While no industry is immune to cybercriminals and ransomware attacks, the education sector has the highest ransomware attack rate. More than 380 ransomware attacks have been reported against education institutions in the past five years, costing an estimated $53 billion in downtime and compromising 6.7 million personal records. The average length of downtime following a ransomware attack is 11.6 days. That’s more than two weeks of lost instruction time for school districts.
“It wasn’t that long ago that K-12 schools used to be considered a sacred place. No threat actor would try to impact our student learning or attack our school system, but times have changed,” said Chris Woehl, Executive Director of Technology and Information Services for the Lake Travis Independent School District (ISD) in Texas in a recent webinar on modernizing technology in K-12 schools. “Schools are now seen as an opportunity.”
Prime Targets for Cyberattacks
K-12 institutions are prime targets because they offer a trifecta for cyber criminals: breaches are high-profile and trigger emotional responses from parents and the community, schools are funded by the government and are seen as more likely to pay the ransom and districts often rely on aging technologies that make them more vulnerable to an attack.
“We conducted a survey of K-12 IT decision makers with our partners and found that 90% of respondents said modernizing IT is vital to their institution’s future, but just 15% gave their current efforts an ‘A’ grade,” said Hernan Londono, Chief Technology and Innovation Strategist for Education at Dell Technologies. “A key driver to modernize is to improve cybersecurity.”
That same survey found that four out of five IT decision-makers say that legacy systems are putting their institutions at risk.
Federal Support
The issue has gotten the attention of the federal government. The bipartisan Enhancing K-12 Cybersecurity Act being considered by the U.S. Congress calls for the Cybersecurity and Infrastructure Security Agency (CISA) to establish a school cybersecurity program.
CISA has also asked for a “voluntary pledge” for K-12 educational software makers to focus on creating products that put cybersecurity at the heart of their design. Six of the largest technology companies in the education sector have signed the pledge. The Federal Communications Commission plans to launch a $200 million pilot program to better protect K-12 infrastructure from cyber threats.
At Lake Travis ISD, “it’s imperative that we survey, manage, detect and respond to cyber threats,” Woehl said. “So, whether it’s an appliance, a piece of software or software-as-a-service, we are collecting and logging our telemetry data. We have to perform cyber audits and do internal threat hunting to protect our systems and the school community.”
Balancing Cybersecurity in a Learn-From-Anywhere World
Protecting employee, student and community data and threat detection and response were noted as the top cybersecurity priorities by IT decision-makers in the Dell Technologies survey. But the security landscape has grown more complicated as students and staff connect and learn remotely from any device. The expanded threat landscape is causing schools to balance strengthening cybersecurity with ease of access.
“A modern infrastructure enables institutions to use technology to protect data regardless of where access originates. This includes supporting Zero-Trust security methods like multifactor authentication that let trusted people in but stop attackers from gaining access,” Londono noted.
Modern infrastructures also support disaster recovery efforts, giving schools the ability to recover quickly with minimal impact to school operations and student learning in the event of an attack.
Investing in K-12 Cybersecurity
Budget constraints were noted as the top roadblock for K-12 IT leaders looking to modernize their infrastructure, the Dell Technologies survey found. Finding technologists skilled in cybersecurity is another key issue.
“School districts are competing with the private sector for cybersecurity talent,” Woehl noted. “Not having adequate staffing has a big impact on a district’s ability to detect and stop threats.”
Investing in training is helping. Districts have focused on training personnel to recognize common methods of cybersecurity attacks, such as phishing, to stop attacks at the point of access.
Other programs, such as the Dell Student TechCrew, are training the next generation of technologists. The program trains high school students as help desk technicians, who can then support school technology teams with district technology requests.
It’s a great program for the students who get hands-on technology training in high school, and it also has significant benefits for district IT teams because they can spend more time on cybersecurity instead of day-to-day technology support.
Funding to modernize infrastructure is available through the Infrastructure Investment and Jobs Act (IIJA). Seventy-four percent of school IT leaders surveyed said that they are likely to use IIJA funding to improve their technology infrastructure.
“While up until now, risk has not been a driving factor in determining IT investments in K-12,” Londono said. “But now it is. External forces are driving investment. For example, cybersecurity insurance is applying an external force to K-12 districts, who need to be insured to protect themselves in case of an attack. The cyber insurance companies are asking if their security posture and risk is adequate. If it’s not, they can’t get insurance.”
Londono notes that districts can partner with technology companies to overcome talent or modernization investment shortfalls.
“Outsourcing talent or moving to managed services … can help cash-strapped districts strengthen cybersecurity even in a resource-constrained environment,” he said.
Learn more about how Dell Technologies can help K-12 districts modernize their infrastructure and fortify modern security to foster safe learning environments at our K-12 IT Solutions site.
