Schools are fighting back by investing in more security resources, increasingly augmenting their IT staffs by turning to outside help to strengthen their cyber defenses.
“When IT teams provision security, they do all the things they know about, but they can overlook some things,” says Frank Dickson, an analyst in IDC’s security and trust research practice. “As humans, we fall into patterns and processes. We don’t think from an attacker’s perspective, so having penetration testing can verify everything you do and illuminate things you miss.”
Conducting Cybersecurity Drills for K–12 District Teams
Every year for several years, Prosper ISD in Prosper, Texas, has hired third-party security experts to run penetration tests. Last school year, the 20-school district took a more comprehensive approach by turning to CDW•G’s experts to not only perform penetration testing but also develop incident response playbooks and run tabletop exercises.
“We want to make sure we’ve done everything we can, so if something happens, we are in a good spot to handle it and resolve it quickly,” says Donna Eurek, the district’s network services director.
During the penetration test, CDW•G’s engineers tried to hack into the district network through internal brute force attacks. Afterward, they produced a comprehensive report on how the IT department could improve its security.
“We spent a lot of hours digging through the results,” recalls De Velasco.
Prosper ISD — which has one cybersecurity administrator on staff — learned that while the IT staff was good at regularly patching major applications such as Windows servers, it needed to do a better job patching less frequently used software across the district as well as documenting and disabling unused accounts, Eurek says.