Privacy & Security

Cyberattacks Are Up. The Feds Must Help Schools Cope, Watchdog Agency Says

By Alyson Klein — November 17, 2021 2 min read
Gloved hand reaching into a laptop screen hacking someone's account.
  • Save to favorites
  • Print

The U.S. Department of Education’s more-than-a-decade old plan to help protect schools from digital threats needs a rethink, as cyberattacks rise and new threats emerge, concludes the Government Accountability Office, Congress’ watchdog arm, in a report out this month.

Since 2010, when the plan was last updated, K-12 schools have dramatically ramped up their use of education technology, leaving their systems more vulnerable to threats. That’s been particularly true during the COVID-19 pandemic, which forced schools to switch over to online learning at lightning speed.

“The efforts that the schools had to go through last year to convert from in-person to virtual learning put a lot of strain and stress on the technology services that they either had or they needed to acquire very quickly,” said Nick Marinos, a director on the GAO’s Information Technology and Cybersecurity team in an interview with Watchdog Report, the GAO’s podcast. “In other cases where we’ve seen entities have to rush to put forward technology, cybersecurity often can be an afterthought or something that might not get attention until, unfortunately, an attack or an incident occurs.”

These attacks can carry a high price tag. Marinos cited a school district in Florida that was targeted by a criminal group in March. The group encrypted the district’s data and demanded a $40 million ransom to decrypt it. And back in 2019, a Kentucky school district got a fraudulent email that appeared to be from a vendor. The school ended up paying a $3.7 million invoice which went directly to an attacker.

All-in-all, 408 attacks were publicly reported in 2020, an 18 percent increase over the previous year, according to data from the Cybersecurity Resource Center that was cited in the report.

The department has taken some steps to help schools get their arms around these threats, GAO reported. The agency published guidance to help students and parents prepare for a cyberattack. It also put out guidance for schools on best practices in online learning. And it has provided schools with some resources, including training drills that have already been successful in other districts.

But “even though federal agencies do already provide a variety of products and services to help schools protect themselves against cyber threats, it’s time for them to ensure that these efforts meet current needs,” Marinos said.

Specifically, the report asks the Education Department to consult with the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA) to figure out how to update its plan for K-12 schools. And the GAO called for the Education Department to consider whether additional guidance is needed to protect teachers, parents, and students from cyberthreats.

The Education Department, which reviewed the report before it was published, agreed with the GAO’s recommendations, but expressed some concerns about its lack of authority over security standards for school districts.

Events

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Budget & Finance Webinar
Innovative Funding Models: A Deep Dive into Public-Private Partnerships
Discover how innovative funding models drive educational projects forward. Join us for insights into effective PPP implementation.
Content provided by Follett Learning
Budget & Finance Webinar Staffing Schools After ESSER: What School and District Leaders Need to Know
Join our newsroom for insights on investing in critical student support positions as pandemic funds expire.
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Student Achievement Webinar
How can districts build sustainable tutoring models before the money runs out?
District leaders, low on funds, must decide: broad support for all or deep interventions for few? Let's discuss maximizing tutoring resources.
Content provided by Varsity Tutors for Schools

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Privacy & Security Quiz
Quiz Yourself: How Much Do You Know About Cybersecurity For Schools And Districts?
Answer 6 questions about actionable cybersecurity solutions.
Content provided by FlexPoint Education Cloud
Privacy & Security What Schools Need to Know About These Federal Data-Privacy Bills
Congress is considering at least three data-privacy bills that could have big implications for schools.
5 min read
Photo illustration of a key on a digital background of zeros and ones.
E+
Privacy & Security A New Federal Taskforce Targets Cybersecurity in Schools
The “government coordinating council" aims to provide training, policies, and best practices.
3 min read
Illustration of computer and lock.
iStock / Getty Images Plus
Privacy & Security Q&A Why One Tech Leader Prioritizes Explaining Student Data Privacy to Teachers
Jun Kim, the director of technology for an Oklahoma school district, helped build a statewide database of vetted learning platforms.
3 min read
Jun Kim, Director of Technology for Moore Public Schools, poses for a portrait outside the Center for Technology on Dec. 13, 2023 in Moore, Okla.
Jun Kim, is the director of technology for the Moore school district in Moore, Okla., He has made securing student data a priority for the district and the state.
Brett Deering for Education Week