What is Needed for Cybersecurity for Schools?

Schools are a prime target for bad actors when it comes to information security and cybersecurity. Because of older infrastructure and decreasing budgets, schools and universities are failing to defend against attacks from these hackers. A mere phishing attack can cost a school millions of dollars if proper cybersecurity measures are not taken.

Despite all of that, it’s more important for schools to improve their cybersecurity posture than ever before. With the increasing pressure from artificial intelligence and the advancing technology that bad actors are using, it is becoming easier for them to hack into school and university networks. Fortunately, normal cybersecurity procedures can go a long way with many institutions, including schools.

The danger of a cyberattack extends beyond just K-12 grades, though. Universities have also fallen under attacks and have been shut down because of them. Many universities have proper budgets for cybersecurity, but it’s still important for IT systems and networks to be updated with the latest cybersecurity frameworks and practices.

The Statistics

According to CISA, cyber attacks on schools happen so often that one happens each day. There are many schools that have fallen victim to these cyber attacks, some of which have had to shut down for days. These attacks not only affect the school, but they can harm the students, family of the students, and the faculty itself.

There were 5,461 ransomware attacks across the world in 2024, resulting in 195.4 million records being stolen and many of them being in the US. With the increasing attacks, it makes sense to give more money to these institutions. With the 2024 Presidential administration, however, money has been cut from many schools across the country.

While it is a dangerous situation, there are a few things that can be done. CISA has provided many resources that can be used to bolster cybersecurity and information security across schools, school districts, and universities.

The CISA Recommendation

These information security standards should be effective across all academic institutions. CISA has listed cybersecurity performance goals following the NIST cybersecurity framework. This framework has been updated to 2.0 recently, which should be followed across all critical institutions of the United States.

1. Invest in the most impactful security measures and build toward a mature cybersecurity plan.

This is probably the most important of the three recommendations. The most efficient cybersecurity plans don’t have to be the most expensive options. There are plenty of things you can do to make the plan, the biggest thing being multi-factor authentication (MFA). Because funds may be tight due to budget constraints, a single sign-on (SSO) solution may also need to be considered.

• Recognize and actively address resource constraints.

There are many free and low-cost resources across the Internet, provided by many entities such as CISA or the NIST. The CISA recommends working with state planning committees to get involved with grants and other various programs given by the government. CISA has also developed a Free Cybersecurity Services and Tools catalog for any school to utilize.

• Focus on collaboration and information sharing.

With the expanding advancement of technology, sharing information has become easier than ever. CISA recommends schools to utilize forums like MS-ISAC and K12 SIX, but also safety centers and fusion centers for information sharing. They also recommend building a relationship with the regional CISA advisor and local FBI field office.

Cybersecurity for K-12 Schools

While government regulations are different between industries and states, it is important to know what needs coverage to be compliant. Despite that, however, there are some programs that are suited to smaller budgets which can prove to be very valuable in terms of information security.

Security Awareness Training

One of the most cost-effective and valuable services that an institution can get is security awareness training. Depending on the amount of people that need it, this is a good way to lower human error, which is the biggest weakness in any cybersecurity defense. It’s a good idea to have occasional seminars or training sessions when it comes to these things, but it can also be beneficial to do simulated phishing attacks.

While this can be for faculty, it can also be a positive thing for students. With the knowledge of the bad actors that are out there and occasional reminders to be aware, it can help the school to be more secure against these attacks. One click on a phishing link from high-ranking school faculty can cause the entire network to shut down and the school to close.

Vulnerability Assessment

While not extensive as an IT audit or a risk assessment, a vulnerability assessment can assist with finding weaknesses in a network. A third-party information security company can usually find critical issues that need to be take care of while weeding out any false positives that might show up. The normal standard for these scans is Qualys, which has become the standard in cybersecurity.

Configuration Reviews

Another low-cost option for many schools and other smaller institutions is a configuration review. These reviews can range anywhere from Microsoft 365 to firewalls where analysts review and determine if you are vulnerable or not. This goes along with reducing your attack surface, which lowers the number of points that a bad actor can attack you from. These reviews aren’t very intensive and can be done quickly and efficiently with little cost to the organization.

Cybersecurity for Universities

Despite the list above being for K-12 schools, it can also be applied to universities. However, universities usually have a bigger budget than public schools in many states. With these budgets, it is expected for many universities to have proper information security for their students and faculty. There are a few other things that these schools might need beyond the above listings.

Risk Assessment

Similar to the vulnerability assessment, a risk assessment will identify the vulnerabilities in the network that is being tested. However, the difference is that it is a much more comprehensive test, including security analysts that will go into the system to manually check for certain things, create a report on them, and offer guidance for how to remediate them.

With the risk assessment, a third-party cybersecurity firm will go through controls and other various information that the university would provide them. With all of this information, the information security firm can categorize the risks and then calculate them to be most dangerous to least dangerous. After the calculations have been made, a plan can be formed to fix these things.

IT Security Audit

While this can mean something different across many businesses and networks, IT security audits usually boil down to a check and verification of controls in a network. These controls are things that can prevent attacks on the network or data, including things like firewalls, authentication processes, and more. With these checks and verifications, a school or university can feel comfortable in their defenses.

Conclusion

While many schools and universities have fallen behind in terms of cybersecurity and information security, there are plenty of ways that they can be kept safe. Despite the lower budget, there are many free resources available to educational institutions. For example, the CISA has many guidelines and suggestions on what to do when it comes to getting information and sharing it.

However, if the budget calls for it, there are a few services that a school can employ as well. These can range from security awareness training to things like configuration reviews or tabletop testing. While not everything will be a one-size-fits-all sort of solution, there are plenty of low-cost defenses that you can put around your school and your students.

If it’s a university, extra defenses may be needed. These educational institutions may have a bigger budget than most other schools, depending on the state. Either way, there are plenty of things that a university can do to protect their students and faculty. Aside from the free resources from CISA, there are many government grants that schools and universities can take advantage of.