Cyberattacks are Coming for K12—So is Grant Funding

If anyone is under the illusion that ransomware only targets mega corporations, please think again.

Cyberattacks are Coming for K12

K12 is increasingly becoming a lucrative target for bad actors – and for “good” reasons. K12 investments into cybersecurity tend to be inadequate, and the data that can be stolen for ransomware is truly sensitive. Data breaches can expose confidential information, mental health records, records about child abuse inquiries, and campus physical security details.

According to a recent global survey, schools are now the single leading target for hackers, outpacing health care, technology, financial services and manufacturing industries. That fact is staggering.

Within the US, from 2016-2022, cybersecurity advocacy group K12 SIX, cataloged 1,619 publicly disclosed cyber incidents involving public K-12 school systems in every state in the nation. The average financial loss of a school district victimized by a cyber-attack between 2020 and 2022 was between $50,000 and $1 million.

Grant Funding is Coming, too

Like any initiative, cybersecurity costs money―but it needn’t be out of reach. In very simple terms, cybersecurity defense is a strategic mix of software, hardware, and education. With this urgency in mind, The White House is spearheading a series of federal initiatives to help with both funding and education.

One upcoming initiative is the State and Local Cybersecurity Grant Program (SLCGP). This grant can cover many essential cybersecurity bases, including multifactor authentication (MFA), system backups, password enforcement and more. The 2023 window has not opened yet, but details will be posted on the PA Emergency Management Agency website. We will keep you informed as this progresses.

Make a Cybersecurity Plan

The first step for any grant application is the submittal of a cybersecurity plan. We can help you with this. Cybersecurity isn’t any single action or solution – rather it is a mix of defensive measures that are within your specific budget, human resources allocation, and aversion to risk. If personnel and money were a non-issue, then every school would be as ironclad as the Pentagon! That not being the case, you must ascertain your main vulnerabilities and which systems are critical to protect. For some districts, a previous data breach will make them more mindful of one area of vulnerability; whereas another could be motivated by an insurance requirement.

Not sure where to begin?

Start with a free Cybersecurity Threat Assesment. This 7-day monitoring and diagnostics gives you a free report that identifies malware and botnets currently active on your network. It also includes a full rundown of bandwidth utilization, risky devices and unsafe applications. 

See a Sample Report.

Cybersecurity Essentials

At minimum, here are steps you should take right now to strengthen your cybersecurity posture. The easiest way to infiltrate into a school system is through leaked or easy passwords and getting susceptible people to click on harmful links. These vulnerabilities can be easily remediated through basic software and education.

• Multi-Factor Authentication (MFA): Yes, it’s annoying to juggle between your phone and desktop to log into the network. But it works. Because, according to the laws of probability, a hacker inputting your leaked password on their computer is very unlikely to also have access to your mobile phone… It's elementary!

• Complex & Secure Passwords: Use strong passwords and implement a schoolwide Password Manager. Once you have everyone trained on using a password manager like Bitwarden, they’ll thank you for putting an end to the multiple password madness.

• Training Programs: Educate your school community to recognize and report phishing emails. There are free and affordable training programs that send out dummy phishing emails so you can track who needs more training.

• Software Updates: Keep your software updated. An older firewall isn’t going to be equipped to recognize newer threats – and is essentially ineffective.

Level-Up!

When you are ready to go beyond the basics, here are our suggestions:

• Network Firewall: If you haven’t invested in a firewall, do get one. It’s the citadel to your crown jewels… It’s your most dependable barrier against malware, viruses, backdoors, and other attacks from entering into your systems.

• Secure Email Gateway: This goes beyond basic spam filters to include anti-virus scanners and real-time threat detection. Given that email is the #1 security vulnerability in an organization, having additional layers of email security is only to your benefit.

• Endpoint Detection & Response: The school environment is flooded with endpoints. In many districts, each student is issued their own digital device; school employees have mobile devices; the building is increasingly fitted with IoT devices such as sensors. These are all entry points into the network. Think about an unsuspecting student inserting a malicious USB into a school computer and infecting the network. Endpoint security refers to software that will detect anomalies, preempt threats, and mitigate damage when a vulnerability occurs.

Go with the Pro

If your district has a complex network, or desires a hardline cybersecurity posture, then you will need these more advanced cybersecurity tools:

• Network Access Control (NAC): Potentially, every device connected to the network is a source for cyber-attack. The benign copier sitting in the teacher’s lounge does, in fact, wirelessly connect to a third-party ink supplier. This could be a gateway into the school’s servers. A Network Access Control Solution will authenticate every single device on the network and assign access policies specific to the needs of that device. No, the copier does not need access to Mr. O’Leary’s gym class grades, thank you very much.

• Cloud Security: If your sensitive data is hybrid or in the cloud, you will need added protection for a cloud or multi-cloud environment. The security provided by your cloud provider tends to be siloed within specific applications, and vulnerabilities are present when there are multiple environments.

External Resources

Now for some helpful resources recently made available to K12.

• Amazon Web Services is making $20 million in grants available to K-12 schools, and for schools that already use AWS Skill Builder, customized training and incident response services for IT staff are offered free of charge.

• Cloudflare will offer cybersecurity and high-speed Internet services to public school districts with less than 2,500 students.

• Google released an updated cybersecurity guidebook that is applicable to schools that use the company’s software and hardware applications.

Once again, please do reach out for a consult. We work with many K12s across Western Pennsylvania and are deeply familiar with your needs.