Science Safety 
Frankie Jackson and Jeff Angle joined Safer Ed in 2023 to discuss threats to school data, the effect of distance learning on cybersecurity, and advice for school technology leaders. A new section below adds federal guidance and incident data and sets out where a district can start.
For this episode of Safer Ed, special guests Frankie Jackson and Jeff Angle join us to discuss K12 Cybersecurity.
The conversation begins by defining some cybersecurity challenges and threats to school data and information technology structures. From typical phishing cybersecurity attacks to the kind of vulnerable data, this conversation provides a great baseline for cybersecurity in K20.
Jeff and Frankie provide insight into the diversification of cyber attacks, the factors and points of failure across K12, and the risk associated with unprotected data.
Creating K12 Cybersecurity Success
In the second part of the episode, the trio discusses the effects of distance learning on cybersecurity and frameworks for cybersecurity success. As Jeff points out, the financial loss accumulated during the pandemic cybersecurity attacks was nearly 10X greater than in pre-pandemic learning.
A major key discussed in this conversation is the development of a culture and practice of cybersecurity. The challenges of establishing great cybersecurity hygiene are resources, funding, training, and leadership.
The Loss of Trust in K12 Cybersecurity Breaches
As Frankie, Jeff, and James discuss throughout the conversation, there is an incomparable loss of trust due to a cybersecurity breach. Parents are invested not only in protecting their students but in protecting their investment in their schools. The importance of proper cybersecurity is communal trust in schools.
Advice for all CTOs
Overall, this conversation sets a great groundwork for school districts to assess, bolster, and create scaffolding for cybersecurity. To close out the show, Frankie and Jeff give some necessary advice to all K12 CTOs.
Frankie’s advice for all CTOs
- Adopt a framework
- Creates assessment
- Hire a 3rd party to evaluate your program
Jeff’s advice for all CTOs
- Educate staff and students on single points of failure for cybersecurity breaches.
- Don’t forget the physical component- protect your computers.
K-12 cybersecurity for school districts: what federal guidance and incident data say
K-12 cybersecurity covers the systems, accounts and habits that protect student records, payroll, networks and classroom technology. Frankie Jackson and Jeff Angle, the guests in the episode above, describe the culture and practice of cybersecurity as the main task, and they list resources, funding, training and leadership as the obstacles. This section adds two sources that give those points numbers and a starting order: the federal Cybersecurity and Infrastructure Security Agency (CISA) and the K12 Security Information Exchange (K12 SIX). For school safety topics beyond cyber risk, edCircuit’s School Safety guide is the place to continue.
What the incident record shows
K12 SIX, a nonprofit that serves schools, keeps the K-12 Cyber Incident Map, a record of publicly disclosed incidents. Its 2022 annual report on 2021 data, as described in K12 SIX’s March 10, 2022 press release and in K-12 Dive, counted 166 publicly disclosed incidents in calendar year 2021 affecting 162 school districts across 38 states. For the first time, ransomware, an attack that locks a district’s files until money is paid, was the most frequently disclosed incident type, at 37 percent of incidents according to K-12 Dive. Since 2016 the map has recorded 1,331 incidents. K12 SIX National Director Doug Levin told K-12 Dive there are 10 to 20 times more incidents occurring than the group can present information about. The press release also reports that compromised vendors were behind 55 percent of publicly disclosed K-12 data breaches since 2016. Those figures describe 2021, so a district should treat them as a baseline for the kinds of incidents that occur rather than as current counts.
What CISA recommends
CISA published Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats on January 24, 2023. Its central finding is that K-12 organizations need resources, simplicity and prioritization to reduce their cybersecurity risk. CISA’s K-12 page turns that into three recommendations.
- Invest in a few high-impact measures first. CISA names multifactor authentication, fixing known exploited vulnerabilities, backups that are tested, regular practice of an incident response plan and a strong training program. Over time a district adopts CISA’s Cybersecurity Performance Goals and builds a plan on the NIST Cybersecurity Framework.
- Address limited resources directly. Use no-cost and low-cost services for early gains, expect technology providers to enable strong security controls by default at no extra charge, and move IT services to more secure cloud versions where it makes sense.
- Collaborate and share information. Join groups such as the Multi-State Information Sharing and Analysis Center and K12 SIX, work with state school safety centers and agencies, and build relationships with regional CISA and FBI staff.
CISA also states that change has to come from the top down, with leaders setting a culture of cybersecurity. Incidents can be reported to CISA at report@cisa.gov or 1-844-Say-CISA at any hour.
Connecting the guests’ advice to the plan
Jackson’s advice to technology officers, to adopt a framework, build an assessment and hire a third party to evaluate the program, fits the CISA sequence. A framework gives the district a shared list of controls, the assessment shows which are missing, and an outside reviewer checks the district’s own view. Angle’s advice to teach staff and students about single points of failure and to protect physical computers corresponds to CISA’s emphasis on training. K12 SIX adds a related point from its incident data: compromised vendors were behind 55 percent of publicly disclosed K-12 data breaches since 2016, and the press release recommends vetting vendors and suppliers.
Decisions for a superintendent or board
- Ask for the five basics by name. Ask the technology director whether multifactor authentication covers staff accounts, whether backups have been restored in a test, and when the incident response plan was last practiced.
- Review vendor contracts. Ask what security each provider that holds student data must maintain, and who tells the district if a breach occurs.
- Plan the family message in advance. The episode stresses the loss of trust after a breach. A response plan should say who informs families, how quickly and in what words.
- Budget for the work. The guests name funding and staffing as obstacles, so a line in the budget for training and outside review shows whether the plan is real.
- Teach students too. Students handle accounts and passwords daily, and the Digital Citizenship guide covers how to build those habits.
Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.
Related reading
More on Cybersecurity
