnerabilities. These folks can lead you in the right direction when it comes to cybersecurity and you can even contract this facet of operations to your local cybersecurity company if you have the means to do so. They'll help set you off on the right path for securing your school!
