School IT Departments have had to adapt quickly as computing and cloud technology has changed education significantly over the last 20 years. As a result, the cybersecurity posture of public schools is complex, with several challenges to overcome. Schools have a wide and varied attack surface that is constantly changing, and a school’s security response has had to evolve as security threats have changed.

In this article, we will learn how to secure IT infrastructure in public schools. We will discuss the various threats and discover the challenges and rewards of incredibly tech-savvy students.

A Complex Security Posture

Schools require various layers of cybersecurity protection because there are many moving parts inside a school. School staff, governors, trustees, and volunteers are responsible for improving the school’s understanding of the latest cybersecurity threats.

Schools have a duty of care to protect students, including their cybersecurity. Therefore, measures must be in place to protect sensitive student information from internal and external threats while meeting the challenges of funding shortages, understaffing, and lack of physical resources.

Are Schools a Target?

According to Real Clear Education, 5.8 million malware attacks in 2021 targeted educational organizations. This evidence suggests that schools need to prepare for the eventuality of frequent cyberattacks.

What are the Cybersecurity Challenges Public Schools face?

The FBI and US Government are increasingly concerned about schools’ cybersecurity risks. Some of the common threats to schools are:

  • Data Breach: The risk of a data breach in schools is a significant concern. Schools collect personally identifiable information (PII) on students, including social security numbers and safeguarding measures. This data is susceptible and must be protected on computer systems, cloud storage, portable media, and during network transmission.
  • DDoS: Schools are frequently targeted in distributed denial of service attacks that overload servers to prevent access to critical school websites.
  • Phishing: Similar to the business world, schools are targeted via phishing campaigns. Students, teachers, and governors are targeted. Spear phishing targeting students (from “teachers”) is a terrible problem.
  • Malware / Ransomware: Another primary concern to public schools is malware and ransomware. Education can be halted if computer services are compromised and unprepared schools are perceived to have weak security. It just takes one student or teacher to open the door to hackers.
  • Vulnerable IT Systems: Due to budget constraints or possible lack of IT understanding, unpatched servers or using computers with legacy operating systems or applications increase the risk of systems being compromised.

How Can Schools Protect IT infrastructure?

Students are always keen to learn new ways to interact with IT systems, so educating students on security best practices should be relatively straightforward.

#1: Promote a Security First Agenda: Teachers need to lead by example and promote responsible usage of IT systems. Rules should be introduced surrounding local laws, policies, and regulations. In addition, students should sign a Responsible Usage Policy that promotes appropriate content, websites, applications, and etiquette for using computer equipment.

#2: Principal of Least Privilege: Abiding by this rule creates a secure ecosystem for students and teachers. Their access and user permissions should be heavily restricted to prevent users from accessing networked resources, accessing inappropriate content, installing games, etc.

#3: Enhanced Data Protection: Introduce enhanced data-security measures to protect confidential student records, which are high-value targets for ransomware actors. Data encryption is a minimum requirement, as are strict access controls to the data. Any data stored offsite, perhaps with a cloud services provider, should only be locked down to authorized user access.

#4: Backups: Also part of data protection, public schools need to back up data regularly every few hours to ensure data integrity. It is helpful to follow the 3-2-1 approach to backups is highly advisable. This strategy keeps three copies of your data; the first is live data, the second is a backup copy, and the third is another copy (preferably at an offsite location).

#4: Protect the Network: Use a VPN to protect access to offsite services with multifactor authentication. Network firewalls should be strategically placed around the network to protect data flow internally and externally. Technical solutions such as network blocklisting can restrict network access to external sources, and having detailed logging in place will provide an audit trail where computer usage can be investigated.

#5: Know Your IT: School leaders need to know who manages and coordinates the school’s IT infrastructure. Contact details for managed service providers or website contractors. The public school leadership teams must understand what IT systems are critical parts of the school’s digital estate and where PII is located.

#6: Be Prepared: Schools need to know what to do in the event of a cybersecurity attack. Reports can be made to local law enforcement, the FBI, the Internet Crime Commission, the National Cyber Investigative Joint Task Force ([email protected]), and the US Computer Emergency Readiness Team.

Security Defined Cloud Services

Atlantic.Net is a cloud services provider with over 30 years of experience providing security-defined hosting services. We offer business-class dedicated hosting and cloud hosting solutions focusing on security, compliance, and simplifying the user experience.

Atlantic.Net offers fully-managed environments, security, and compliance-focused solutions across all its hosting facilities in San Francisco, New York, London, Toronto, Dallas, Ashburn, and Orlando. With a range of certifications, along with SSAE 18, SOC 2, SOC 3, HIPAA, and HITECH-audited data center infrastructure, Atlantic.Net is a security-first provider. For more information, please visit www.atlantic.net.