The notification came in at 5:30 a.m. that something was wrong with the servers in the Cherry Hill School District outside Philadelphia. By 7:30, Wi-Fi was down. Email too.
Superintendent Joseph Meloche and his team later learned that a hacker had taken over their system, potentially through a phishing email. It took district officials and a slew of vendors more than two weeks to get everything back up and running, from staff email to the checkout system used in the school libraries. That meant 20-hour days, with emails flying back and forth daily from 5:30 a.m. to midnight.
And although learning was uninterrupted, the experience last fall was more than just a technical nightmare, Meloche said. The district had to explain to parents why they were unable to email their child鈥檚 teacher.
鈥淚t seemed like, 鈥榃ow, the district is falling apart,鈥� but we were actually functioning and functioning well,鈥� said Farrah Mahan, Cherry Hill鈥檚 curriculum director. Still, the task of getting back to normal was grueling. 鈥淭his was a marathon, you have to be slow and steady and pace yourself. There was a lot of conversation about self-care and making sure that we were taking some moments to be offline.鈥�
Cherry Hill is far from alone. There have been at least 775 publicly disclosed cyber incidents nationally since 2016. That includes phishing attacks, data breaches, ransomware attacks, and denial-of-service attacks, according to the K-12 Cybersecurity Resource Center. And the number of incidents more than doubled in 2019, compared with 2018, from 122 to 348.
In fact, 2019 had the highest number of incidents since Douglas Levin, the founder and president of EdTech Strategies, began tracking the problem.
One possible explanation: School hacks are increasing because K-12 school systems are so reliant on technology and have potentially valuable data on students and employees, Levin said. 鈥淭here are bad guys who are targeting [schools] because they鈥檝e become successful,鈥� Levin said.
He added that the coronavirus pandemic could exacerbate the problem because hackers play on people鈥檚 fears, more students could be using school-issued devices at home more often, and dealing with coronavirus-related technology needs could divert IT resources away from cybersecurity efforts.
Serious Consequences
Some systems, including Alabama鈥檚 Houston County school district, have had to close or postpone classes. The Rockville Center School District outside New York City paid hackers $100,000 to recover its data, according to local news reports. (The payment was covered by the district鈥檚 insurance policy, the local radio station reported.) Back in September, Louisiana Gov. John Bel Edwards, a Democrat, declared a statewide emergency after school systems in three parishes were hit by cyberattacks.
Districts are coping mostly with ransomware attacks, which will encrypt files in a computer and can quickly render entire systems inaccessible, and phishing attacks, which seek to steal employee credentials so that hackers can get into a computer system or steal valuable data, said Amy McLaughlin, the cybersecurity director for the Consortium for School Networking.
69传媒 are increasingly becoming the victims of cyberattacks鈥攕uch as phishing, ransomware, and denial-of-service鈥攂ecause they are easy targets.
775 publicly disclosed cyber incidents in K-12 schools since 2016, including phishing attacks, data breaches, ransomware attacks, denial-of-service attacks, and other incidents.
The number of incidents more than doubled in 2019, from 122 the previous year to 348鈥�.
Source: K-12 Cybersecurity Resource Center
44 percent of chief technology officers report their districts do not offer cybersecurity training for district employees
35 percent offer training to both teachers and principals
18 percent said their districts planned to add training this school year
73 percent of education technology leaders reported they were backing up all information and storing it off site in case of an attack
69 percent are encouraging staff to upgrade passwords
47 percent are increasing the use of encryption
34 percent are having cybersecurity practices audited by an outside organization
20 percent are convening a cybersecurity team
Source: Consortium for School Networking/Education Week
These tactics aren鈥檛 always sophisticated. The classic phishing attack could be an email that says something like 鈥渢his is an emergency, please send all W-2 forms for current employees,鈥� McLaughlin said. Or a hacker may try to copy the email of a district leader, say the superintendent, and ask their executive team to buy gift-certificates and send the codes to them right away.
K-12 systems make 鈥渞eally easy targets鈥� because they are staffed by helpful, diligent people, and because district leaders鈥� schedules are a matter of public record, so it would be easy for a hacker to include seemingly relevant details in a phishing email, McLaughlin said.
鈥楥ybersafety鈥� Is Key Word
McLaughlin鈥檚 number one piece of advice for combatting those types of scams? Train staff. And she鈥檚 not talking about a quick, 15-minute annual in-service training, sandwiched between other professional development. She鈥檇 rather see 鈥渁n ongoing marketing campaign鈥� where everyone in the district reminds staff, and even students, to report phishing scams. Districts could offer a reward each month for the person who reports the most potential problems, she suggested, or have students make posters about the problem.
Staff should be encouraged to report every possible attempt. District tech leaders 鈥渨ould much rather spend time saying, 鈥榥ope that鈥檚 not legit,鈥� than to have someone click [on a suspicious link or email] even once.鈥�
She also suggests districts use the term 鈥渃ybersafety鈥� when discussing these issues. 鈥淲hen you talk about safety, people listen,鈥� she explained. 鈥淲hen you talk about cybersecurity, it sounds like some nerdy, geeky thing and their eyes glaze over.鈥�
Reporting every possible hacking attempt is advice Cherry Hill took after the hack earlier this year. After the incident, district leadership also moved email to a cloud-based system, with two-factor authentication. And officials told employees, 鈥淚f you receive an email from an external person, if you don鈥檛 recognize the person or the name, don鈥檛 click on any forms,鈥� Mahan said. 鈥淥ne person in a district of 11,000 could bring down our entire system. You have to be mindful of what you鈥檙e clicking on.鈥�
But not every district trains its employees on cybersecurity. In fact, in a survey conducted by CoSn and Education Week, 44 percent of CTOs said they don鈥檛 offer such training. Another 35 percent said they offer training to both teachers and principals. And nearly 18 percent said they planned to add training this school year.
Back Up Computer Systems
Districts also need to do some technical work, including backing up their systems, and testing those backups. 鈥淎 lot of ransomware attacks are successful because backups have been compromised,鈥� McLaughlin said. Staff should make sure they are storing files in a place where it can be backed up, not directly on their laptops.
Jason Dial, the superintendent of the Ava R1 school district, in southwestern Missouri, which experienced an attack earlier this school year, seconded that advice.
鈥淏e sure that you have quality backup solutions,鈥� he said. 鈥淚f it hasn鈥檛 happened to you yet, it鈥檚 going to happen. In order to be ready for it, you have to make sure you have prepared yourself so that you鈥檙e not down very long.鈥� His district, he said, had recently installed backups and 鈥渄idn鈥檛 lose anything鈥� but 鈥渋f it had happened to us a year ago, we would have been in a lot worse situation.鈥�
Many districts are already working on backups, according to the CoSn/Education Week survey of 513 K-12 technology leaders in the United States Seventy-three percent of education technology leaders suggested they were backing up all information and storing it off site in case of an attack. Other popular strategies included encouraging staff to upgrade passwords (69 percent), increasing use of encryption (47 percent), having cybersecurity practices audited by an outside organization (34 percent), and convening a cybersecurity team (20 percent).
Sometimes, hackers demand a ransom for restoring a district鈥檚 data. McLaughlin鈥檚 advice: Don鈥檛 pony up. 鈥淚 would certaintly recommend against paying, because it鈥檚 just like kidnapping,鈥� she said. 鈥淧eople will continue to do that if they continue to get rewarded.鈥�
Dial said that when district officials arrived at school on the day of the hack, several printers had messages on them saying 鈥渨e have locked all of your data. If you would like it back, please send an email to this email address and we will send further instructions.鈥�
But the hackers never heard from the Missouri district. 鈥淲e choose not to respond to those types of threats. We knew that we had quality backup solutions off site,鈥� Dial said.
And, in case the worst happens, McLaughlin recommends districts have a cyber security plan in place that鈥檚 been read and vetted by lawyers. Key staff should know what they need to do and what sort of information they need to have, in the event that they have to call the insurance company.
District leaders also need to make sure they have an incident response plan in the event of a cyber event鈥攁nd they should practice it, just like they would a fire drill, McLaughlin said. 鈥淗aving that pre-prepped is so much better than trying to build an airplane while you鈥檙e flying it,鈥� she explained.
Another piece of wisdom from district leaders who have weathered attacks: Be sure to put some money aside in case the worst happens. Bob Blalock, the technology coordinator in Houston County, said his district might have ended up in a tight financial spot without some funding in reserves.
鈥淲e were very fortunate we had some budget for an emergency situation,鈥� he said. 鈥淲e are not an affluent school system.鈥� (Blalock declined to say just how much the district spent rectifying the situation other than that it was 鈥渧ery expensive.鈥�)
