The Cybersecurity & Infrastructure Security Agency (“CISA”), working in cooperation with the Office of Management and Budget (“OMB”), is the coordinating agency for the execution of national cyber defense. As a part of this role, CISA has developed a suite of cybersecurity resources including a new report, released last week, entitled Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats.
Highlighting the increasing risks faced by K-12 schools, the report includes the following chart of the growth of cyber attacks reported by schools from 2016 through 2021:
As a starting point, CISA recommends the following six priority steps that schools should take to reduce cybersecurity risks:
- Implement multifactor authentication (“MFA”) to secure online accounts and databases.
- Fix known security flaws by keeping systems patched with the latest software versions.
- Minimize exposure to common attacks on vulnerable targets such as Remote Desktop Protocol (“RDP”) servers.
- Develop and exercise a cyber incident response plan.
- Create a training and awareness campaign at all levels.
The CISA report recognizes that many schools are resource limited. To this end, CISA recommends the need for additional resources and suggests the following:
- Work with state planning committees to leverage the State and Local Cybersecurity Grant Program (“SLCGP”) and consider leveraging the Homeland Security Grant Program (“HSGP”) that dedicates 7.5% of its funds to support critical cybersecurity infrastructure. Notably, this recommendation references the FCC’s call for comments (DA 22-1315) on the use of E-rate funds to support advanced firewalls.
- Utilize free or low-cost services to make near-term improvements (see Appendix 1 of the report).
- Ask more of your technology providers. K–12 organizations should demand that all core educational technology products have critical security controls enabled for all administrator accounts at no additional cost.
- Minimize security risks by eliminating or reducing on-premise systems in favor of more secure and resilient cloud-based systems.