"Schools must foster partnerships with technology providers, cybersecurity firms, and government agencies to stay ahead of the curve."
Why this is important: When considering cybersecurity targets and threats, K-12 institutions may not be the first thing that comes to mind. Yet student records, personnel data, health records, and administrative files are all vital pieces of information that K-12 institutions maintain and risk compromising when data security in a K-12 setting is breached by a cyber threat. As previously reported in several of our publications, cyberattacks targeting educational institutions have increased, making it crucial to address this issue in a manner that not only prevents data loss, but also disruptions to the learning environment. To avoid cyberattacks and mitigate the damage they cause, this article offers various measures that educational institutions, including K-12 schools, can employ to protect their databases.
One effective step in this important work is to secure technology. Schools often operate with outdated technology and software, which makes them more vulnerable to increasingly complex cyberattacks. Due to recent moves to more remote and hybrid learning models, technology is used more in K-12 settings than ever before. While beneficial in many respects, this means that vulnerable information resides on more devices. Regular vulnerability checks can help to identify weaknesses in school networks and digital infrastructure that need to be secured. Meanwhile, strict encryption protocols for sensitive data can aid in further ensuring that even if intercepted, the data remains unreadable and secure. In addition, grants from governmental agencies such as the Department of Homeland Security are available to support the replacement of outdated technology and to implement security infrastructure upgrades.
Regular training of both staff and students is also critical for reducing the likelihood of a successful cyberattack. Required learning sessions for the individuals who use school-issued technology, or personal technology that provides access to school networks or sensitive data, equip them with the information needed to recognize cyber threats and react appropriately, including by immediately reporting related concerns to a designated school official. Educational institutions can also implement a comprehensive technology security plan to ensure all constituents know how to respond in the event of a cyber threat. In addition, while reliance on third-party support for data storage needs may be acceptable, it is imperative that institutions first vet their vendors’ data security policies and practices and establish an agreement that ensures the vendors’ use of any required technical safeguards and prompt notification of any threatened or actual data breach, among other obligations.
By adopting proactive measures to secure critical data and information, educational institutions can avoid costly reactive solutions and better manage their already limited budgets. The solution to increased cyberattacks against K-12 schools is not a one-time fix. As technology evolves and the threats become more elaborate and harder to recognize, the cybersecurity measures that educational institutions implement must be stronger to respond in kind. Like all educational institutions, K-12 schools must prioritize cybersecurity and continually update their security measures to avoid cyberattacks. --- Nicholas A. Muto
