So I wanted to bring up in discussion today, it's Friday that we're doing a recording
of our podcast, but it's also St. Patty's Day.
And not that you guys have to be Irish to wear green, but and we can't do a show of
hands, but I'm going to go around the virtual room and ask how many of you guys are wearing
green.
I'm going to go first.
I actually have a green sweatshirt and green pants on.
So I am full on going to be Irish today and say, let's go.
Kelsey, what about you?
I was really hoping you were going to do that with an Irish accent.
So maybe next time, maybe next time.
Yeah, totally.
Right.
So for anybody listening, can't see my socks, obviously, but I'm wearing two different
pairs of Irish cat socks because I couldn't say pick a single pair.
One of them says Toth of Meowning to you, which doesn't really work, but it's here.
It's green.
It's got orange cats.
What about you, Matthew?
I, as you guys know, it's very early in the morning for me and I did forget.
So no, I'm not wearing green today.
Not appropriately caffeinated is what I heard.
Yeah, that's still happening.
What about you, Todd?
I am wearing a green polo and that's all I have, but slighty.
And I am not.
I've got a kid that had a dirty diaper that was in a rush to get out the door and I just
took care of it and threw on all my clothes and without even a thought that St. Patty's
Day was today.
So I'm sure my family will give me crap later or try and pinch me or something.
Don't you have like a little green swoop on your quarter zip?
Probably not.
Maybe.
How about this?
My forest green on my hiking shoes.
We'll say that's green enough.
It counts.
It does.
I guess I should have promised this that you didn't necessarily have to have on green to
be part of the Cool Kids Club today, but that's all right.
Maybe if you put some green drops into your coffee, then we can say we had green coffee
even though it won't show up.
But then we'll say we're drinking Irish coffee.
It's not black coffee.
It's just really, really dark.
Yeah.
All good.
I will make sure to get that we get this subject at hand here because today our podcast is
very real that we wanted to definitely educate our community in regards to protecting the
education industry and best security practices.
So as always, we're going to kick it off.
This is our CIT Tech for Business podcast.
And today I have Matthew, who is our governance risk and compliance analyst, along with Nate,
who is our director of cybersecurity and virtual CISO, Todd, who is our chief operating officer
and CISO.
And then, of course, lovely Kelsey and Tara as part of the marketing team.
But first of all, I'm going to kind of get us started.
I want to just to talk about this, why it's important.
We're here in the Twin Cities and we had a school district that had a ransomware attack.
So I wanted just to bring this up in conversation and just kind of start some of the best practices.
So let's get started about that.
Who, Eeny, Meeny, Miny, Moe, who wants to take that of just briefly introducing why
cybersecurity is really important in the education industry?
I'll take it, I guess.
All right, Nate, fire away.
Yeah.
So in the education industry, essentially one of the main things here is schools, and
this is going to come back to some of the challenges as well, but schools typically
really struggle with protecting networks, protecting data, and it's due to a lot of
different challenges.
It could be funding, administrative challenges, whatever it is.
But the critical thing here is schools do have a lot of sensitive data, right?
And there's a lot of components that you need to protect.
So you're dealing with kids' health records, medical records, maybe you have an on-site
nurse or anything like that, all the social security numbers.
And protecting the data of minors is extremely important.
And oftentimes, again, these are hosted either on-prem in some type of cloud solution that
someone can have access to.
So a lot of care needs to be taken to protect that.
And then ransomware is just a recent one.
We can cover a little bit of what that looked like.
I'll probably let someone else talk on that if they want.
But one component of that was data was exfiltrated or taken out of the network, and it does contain
a lot of sensitive info along the way.
So I don't know, Todd or Matthew, do you want to talk a little bit about the school district
incident?
Yes.
Well, not this one, yes, but also a little bit more background.
I mean, Nate covered a ton of ground there, and I just kind of wanted to reemphasize a
few things is they did get attacked.
One of the things that I wanted to say is it's a great example of nobody's safe, right?
You may go out to school.
How likely is that?
According to the FBI, 57% of all attacks go against education institutes.
So if you're curious if they're of interest, the answer was absolutely yes.
And Nate covered a lot of reasons why that is.
There's a lot of sensitive data that are within the walls or those institutions.
But part two is Nate hit this too, is that they unfortunately tend to lack funding.
And we can get into the whys of that in a few minutes.
But the big pieces that I just wanted to highlight briefly is the maturity level of a lot of
schools, unfortunately today, just isn't as where you would expect it to be.
A lot of businesses are quite a bit ahead of where the schools are.
Now, it's not all bad news, but we can touch on some of the good things that are going
on with a lot of schools as well.
But the biggest reason, in my opinion, is a lack of funding, which drives a lot of the
other things that we're going to get into as well.
Yeah, I'd say that I think there's a bit of a logical fallacy as well.
I think breaking down now, but it followed the same things I used to see in small businesses
of well, we're not a target.
And so people would assume that they were safe because they weren't thought of as holding
the type of data that was valuable.
And I think that that's why we're seeing that uptick in more recent years towards education,
towards the education field in general.
It results in them being hit and potentially being hit harder because they aren't prepared
for it at all.
Yeah, maybe the one other thing I'd add to this before we start getting a little deeper
is that this is nothing new.
So attacks against the schools, this is a new trend.
So if you even go take a look back in, I believe it was 2019, even the full state of Louisiana
issued a state of emergency because a ton of their schools were getting hit with ransomware.
And there's California and a couple of other places that issued state of emergencies.
But again, that was what is that now four years ago, five years ago, somewhere around
there, depending on when those came out.
So we're only taking that one example of a recent one because it's so close to us to
bring this back up.
But yes, ransomware has been affecting school districts and not just ransomware.
That's an easy one to pick on.
Security threat actors have been focusing on schools for a long time.
Yeah, I mean, again, this is probably a little bit of a rabbit hole that we don't necessarily
need to go down.
So I'll keep it brief.
But I was just kind of thinking more about the comments about not having funding and
whatnot.
Obviously, the vast majority of funding for schools either comes from the federal government
or it comes from referendums.
And referendums tend to be my neighborhood is growing like crazy, we need another school
or there's a technology upgrade.
Is security a surprise?
Security does become a priority.
Unfortunately, it's all reactionary.
I was kind of also going down the thought process.
If you look at how if you're in the education industry, you're aware of what e-rate is,
and it's an additional way of getting additional funds to help pay for some of the technology
that the schools need.
Even that is dated.
If you look at it, that's all built around trying to build out infrastructure so you
have enough internet connectivity to supply the schools with what they need, whether that's
wireless access connectivity itself.
When I say it's dated, it is still relevant, right?
The schools need to keep up with it and so on.
But it's interesting that that funding was put in years and years ago, and it really
has not evolved along with the security threats that schools are facing.
So I did want to talk a little bit about it.
So we talked the budgeting with them maybe not necessarily having the funding, but let's
say that there is funding available.
What are some of those best practices that they can start with?
I know we talk heavily about MFA.
So obviously, I want you guys to talk about MFA, multi-factor authentication, key number
one, basic level, but let's build upon that.
So what else can they do to kind of help protect their environments?
I'm going to take a real quick first pass at it.
I mentioned at the intro that there is a lot of good news for schools.
There is a lot of stuff in place.
So I don't want it to seem like there is no hope and they aren't doing a lot of good things
because they are.
There's a lot of really things that have been put in place over the course of years, like
physical security typically is very, very strong in schools.
Now there are other things that would counter that statement, right?
I mean, you see all kinds of issues with people being able to get into schools and all kinds
of other threats that are outside of the cybersecurity world.
Now typically, most schools have a very strong foundation for physical controls.
The doors are locked.
You get stuck in a man trap when you first enter the doors.
You have to sign in.
You have to validate who you are.
You're typically escorted through the building, et cetera.
So that is almost always incredibly well done.
Again, they do have funding, so they're very good about doing their backups.
They do have very good baseline policies in place.
And then typically most schools, just like most organizations, have a very strong exterior
posture.
So when the outside looking in, you really don't see a lot of stuff going on with schools.
You may see a web portal.
You may see a VPN, but usually don't see a whole lot.
So there are really good starting points for them, which is a good baseline and a good
place to start.
And I just want to acknowledge that most of that is in place for most organizations.
One of the things that I'm going to start with, I agree with what you said with MFA
and a bunch of other stuff, and we'll dig into that.
But one of the places that I would typically start, and it's fairly low hanging fruit,
fairly low effort, and this will be probably somewhat near and dear to Matthew's heart,
is I'd start with your security policy.
You need to state what you do and how you're going to do it.
And that could be some really basic stuff like when the crap hits the fan, who do you
call?
Who is your main person and who is their backup?
What is your password policy, et cetera?
Those are some areas.
Like I said, it's not a huge effort to do it.
There's tons of templates available that you can get for free as a starting point.
And if you have a baseline, then you can start to build your program around that.
Yeah.
The computer incident response plan, we have a podcast on that already.
Great way to kind of know and have a path to follow if something like this were to happen.
On top of that, you mentioned password policies.
That ties in really well with MFA, with these types of things that you're building.
The more documentation and the more policy you have around how process and how actions
should be taken and what the posture is of the organization, that's what we call your
maturity level.
The more of it there is, the more in-depth it is.
And those are the things that, in my opinion, catch the most stuff.
Because if you have people who are aware of what's going on, aware of what they should
and shouldn't do, then they're far less likely to accidentally click on something that could
trigger an event like this.
They're going to be aware that they need MFA and maybe an unexpected MFA token pop-up is
going to be treated the way it should be.
Obviously, I just kind of jumped into an MFA thing there.
I'll let Nate dive into that a little more.
The clearer you are with what the rules are, and this is obviously the education industry.
They're right there.
You've already got a lot of them written down.
When it comes to this side of things, the clearer you are with what isn't expected,
the better it's going to be for everyone.
I'm going to probably go even higher level with my recommendations because Todd gave
a great overview of a lot of different components there.
He said that most schools have this.
The way that I'm going to bring this even higher is say, no schools are similar or identical
in what they have today.
Oftentimes what we'll see is some schools have been able to influence greater cybersecurity
budgets.
They have great tools in place.
Then we go into other schools that are years behind on their security, posture, and maturity.
Same industry, very different approaches that need to be taken.
I'm going to call out a link that we can link out later, but it's stopransomware.gov.
It's right from CISA, which is a government agency.
It's also a cisa.gov slash stopransomware.
The reason why I bring that up is they have a ransomware readiness self-assessment tool
that you can go through.
The reason why I bring that up is identifying what you have today or what you don't have
should be the first step before you go dig into implementing multi-factor or policy revisions
or anything like that.
It's what do you have today and what don't you have?
Then you can start developing that plan, which ties everything back together.
Some schools have great multi-factors, some have none.
That's my recommendation.
Yeah, I was going to state that too.
I was going to circle back and go, I think starting with some sort of assessment, whether
it's a self-assessment or you bring in some experts to help you with it, is a great way
to start.
If you don't know where you are, you don't know where you're going, right?
One of the other things that Nate touched on in that overview is it also can help you
with the influence if you bring in somebody.
I'll just kind of tip my hand a little bit.
CIT does this often with a lot of schools.
Essentially what we're coming in and saying, this is what we see, here's what we're seeing
other schools do, and we can start to help influence at that level and saying, here's
where you're at, here's how you measure up to comparables, and then start to build out
the plan.
That helps with the budgeting mindset, right?
That starts to build out the long-term plan.
That can be doing things like policies, procedures, start looking at what tools are in place.
So multi-factor authentication, absolutely critical for everybody.
I don't care what industry you're in, it's absolutely critical.
But again, schools may not have them in place.
Maybe some of the legacy tools they have may not be in place.
But you can start to map that out and saying, this tool needs it.
When you're trying to access student information, you need to have X, Y, and Z.
So I 100% agree that the assessment is incredibly important.
This is a little bit of a little tangent that we probably should bring in a little bit later,
but I'm going to bring it up just because I did mention the government.
Something that's really, really powerful to our Wisconsin school districts, when you're
talking about how do you start preparing for that, right?
So Matthew was talking about the incident response plan and everything like that.
The government in Wisconsin has a great cyber response team.
So if you ever have a security incident, call them up.
They will send the FBI and CISA and all that fun stuff there to help you along the way.
So if you didn't know about that, Wisconsin, you're in a great position having the government
help you out.
Minnesota, while I love many, many things about Minnesota since I live here, that is
one where I am envious of Wisconsin.
Yeah, there's also been funding made available to Wisconsin schools that we've seen a lot
of them take advantage of, whether that's starting with assessments or whatever.
So diving in a little bit further, I know we started out the podcast going, what do
you do about it, right?
So major problem, ransomware, starting out figuring out where you're at.
That's typically an assessment, then starting to build your plan.
Plans include the policies.
They include MFA like we talked about.
Other things that we typically do as we start to get engaged with schools or even any industry,
quite frankly, is we start to go through a process of defining what risk exists.
You can say risk is ransomware.
We know how much it costs.
We know what it takes to start to mitigate it.
Then we start to build out how you would start to tackle that.
That framing up is typically on a handful of things.
How big is the risk?
What does it take to do it, whether that's man hours or woman hours, and cost and so
forth.
So you start to walk through that and go, what does that typically look like?
Things that would definitely be on the radar, cybersecurity training and simulated phishing
would be extremely high on my radar.
It's not expensive.
It's very easy to do, and it increases awareness almost immediately.
Matthew, I don't know if you had anything there, but otherwise, I guess from my experience,
typically what I see is a lot of school districts.
I mentioned this a little bit before, is they have a very, very strong exterior posture.
But then once you move in, it's very soft and squishy and easy to compromise items internally.
We see a lot of this is challenges within the classroom.
For example, a lot of the staff, when they're in the classroom with the students, they don't
want the screen to automatically lock because it might give them an extra couple of minutes
that they need to log back in.
So the kids will hop on the computers or things such as even some of the most robust school
districts, they don't know if the student Wi-Fi is properly segmented from the internal
network.
Oftentimes, it's not.
So better network segmentation is going to be something really critical.
I was just working with a school district, I think last month, that all of their students
were on the same or had access to the internal network.
And that's also where all their backups were.
That's extremely dangerous.
So kind of going back to the identification, that's one of the things I would at least
consider.
It's just so important to better segment your network.
Matthew, I think you are on mute, but great topic.
Thank you.
There we go.
One of the things that goes with the funding that we've talked about is that we've said
we do a lot with the education industry, with these schools.
And the reason for that is that the funding that's being used, your internal team is the
one doing all of this work.
So when you need something more than what you have in place, organizations like CIT,
we do have security teams, we can assist in those locations.
And that's why it's easier and significantly cheaper in some cases to pull in an organization
like us to assist in that field.
Depending on how many people you have on your IT team, it may just be too much for one,
two, even five people to handle depending on the scope.
And trying to have that number of people, however many it is, handle all parts of an
internal IT system can be not just overwhelming, but cause burnout, can cause a fear of rushing,
feeling like things have to get done as quickly as possible rather than taking the time to
do them in full best practices.
There's obviously a lot to that.
Everyone's doing the best they can.
But this is why services like this exist.
It's so you can have help that isn't having to hire someone else who is a specialist in
that field.
You can do consulting work.
You can have someone come in and assess and do that, review it, provide some guidance
or assistance, and then step back.
And that's a really great way just in general to find out where you are.
We do this ourselves.
We have audits that we do.
We have reviews done.
Vulnerability scans are incredibly useful.
These help you find not just the posture from what you're looking for on your side, but
how it looks to other people coming in.
And that can be a little scary.
I know there's been a couple of times where I've seen people say they don't ever want
to see how it looks to other people.
But those are exactly the times when you need someone to.
Like I said, everyone's doing their best.
None of this comes with judgment.
It's all about guidance and what can be done better.
I'm going to just quick ride off your whole staffing conversation.
I know that we could go deep into that.
But I do want to just quick make a call out saying, if you are in any form of district
leadership, please take the time to have a little empathy with some of your IT staff
if they are feeling burnt out and stressed.
And then also, oftentimes it's the IT staff that are trying to make recommendations for
different cybersecurity or different products or trying to push for some type of assessment.
Maybe just take some time and ask them, hey, where do we stand on our assessments for cybersecurity?
If you haven't done that already.
And empower them to start looking into that.
It's free, but it's a great way to help empower and start the conversations rather than having
to influence up.
Because that's often one of the main challenges there is just be receptive to them influencing
you as well.
Yeah, the one last thing that I would throw on the staff is schools have a tendency to
try to delay as much as possible to the summertime because that's when the schools, quote unquote,
aren't busy.
Your IT staff is already busy during the summer.
That's when they actually get to, quote unquote, do the work.
So that's when they're doing the system revisions, they're upgrading, whatever it is, closets,
network switching, access points, you name it.
They've got a full slate coming into the summer.
So if you're just thinking, well, we'll deal with that in the summer, they're already swamped.
So just be cognizant of what you're asking your teams as you're going through it.
If you're one of those teams, we feel you were with you 100% and we often help out during
the summers too, because that's when they need the help the most.
So as we're kind of walking through this, we kind of did a bit of a dive into some of
the challenges that are out there.
And one of the larger challenges that we typically see is friction that the security tools put
in place, right?
So things that we almost inevitably see as a lack of multifactor, we often see passwords
that don't expire.
Nate already mentioned whether the network is segmented or not.
Those are things that are typically not done.
Obviously, if you're looking for examples, things we want to do is we want to segment
the network, the students shouldn't be on the same network as the staff.
So they shouldn't have access to any of that PII, that personally identifiable information.
We often see that they almost never have lockouts on their PC.
So the teacher may have unbelievable amounts of access to data, and they don't like that
their computers lock out when they walk away from them.
There's ways to get rid of friction too.
But because of that, the school just says, well, that's fine.
We'll just leave them open, which is a terrible idea.
There's other things that we would typically see that, again, kind of fall down that path
that we would see that you need to go through.
Ultimately, where I was going with it is there is ways to limit the friction that comes up
from some of these tools.
For example, passwords, where I said the passwords tend to be terrible.
We typically recommend doing a very long, strong password and then changing it once
a year.
Teachers hate having their passwords changed.
However, I've worked at schools with schools in schools, and I can tell you that when they
go on their summer break, so from when they're gone from June until September, they've forgotten
their passwords.
So it's a great time to just say it's time to roll the password.
Let's get it updated September 1st, and you can start the new year fresh.
That's an easy way to start to kind of remove the friction that goes with it.
Other things that we typically see is when we start to put multi-factor in, you'll get
push back from the teacher saying, well, I own this phone, you don't, therefore I'm not
going to put the tool on my phone, or you have to pay for it.
There's ways around that too.
You can look at biometrics or physical keys or something along those lines to, again,
help remove the friction that goes with it.
And then the last other point that I wanted to dive into, and I'll be quiet for a little
bit, is we often see shared administrative accounts.
So historically when you look at the schools, they may just have school district admin as
the name of the account, and all of them use it.
We definitely recommend getting rid of that too.
Everybody should have a daily user account that is no admin, and then when they need
it, they've also got an additional account that they can use for the accelerated administrative
privileges or look at some sort of privilege access management tool set, which would also
reduce friction, but it also has a cost associated with it.
That's a great list.
Thanks.
I was going to mention the privilege access management as well, but again, the budgets
are the main thing, so that's why I really just wanted to focus on the free initial things
to get started.
I hope that more of this falls into e-rate down the road, with everything starting to
get more and more of a requirement.
Unfortunately, it's just not there yet.
I did want to mention, I think too, a lot of what you all had stated here today is pretty
basic if we look at it from a wider lens of just taking a moment, so you know where you
are and then can kind of take those steps forward.
So I like the fact that we're able just to say, at the base level, here's where we're
at and where we need to go and then pick those off as you can and just making those small
little changes into that because they do have a bigger impact globally across that.
So I know one of my jobs is here is to make sure that we kind of stay as far as the time
goes.
So we will be looking to kind of wrap up this podcast.
I wanted to make sure we left enough time for everybody to kind of get in their last
comments as we close out the segment.
But anybody want to go first on some closing thoughts for our education community?
Yeah, I feel like we've kind of danced around something a little bit.
We've kind of mentioned it without really giving any guidance, which is the education
industry doesn't have any cybersecurity frameworks that they're required to follow.
They aren't forced to follow anything like the finance industry is.
And while I think it could be great, I know that having something like that as a framework
you have to follow could be, I don't want to say debilitating, but very difficult.
So instead, I want to recommend finding something that works for you.
The NIST cybersecurity framework is a great place to start.
It's just a I think it's 120 ish questions to find out how you fit on their scale.
You can also build up to some of the larger ones if you want.
If you want to look at the NIST 853 guidelines.
You know, there's more options out there.
But starting with something like the NIST CSF is going to give you a guideline to see
what the essentials could be, what it could be that you can follow and however you find
yourself on that, that's your base.
That's where you can start looking at what to do next.
So just as a little guidance there, it's not just Google cybersecurity best practices.
That is a great start.
Finding a standard like the NIST CSF or shout out to my home country, the Australian Essential
8, those will give you a great baseline.
I can go next and I'll let Todd wrap it up.
I was hoping you were going to say work up to NIST 800 171.
For those that aren't familiar, it's a massive NIST for the federal government and everything.
So I was going to say FFIC and I thought that might be too far.
Yeah, it's a massive list.
I guess my closing comment is going to be kind of what Taira touched on at the last
little component is we talked about a lot of these basic recommendations.
I love the idea that it kind of follows that Pareto principle.
You put in 20% of the effort and you're going to remediate 80% of the risks.
You start with the low hanging fruit, the baby steps, and that's going to have the biggest
change to the network.
You can get deep in the data classification and data encryption, but again, if the entire
network is non-segmented, you don't have multifactor.
You didn't do the basics.
It's all for a waste.
So to a degree.
So just start with that.
Before we jump past that, what are the basics?
Just a couple items you'd recommend as those basics.
Starting with the readiness assessment.
You're familiar with that, Matthew, you talked about if you don't have some type of framework
to start navigating down.
So once you know where you stand, picking out the road that you want to drive down,
that would be picking the framework and then starting from there.
When we're talking about something like the NIST cybersecurity framework, the first two
pillars of that is identify and protect.
Work down through all the identification steps there to know what you have because you can't
protect if you don't know what you have.
And then at that point, start considering what do we actually need to protect that data
or devices or users, right?
So but again, 20% of the effort will fix about 80% of the risks there.
Yeah, I'll keep my closing comments brief.
So I think Nate and Matthew covered a lot of really good ground.
There is a lot of baselines that are covered by these frameworks, which is why that we're
mentioning them.
The last piece that I'll mention is as you're going through these things, the good or the
bad is that they do align with a lot of other things that we're seeing industry wide.
So whether you're in finance or if you're in schools, it doesn't matter.
Cybersecurity insurance is incredibly important.
And the things that they're looking for in that are exactly the things that we're talking
about.
So it's all of the things we just covered through the podcast, but it also is referencing
those frameworks and saying where do you start?
What do you need to put in place and so forth?
So there is a lot of benefits going through that as you start your journey on your security
process.
It does map to a lot of other requirements that we'll see continue to come down the pipe.
I would also anticipate at some point to Nate's comments and Matthew's is there may be some
requirements in the future.
The more of this that happens, government will eventually get involved in that.
Again, pluses and minuses, you'll be held to a standard.
The plus would be that there'll be more funding available.
So I would anticipate it's coming.
I just don't have any insights as to when.
Wonderful.
You guys all three did a great job of wrapping that up.
I appreciate that.
Thanks so much, Nate, Todd and Matthew and also Kelsey for joining us on the Tech for
Business podcast on protecting the education industry and discussing some best security
practices.
I know we went over a lot, but we're definitely we'll get this out onto our website, which
you can find at www.cit-net.com slash podcast.
Or as always, if you have any questions from our podcast today or have any additional topics,
please email us at info at cit-net.com.
And as always, too, we look forward to chatting with you guys next week.
Thanks so much.