Privacy & Security

Schools Aren’t Doing Enough to Protect Their Networks, Top Cybersecurity Official Warns

By Mark Lieberman — December 03, 2020 3 min read
Images shows a symbolic lock on a technical background.
  • Save to favorites
  • Print

The nation’s top cybersecurity official during a Senate hearing Wednesday urged K-12 schools to take advantage of federal resources for safeguarding their networks and lamented that only a small fraction of schools have done so.

Only 2,000 of the 13,000 U.S. school districts have signed up for free membership in the Multi-State Information Sharing & Analysis Center, which offers government organizations, including school systems, network vulnerability assessment, cyberthreat alerts and other related services. Only about 120 schools are using a no-cost federal service called “malicious domain blocking,” which helps prevent IT systems from connecting to harmful web domains.

Those numbers were shared during a U.S. Senate subcommittee hearing Wednesday afternoon by Brandon Wales, acting director of the Cybersecurity and Infrastructure Security Agency, a standalone federal agency overseen by the U.S. Department of Homeland Security.

“How do we build a national community with the school districts to get them focused on the security aspects related to their networks that are not going to go away even after the pandemic is over?” Wales said.

Even a minimal effort to strengthen cybersecurity could make a big difference for a school district or other government organization, Wales said.

“Ransomware operators are looking to make money quickly, and they are going to look for whoever is the most vulnerable,” he said. “With the bare minimum level of cybersecurity, there is a good chance that the ransomware operator is going to go on to the next victim.”

Wales assumed leadership duties at CISA on Nov. 17 after President Trump fired Christopher Krebs, the agency’s director. Krebs had raised Trump’s hackles earlier in November with a statement affirming the integrity and security of the 2020 presidential election, which Trump lost but has refused to concede.

U.S. Sen. Maggie Hassan, D-N.H., who organized the hearing, said the urgency has “never been greater” for stronger federal support for cybersecurity. Possible solutions, she said, include a grant program for state and local governments and improved information-sharing between the federal government and schools.

The hearing also included comments from Leslie Torres-Rodriguez, the superintendent of the Hartford school district in Connecticut. She delayed the start of the school year by one day in September after a ransomware attack temporarily shut down crucial systems, including the district’s transportation network.

“Two weeks later, our systems were still not yet fully operational and the costs to address this problem, financially and in resources and staff time, have been significant,” Torres-Rodriguez wrote in her prepared testimony.

The district is now in the process of restoring more than 70 terabytes of data, which has entailed shutting down all servers and drawing from backups.

Perhaps even more debilitating, the cyberattack also required the district to restore to factory settings every digital device that had been connected to the network at the time, Torres-Rodriguez wrote. The district had planned to distribute one laptop for every student in the district, but instead had to divert many of those devices to staff members, delaying efforts to ensure every student can access schoolwork during part- or full-time remote learning.

“We serve communities that have concentrated levels of need,” Torres-Rodriguez said during the hearing. “Every minute, every day matters to us in terms of having access to instruction and other social emotional supports.”

Hartford is one of many districts, small and large alike, that have seen the daunting task of maintaining instruction during a devastating pandemic further impeded by cybersecurity threats. Schools in Baltimore County resumed instruction Wednesday after three academic days were canceled due to a “catastrophic” hack. Huntsville City Schools in Alabama have suspended classes and sent on-campus students home for the rest of the week after an apparent ransomware attack.

For more on the cybersecurity challenges schools are facing, read Education Week’s coverage from earlier this week, and its special report on the topic from earlier this year.

Related Tags:

A version of this news article first appeared in the Digital Education blog.

Events

This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
IT Infrastructure Webinar
A New Era In Connected Learning: Security, Accessibility and Affordability for a Future-Ready Classroom
Learn about Windows 11 SE and Surface Laptop SE. Enable students to unlock learning and develop new skills.
Content provided by Microsoft Surface
Classroom Technology K-12 Essentials Forum Making Technology Work Better in Schools
Join experts for a look at the steps schools are taking (or should take) to improve the use of technology in schools.
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Budget & Finance Webinar
The ABCs of ESSER: How to Make the Most of Relief Funds Before They Expire
Join a diverse group of K-12 experts to learn how to leverage federal funds before they expire and improve student learning environments.
Content provided by Johnson Controls

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

Privacy & Security 'There Are So Many Issues’: Why Schools Are Struggling to Protect Student Data
While efforts have been made to protect student data, there are still troubling examples of data breaches.
8 min read
Illustration of numerous computer windows overlapping with creepy eyeballs inside the close, open, and minimize circles within the various window screens.
Daniel Hertzberg for Education Week
Privacy & Security Download Be Ready When Parents Ask These 7 Questions About Data Privacy
These questions offer a roadmap for issues that K-12 leaders should be prepared to discuss.
1 min read
Data security and privacy concept. Visualization of personal or business information safety.
iStock/Getty Images Plus
Privacy & Security Cyber Hackers Attack Schools More Often Than You Think: 8 Ways to Stop Them
Experts say there’s no magic formula for districts to completely protect themselves from these incidents, but there are ways to reduce risk.
1 min read
Image of a red glowing caution sign over a dark field of data.
Getty
Privacy & Security What Schools Can Learn From the Biggest Cyberattack Ever on a Single District
Hackers infiltrated a New York City school district vendor, jeopardizing personal information for 820,000 current and former students.
2 min read
Gloved hand reaching into a laptop screen hacking someone's account.
iStock/Getty Images Plus