FETC 2019: K–12 Schools Need Evolved Security Protocols to Thwart Next-Gen Hackers
Hackers are evolving at a rapid pace, organizing into complex organizations designed to breach networks of all sizes.
“It is no longer just a hacker by himself in the basement,” said Michael Lane, senior fields solution architect for CDW-G, in a Jan. 28 session at the Future of Education Technology Conference. “There are cyber gangs out there that are essentially organized crime, where you have programmers at the bottom and people running them to develop malicious code and then distribute that code.”
A recent analysis of 4,000 CDW-G security assessments shows schools may not be ready to handle this kind of threat because of outdate or ineffective technology.
“One hundred percent of the time we were able to get access to information we were not supposed to, but we were only detected less than 10 percent of the time,” said Lane. “There are tools out there, though, that can help you detect these kinds of things when they are happening.”
JOIN THE CONVERSATION: Follow @EdTech_K12 on Twitter for continued FETC 2019 coverage.
New Best Practices to Help Faculty Improve Their Cyber Hygiene
Spear phishing has become increasingly complex. In one instance, said Lane, hackers devised a fake delivery coupon for a real Pho restaurant to infiltrate a bank’s network.
Because employees would sign up for their discounted soup with their work emails, the entire network was compromised.
One of the simplest lessons K–12 schools can learn from this is to update their password protocols.
K–12 IT teams should instruct school faculty to choose password phrases instead of a random combination of numbers and letters, or replacing letters for symbols.
Password phrases “have a much higher degree of entropy, which makes it much harder to guess,” said Lane. “It also makes it easier to remember.”
Schools should also install multifactor authentication software, primarily around their financial systems and processes critical for continuing operations, according to Lane.
There are also a number of education tools available to help teachers learn to avoid phishing scams. One software product from Proofpoint allows IT teams to send out a phishing test that automatically signs teachers up for interactive phishing detection training if they fail.
4 of the Most Pertinent Threat Areas for K–12
Before integrating security solutions, it is important to understand the greatest threats to K–12 school networks. Here are crucial elements in K–12 networks to pay attention to:
- Patching: One of the biggest issues for K–12 schools is patching, according to Lane. An unpatched server can allow bad actors who have hacked into a point in the network to move laterally, compromising the entire system. Schools should be regularly patching software or implementing automatic patching tools.
- Email: Email is the number one threat vector schools face. Schools should be implementing anti-phishing tools beyond what is built into the email products, said Lane.
- Firewalls: Next-generation firewalls can filter on a much deeper level, including who the user is and what they are accessing. This means IT teams have much more granular control over their schools’ networks.
- Endpoint Protection: Ransomware has been replaced by cryptomining, where hackers use the processing power of a machine to harvest bitcoin. While this may not seem so bad, it still means hackers have full control. Next-generation endpoint products have advanced technology that looks at what processors are doing, what files are behind modified, and use artificial intelligence tools to prevent workstation takeovers.
Keep this page bookmarked for articles from the event. Follow us on Twitter at @EdTech_K12 or the official conference Twitter account, @FETC, and join the conversation using the hashtag #FETC.
