Better K-12 Cyber Data – Exposing Hacker Ecosystems, S3E3

In this 2022 episode of The CoSN Podcast, Michelle Mercer, John Frangos and James Levija discuss hackers and the strategies educators can use to protect district networks and data. A new section after the episode description summarizes what federal agencies and CoSN’s survey say about K-12 cybersecurity and lists steps a district can take.

K-12 Cyber Data – Exposing Hacker Ecosystems

The CoSN PodcastK-12 Cyber Data – Exposing Hacker Ecosystems, S3E3September 21, 2022 · 26 min 53 sPlay episode: K-12 Cyber Data – Exposing Hacker Ecosystems, S3E3 (26 minutes 53 seconds)0:00-26:53Follow on SpotifyApple

What is a hacker, and what threats do they present to K12 school districts? As we begin the school year, we want to ensure that K12 districts are adequately prepared to address these risks and secure data. In this episode presented by Telos, we discuss the philosophies behind anti-hacking data security and strategies educators can take to protect district networks, data, information, and security systems from hackers.

K12 cybersecurity in 2026: what districts face and what protects them

The episode above, as described on this page, asks what a hacker is, what threats hackers present to K-12 districts, and which strategies educators can use to protect networks, data and security systems. The page gives only that description, so this section does not summarize the conversation itself. It sets out what government and survey sources say about K12 cybersecurity, so that a superintendent, technology director or board member can use the episode’s questions with current information in hand.

What an attack costs a district

A Government Accountability Office report, Critical Infrastructure Protection: Additional Federal Coordination Is Needed to Enhance K-12 Cybersecurity, published in October 2022, found that ransomware and other cyberattacks have significantly disrupted K-12 instruction and operations. State and local officials told the GAO that students lost between 3 days and 3 weeks of learning time after an attack, and that recovery took from 2 to 9 months. The report notes that the national scale of attacks is not known with precision, and that districts also face financial losses from downtime and the resources needed to recover.

The Cybersecurity and Infrastructure Security Agency (CISA) describes K-12 schools on its K-12 cybersecurity page as holding large amounts of personal and financial data about students, staff and school records while often lacking the resources to protect it. The page names ransomware and phishing among the common risks.

What districts report about their own readiness

The CoSN 2025 State of EdTech District Leadership report, as summarized by eSchool News, found that 61 percent of districts pay for cybersecurity from general funds with no dedicated funding, and 78 percent invest in monitoring, detection and response. Phishing was rated a high risk by 27 percent of respondents, and data breaches and ransomware were each rated high risk by 13 percent. The summary does not state how many districts responded, so these percentages describe the respondents and may not match every district.

Protecting student data in practice

Protecting student data involves both technical controls and everyday habits. CISA’s #StopRansomware Guide, updated in September 2023, lists prevention practices that apply to a district of any size. Among them:

• Keep offline, encrypted backups of critical data and test restoring them.
• Update software and operating systems promptly, starting with systems exposed to the internet.
• Use phishing-resistant multifactor authentication, especially for email and remote access.
• Limit each user’s access to what the person’s role requires.
• Filter malicious email, and keep administrator accounts separate from everyday accounts.
• Keep and review logs, and write and rehearse an incident response and communications plan, with copies stored offline.

These practices are written for organizations of all kinds, and a district will need to decide which fit its staff and budget first. Because the CoSN respondents rank phishing as the most commonly rated high risk, multifactor authentication and staff reporting habits are reasonable early choices, since both address stolen or guessed passwords and suspicious messages. Backups come next, since they decide how long a district is without its systems after an attack, which is the number the GAO’s officials described in weeks and months.

CISA’s K-12 page also points to a Cybersecurity Guidance for K-12 Technology Acquisitions, a K-12 Cybersecurity Foundations Resource Package and free help from regional cybersecurity advisors. Districts that are weighing a purchase can use the acquisition guidance in the same review as price and classroom use.

Questions a board or superintendent can ask

1. When was the last time the district restored a system from backup, and how long did it take?
2. Which staff accounts use multifactor authentication, and which do not?
3. Who decides whether to close schools or move to paper if the network is down, and has the plan been rehearsed?
4. How are staff trained to report a suspicious email, and how quickly can they reach someone?
5. Where is student data stored by outside vendors, and what does the contract say about a breach?

The GAO’s figures on lost learning time are the reason the plan for operating without the network belongs next to the plan for restoring it. A district that has written both can answer a family’s question about what happens on the first morning after an attack.

More on Cybersecurity