As academic institutions slowly reconvene, virtual learning has become the driving force of education in the current climate, placing schools at the top of the cybercriminal’s wish list. With some of the country’s largest school districts shifting to a fully remote learning experience, rising vulnerabilities could provide hackers with a hefty payout.

With K-12 schools relying heavily on videoconferencing and unfamiliar technologies to deliver curricula, an abundance of devices will be interacting on their networks, rendering past security measures useless against this “new normal.” Adding to this already target-rich environment of devices, the often-sub-par maintenance of a home network poses an even greater cyber threat.

The most recent attack on Clark County School District, who first announced it had experienced a “data security incident” on Aug. 27, 2020, when “certain CCSD systems became infected with a virus that prohibited access to certain files,” the district said. Weeks later, the hacker published information that was held by the district, including addresses, employees’ social security numbers, and students’ birthdates and grades, The Wall Street Journal reported on Monday.

And according to cybersecurity firm Emsisoft, the number of schools hit by ransomware in August had already grown to twice the number by September.

“There is a very high likelihood this is going to be a very rocky fall for school districts with respect to cybersecurity,” said Doug Levin, president of EdTech Strategies, which tracks ransomware attacks, data breaches and other cyberattacks on K-12 schools.

Online learning means school districts will experience a proliferation of devices interacting on their networks, stretching existing security measures thin. Furthermore, home networks tend to be less secure and less frequently maintained than school networks.

It’s a near certainty that hackers are aware of the vulnerabilities, said Chris Hinkley, who heads the threat resistance unit at Armor Defense Inc., a Texas-based cybersecurity firm, and has been tracking ransomware attacks against schools throughout the year.

At least 27 school districts and colleges were the target of ransomware attacks this year, but according to Armor, it’s likely that the actual number is much higher because many incidents are never disclosed to the public. Hinkley predicts that fall will see a rise in ransomware attacks.

CYBERSECURITY RECOMMENDATIONS FOR K-12 SCHOOLS USING VIDEO CONFERENCING TOOLS AND ONLINE PLATFORMS from the Cybersecurity & Infrastructure Security Agency (CISA)

Tuesday, October 06, 2020 at 10:30 AM EST
Matthew Webster
Overview
A Cybersecurity risk program is absolutely critical to an information security program. It is also required by most compliance frameworks. There are many challenges with setting up risk programs and it is important to get started in the right direction. This presentation walks you through setting up a program, assessing a program, and managing the risks.

Speaker Bio
Matthew Webster
Matthew Webster has almost 25 years of experience in IT and Information Security – including Chief Information Security Officer. He has built several security programs from the ground up and advised CISO’s across the Tristate region about everything from tooling, compliance, risk, and so on. He is passionate about everything related to information security and privacy.