The great recession has hit education hard. Many are reporting a mass exodus of teachers – a wide majority of which cite pandemic stressors as a key contributor. But it’s the short supply of financial and IT staffing resources in education that seems to have the most direct link to mounting school-based cyber risk.
According to EdTech Magazine, “A poll from EdTech: Focus on K-12 in October found that, of the first three phases of a proactive cybersecurity strategy, prevention is the area where K-12 IT leaders feel they need the most help. However, nearly half of the respondents said they needed help with all three of the phases or had no cybersecurity plan in place at all.”
Any educational institution that hasn’t already made cybersecurity a priority is dangerously behind the curve. Here is what you can do to hedge against the fever pitch of harmful breaches in schools and higher education.
1. Adopt a “Prevent and Protect” Mentality
To meet your school where it’s at, start by assessing your assets. Once you have cataloged all the hardware and software that connects to your network, you can work backward to see which are potentially vulnerable.
You may also choose to conduct penetration testing or see how well staff can spot a potential phishing email attempt and concentrate your efforts there.
Be sure to update your inventory list annually and anytime you implement new technology.
2. Solidify How You’ll Detect and Contain Threats
After pinpointing your weak spots, decide how you’ll reinforce them with proper detection tools and tactics. These usually involve some combination of automated security software and manpower monitoring protocols that can ID abnormal behaviors.
It is best practice to designate an IT point person to decipher which flags require immediate action and which are false alarms. This individual could be internal or outsourced.
EdTech Magazine recommends, “Schools take other steps to enhance their cybersecurity posture, such as strengthening user, device, and application security controls and segmenting their networks to limit what an intruder would be able to access.”
3. Create and Practice Your Recovery Plan
For most institutions – even those that are well-prepared – cybersecurity incidents are inevitable. How much or how little the impact is felt usually comes down to the strength of your disaster recovery plan.
Preparing your responses in advance ensures your designated recovery actors can contain and repair breaches in real-time.
Make sure your plan includes provisions about communicating with stakeholders like staff, students, and parents.
Randy Rose, Senior Director of Cyber Threat Intelligence, Center for Internet Security, recommends practicing the plan ahead of time, too. “We’ve seen schools with a disaster recovery plan in place that they’ve never tried out,” Rose says. “They don’t have the proper individuals identified. They haven’t figured out how they are going to fund some of this stuff.”
4. Consider Collaborating With a Third-Party Security Expert
Remember, you don’t have to do it all alone. Bringing on a tech partner is the right move in some cases, especially if you are having trouble finding qualified IT or cybersecurity personnel.
They can help evaluate whether your security strategy is comprehensive enough and work with your administrators to create additional airtight security controls.
Getting this objective view from a qualified outsider is a great way for schools to take a better security vantage point and put the most effective safety protocols in place.
Taking a preventative, proactive position to potential cyber threats is a must for schools. Whether you deploy the industry’s most sophisticated security software, hire senior security staff, or both, make sure your edtech is primed and optimized to keep your school and student data safe.