Home Tags Posts tagged with "cybersecurity awareness month"
Tag:

cybersecurity awareness month

CybersecurityDigital Citizenship

Cyber Protection: A Basic Right

by Miguel Guhlin
written by Miguel Guhlin

Schools are laden with video surveillance cameras. Their goal is to protect children, but the effect is often the opposite. Video surveillance provides insight into what happened but doesn’t necessarily prevent it. Encryption prevents bad things from happening. Why not empower students and staff with knowledge?

The Problem with Schools and Encryption

Schools don’t often teach encryption to students and staff because it may be inconvenient. Those tasked with people and technology management have to work harder. Yet, in my experience, encryption is a critical pillar of digital citizenship. We must teach not only to protect our privacy settings but our data. And in doing so, learn the value of holding others accountable. Let’s explore how.

[Encryption] matters for children because while it protects their data and right to privacy and freedom of expression, it also impedes efforts to monitor and remove child sexual abuse materials and to identify offenders attempting to exploit children online (source).

Protect: An Essential Element

Dr. Ribble outlines essential elements of digital citizenship in this ISTE.org article. He highlights nine elements, of which one is Protect. In that overview of Protect element, he writes:

  • Digital rights and responsibilities. Students must understand their basic digital rights to privacy, and freedom of speech.
  • Digital safety and security. Digital citizens need to know how to safeguard their information (source).

At a session during the Google Summer Camp 2022, participants expressed their appreciation. They had no idea how to encrypt their own data for protection or how to send encrypted emails. But a minority of attendees questioned whether school staff (teachers, clerks) should know.

Encryption: A Basic Right?

Some argue that encryption is a basic right. It is more indispensable today than ever before. They write:

Studies show that access to encrypted communications is a human rights issue. End-to-end encryption make your messages…unintelligible…to snoops and interlopers. [They] can’t access what you’re saying—and neither can the company that offers the platform. People who once thought they had nothing to hide may realize that era is now over (source).

Who is to teach students and staff how to safeguard sensitive data if not schools? It would be easy to introduce it as a part of mandated digital citizenship training.

By taking the time to carefully communicate with staff and students the importance of protecting private data, you can minimize the threat of breaches and unauthorized access (source).

Preemptive Protection

We want our children and staff in schools to learn encryption. They must know how to protect themselves. Why do we avoid encryption instruction when we teach digital citizenship? The answer to that question reveals something about schools today.

Without encryption, none of us has a chance to enjoy limited privacy. Encryption is one of the tools we must have at our disposal. It’s also useful to companies, even though they make a living by mining our information. Encryption is as essential for the rest of us. (adapted from source).

Our schools have a thousand eyes, watching for danger. Yet surveillance cameras only show us what happens AFTER bad things occur. Encryption can prevent them BEFORE they do.

TCEA offers the online, self-paced Data Guardian course. Learn how to safeguard sensitive data in your school district. You will learn about why it is important to secure data, how to encrypt it, how to protect your passwords. You will learn the best ways to secure your data and device(s) as well as what you put in the cloud. Sign up now.

Tips to Share

Here is a short list of tips you can share with students and staff. You can find a plethora of suggestions online. CommonSense.org offers a wide variety of lessons for students. ClassTime.org offers five tips for teachers to protect student data. You can read past TCEA blog entries with tips for schools on safeguarding sensitive data.

There is plenty of data, research, and tips. What are you doing to empower children and staff with encryption?

0 comment
1 FacebookTwitterPinterestLinkedinEmail
Cybersecurity

October Is Cybersecurity Awareness Month

by Peggy Reimers
written by Peggy Reimers

October is Cybersecurity Awareness Month, as declared by President George W. Bush and Congress in 2004. Cybersecurity Awareness Month was created to help individuals protect themselves and their confidential data online. Each year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) release a theme. This year’s slogan is “See Yourself in Cyber.” 

According to their website:

This year’s campaign theme — “See Yourself in Cyber” — demonstrates that while cybersecurity may seem like a complex subject, ultimately, it’s really all about people . This October will focus on the “people” part of cybersecurity, providing information and resources to help educate CISA partners and the public, and ensure all individuals and organizations make smart decisions whether on the job, at home or at school – now and in the future. We encourage each of you to engage in this year’s efforts by creating your own cyber awareness campaigns and sharing this messaging with your peers.

They have four tips to follow to help everyone increase their protection of themselves online.

  1. Enable Multi-Factor Authentication
  2. Use Strong Passwords
  3. Recognize and Report Phishing
  4. Update Your Software

If you’d like more information on measures you can implement, check out the September 30 Lunch and Learn webinar, Recovering Lost Data and Safeguarding Sensitive Content, delivered by my colleague Miguel Guhlin. The recording is available for TCEA Members in the Recordings and Resources Group in the TCEA community. 

Cybersecurity Awareness Month Toolkit

All schools and academic institutions can receive a Cybersecurity Awareness Month 2022 toolkit from CISA which includes the following resources:

  • Ways to Create a Campaign
  • Partner Toolkit
  • Sample social media posts
  • Sample email to send to employees
  • Sample newsletter article
  • Tip sheets
  • Talking points
  • Cybersecurity 101 presentation
  • Presentation template
  • Logos and graphics

Details can be found by emailing Cyberawareness@cisa.dhs.gov.

If you’re looking for even more information and resources, check out our previous TechNotes articles:

0 comment
0 FacebookTwitterPinterestLinkedinEmail
phone, pencil, earbuds, and eyeglasses
CTO/CIOCybersecurity

Cybersecurity Resources for Planning, Prevention, and Safeguarding Data

by Miguel Guhlin
written by Miguel Guhlin

As Cybersecurity Month 2021 looms, I am reminded of two incidents that occurred under my watch as a technology director. The first was a ransomware attack due to a Yahoo email attachment. At an elementary school, the ransomware knocked the point of sale food service computers offline. The problem had hit right after lunch. But no one reported it until late in the day. Consequently, I scrambled the team and descended on the campus at 4 p.m. on a Friday afternoon. Then, the second ransomware attack came. As a result of this attack, five years of federal reporting data went missing. With a data protection impact assessment or privacy impact assessment, the issues might have been lessened. It was all preventable if only district staff had listened to recommendations.

“I don’t think there’s a school district in America that doesn’t have important digital assets sitting on a computer somewhere that needs to be protected,” said Michael Kaiser, executive director of the National Cybersecurity Alliance. “We know schools sometimes don’t like to report incidents. Responding right away and bringing in law enforcement should be encouraged.”

Source: Cybersecurity in K-12 education

Recent Cyber Incidents

In August of 2021, there were 84 cyber incidents worldwide. Those accounted for 60,854,828 breached records (source). Here are a few more in the last few months, which affected school districts in the United States:

September 2021 wasn’t looking any more promising than August. For example, at the time this blog entry was written, North East ISD in San Antonio, Texas reported a potential breach as well. Would anyone argue that there isn’t a problem?

Have You Seen This?

If you go to StopRansomware.gov, you will access a resource from the United States Government. Once there, you can access resources, a newsroom, see alerts, and report ransomware.

NBC News Reports Leaked Children’s Data

In their article Hackers Are Leaking Children’s Data — and There’s Little Parents Can Do, NBC News reported data breaches for over 1,200 school districts in 2021. Here is just some of the harrowing information from the article:

“Some of the data is personal, like medical conditions or family financial statuses. Other pieces of data, such as Social Security numbers or birthdays, are permanent indicators of who they are. Their theft can set up a child for a lifetime of potential identity theft.”

“One of those [files], still posted online, is an Excel spreadsheet. It lists approximately 16,000 students. That is, roughly, the combined student population of Weslaco’s 20 schools last year. It lists students by name and includes entries for their date of birth, race, and gender.  Social Security number is indicated as well as whether they’re an immigrant, homeless, marked as economically disadvantaged. It also flags those potentially dyslexic.”

cybersecurity week

Safeguarding Sensitive Data

What can students and their parents do? Check out some suggested steps, including freezing student credit while they are still underage.

You can also get a copy of my free guide Safeguarding Sensitive Data: Data Breach Prevention and Response Plan. It’s available as a Google Doc or an electronic ebook (ePub format). In it, you will find suggestions on prevention. You will also find policies to put into place which I developed to guide my school district’s efforts. Is your organization ready for ransomware and data breaches?

Explore Relevant Resources

In the meantime, what can school districts do? Focus on prevention with proactive measures instead of being reactionary. Most importantly, safeguard against ransomware and cyberattacks. In addition, provide professional learning for all staff on how to protect sensitive data. Finally, take the time to review cybersecurity resources and guides like the resources I provide here.

cybersecurity week

Resource #1: The Cybersecurity Workforce Training Guide

Not sure where to start? Explore the Cybersecurity Workforce Training Guide released in August of 2021. The guide helps professionals develop a training plan. It also provides over 100 training resources and certification prep courses for technical support. The guide is interactive and available online. At the very least, it suggests that this topic requires study.

Resource #2: National Standards for Districts

In August of 2021, the K12 Security Information Exchange (K12 SIX) shared resources that include protective measures every school district should put in place.

cybersecurity week

Resource #3: Cybersecurity K-12 Fact Sheet

Need assistance in selling the message? Grab a copy of the Cybersecurity K-12 Fact Sheet. It can help you explain the complexities of protecting your school’s data assets. For this purpose, it covers a wide variety of topics, including cyber insurance. Another great resource to consider is The Data Breach Survival Guide.

Resource #4: Statewide Cybersecurity Awareness and Training

Looking for a starting point aside from what has been shared above? Take a look at Texas’ Statewide Cybersecurity Awareness Training website. You may also find the Texas Cybersecurity Council resources worth looking into. As you may not know:

Texas Government Code 2054.519 State Certified Cybersecurity Training Programs requires DIR, in consultation with the Texas Cybersecurity Council, to certify at least five cybersecurity training programs for state and local government employees and Section 2054.5191 requires state and local government employees to complete a certified training program. The statute also requires state and local government employees to complete a certified training program.

School districts only need to have a cybersecurity coordinator to receive the training. A reporting form is available online.

Start the Work

Cybersecurity Month (October 2021) may be the time your organization takes cybersecurity, protecting against data breaches, seriously. If not, consequently, the next major network news source may find your district’s student confidential data on the dark web.

Did You Know?

TCEA offers an online, self-paced course to prepare you to protect your own and district data. It is geared towards individuals who may want to learn more about safeguarding sensitive data. Register now for TCEA’s Data Guardian course.

Feature Image Source

Photo by Dan Nelson on Unsplash

0 comment
1 FacebookTwitterPinterestLinkedinEmail
CTO/CIOCybersecurityTechnical Support

Cybersecurity Month: Resources, Data, and Information for K-12 Settings

by Emily Horn
written by Emily Horn

October is Cybersecurity Awareness Month! CISA and the National Cyber Security Alliance are keeping with the theme of “Do Your Part. #BeCyberSmart.” If you haven’t already, I would highly recommend checking out their resources for this month. They have tip sheets and one-pagers galore offered in many languages. They also have six resources available for kids on cybersecurity, which are fantastic. CISA‘s promotion and outreach this month will focus on being “Cyber Smart” (Week 1), phishing (Week 2), cybersecurity careers (Week 3), and “Cybersecurity First” (Week 4).

Cybersecurity and K-12

Why is cybersecurity becoming more and more of a “hot topic” in K-12? The 2021 EdTech Leadership Survey Report from Consortium for School Networking (CoSN) states:

“Given that the FBI, [MS-ISAC], and CISA jointly stated that K-12 is the most targeted public sector for ransomware, it is surprising that district IT leaders do not rate this risk higher.”

Whoa. I had to read that twice. The most targeted public sector for ransomware? This statement is in response to survey data indicating that cybersecurity threats, while a top priority, are generally underestimated by district technology leaders. In fact, this report says, “The vast majority (84%) don’t rate any cybersecurity threat as high risk.”

Budget challenges and this underestimation of the severity of threats make schools and districts vulnerable. Not only that, but the report found that 77% of districts do not have a full-time employee whose work is solely focused on network security. Take a look at the top challenges according to the CoSN report.

cybersecurity K-12
Table from CoSN Report

What Does the Data Say? 

In addition to the 2021 CoSN EdTech Leadership Survey Report, data from the 2020 State of K-12 Cybersecurity: Year in Review (K12 SIX) was released in March of 2021. This data showed that moving to remote learning put schools at significantly higher risk of cyber crimes. As a result of this move, cyber incidents rose drastically in the late summer and early fall of 2020.

cybersecurity incidents
Data from K12 SIX Report

Based on their data analysis, K12 SIX identified four major factors for this swell of occurrences: 

  1. Increased reliance on devices
  2. Devices used during remote learning being brought back into schools
  3. IT staff being unable to actively service devices used during COVID-19
  4. More focused efforts by threat actors during vulnerable times of the school year using more sophisticated methods

In this study, they also identified five trends in data:

  • Data breaches involving the personal information of both students and staff were the most reported type of incident.
  • A new kind of cyber threat emerged during COVID-19– class invasion– which was used to enhance and propel other incidents like denial of service and ransomware attacks.
  • Spear-phishing continues to be a problem for K-12 schools. $9.8 million was stolen from one school district alone in 2020, with the average amount being $2 million since 2016.
  • Larger schools in urban and suburban districts with higher-income communities and districts with higher proportions of students experiencing poverty are at higher risk.

What Are the Top Threats to K-12 Institutions?

types of cybersecurity incidents
Data from CoSN Report

In 2017, the Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center published a fact sheet. This document outlines the six most common online threats for school and district networks. CoSN has also rated the top five threats. Here is a list of what the two have in common:  

  1. Data Breach
  2. Denial of Service
  3. Phishing
  4. Ransomware
  5. IOT Vulnerabilities 

Both K12 SIX and CoSN refer to 2020 as a “record-breaking” year for cybersecurity incidents.  

What Do We Do Now?

Ed Tech Magazine suggests that being proactive with protocols, planning, and training staff is essential to preventing and addressing cybersecurity threats, among other measures. Additionally, CoSN agrees: “TRAIN, TRAIN, TRAIN! Make sure everyone knows security awareness is their job and who to talk to if they make a mistake.” 

Luckily, TCEA can help with this. If you know us, you know that we strive to provide educators with quality professional development in areas that are relevant and essential to the safety, well-being, and quality of education for students in Texas and beyond. That said, we have a two-day System Administrator and Technical Support Conference coming up November 4-5, and anyone can attend. Because we know cybersecurity is a top priority, we have several sponsors specializing in this area who will be available to discuss the latest and greatest trends and solutions to help with assessment, planning, and threat management. We are also offering educational sessions that address this hot topic. Take a look at the full schedule here, and if you’d like to register for the conference, you can do so here. 

Additional Cybersecurity Resources

0 comment
1 FacebookTwitterPinterestLinkedinEmail
digital citizenship week
CybersecurityDigital Literacy

It’s Digital Citizenship Week

by Andrew Roush
written by Andrew Roush

Civics classes can help students learn their rights, privileges, and duties as a part of a larger society. For that reason, we include civics in most education programs. But today, being a positive part of society includes not only our words, actions, and behaviors in “the real world” — but those online as well.

Helping anyone, including students, understand the potential and potential dangers of the online world can be tough. Luckily, many are working on spreading awareness of what it takes to be a good digital citizen.

Defining Digital Citizenship

It’s all about staying safe while staying connected and understanding the realities of the digital world that we spend so much of our time in. Being aware of one’s actions online is a lot like our behavior in face-to-face society. That is, a good citizen should also be a good digital citizen.

With so many aspects of our lives online — no less now because of restrictions to gatherings — from banking to schooling, it’s important to consider our digital behaviors, and for educators to help learners understand the potential and potential pitfalls of the connected life.

Here’s a simple, memorable definition:

“The quality of habits, actions, and consumption patterns that impact the ecology of digital content and communities.”

Terry Heick, https://www.teachthought.com/the-future-of-learning/the-definition-of-digital-citzenship/

Virtual Library offers this definition: 

Digital citizenship can be defined as engaging in appropriate and responsible behaviour when using technology.

It encompasses digital literacy, ethics, etiquette, online safety, norms, rights, culture and more.

A digital citizen is one who knows what is right and wrong, exhibits intelligent technology behavior, and makes good choices when using technology.

https://www.virtuallibrary.info/digital-citizenship.html

Good digital literacy could include using strong passwords and password managers, understanding our personal online “brand,” and ensuring that our actions and words online are safe and secure, and that privacy is maintained, especially for students. 

Defining the Event

Digital Citizenship Week is designed to promote awareness of sound digital literacy habits and inspire best practices in organizations and individuals. That means sharing ways to interact safely online. This year, it is observed October 19–23. 

Common Sense Education is sharing events you can take part in to better understand your role as a good digital citizen.

  • Digital Citizenship and Supporting Young People’s Lives Online (RSVP)
  • Helping Kids Use Social Media Responsibly: An Educator’s Guide to “Social Media TestDrive” (RSVP)
  • Workshop for Educators: Digital Citizenship and Supporting Young People’s Lives Online (RSVP)
  • And more!

You can also check out a planning calendar, activities organized by age and grade, and many other resources. 

More from TechNotes

Looking for more ways to understand this topic, and inform your students (and staff, educators, and families) about staying smart online? Check out more digital literacy resources from TCEA below, and don’t forget to share your ideas in the comments!

More Digital Citizenship Week Links

0 comment
0 FacebookTwitterPinterestLinkedinEmail
cybersecurity
CTO/CIOCybersecurityTechnical Support

October Is Cybersecurity Awareness Month

by Andrew Roush
written by Andrew Roush

We live much of our lives online, and security in the virtual world can be just as important as physical security. This is especially true in education, and that’s why, in October, educators, administrators, and students are observing Cybersecurity Awareness Month. 

Defining Cybersecurity

The history of keeping digital devices, records, networks, and more safe has seen many changes, twists, and turns in its relatively short span. Known variously as IT security or simply computer security, cybersecurity includes “the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information,” according to the U.S. Cybersecurity and Infrastructure Agency. 

Common cybersecurity practices might include multi-factor authentication, keeping software up to date, managing firewalls, using strong passwords, and being aware of common email scams. The goal is to keep computer hardware and software safe for users, and to help protect privacy online. 

Getting Web Wise

National Cybersecurity Awareness Month is marked each October in the United States. The practice began in 2004 when the U.S. Department of Homeland Security and the National Cyber Security Alliance launched the event “as a broad effort to help Americans stay safe and secure online.” This includes awareness of common online scams and tips for keeping your digital presence secure. 

The theme of this year’s event is “Do Your Part. #BeCyberSmart.” The organizers hope to use the event to highlight a number of easy practices to keep information safe.

Here’s how the National Cybersecurity Alliance frames it:

The line between our online and offline lives is indistinguishable. In these tech-fueled times, our homes, societal well-being, economic prosperity and nation’s security are impacted by the internet.

National Cybersecurity Alliance, https://staysafeonline.org/cybersecurity-awareness-month/

Getting Involved

The National Cybersecurity Alliance encourages people to stay connected by following them on  Twitter, Facebook, YouTube, and LinkedIn. You can even download images and messages about cybersecurity to share on your own social networks. Check out more suggestions, ideas, and resources here.

Further, a number of events are planned throughout the month. Here’s what’s on tap for the rest of October. 

  • Week of October 12 (Week 2): Securing Devices at Home and Work
  • Week of October 19 (Week 3): Securing Internet-Connected Devices in Healthcare
  • Week of October 26 (Week 4): The Future of Connected Devices

The organizers this year are sharing “Tip Sheets” for cybersecurity at work, while traveling, with connected devices and digital assistants (IoT), as well as more specialized topics, like “e-skimming,” phishing attacks, and connected home security. Institutions can also get involved as “champions” for cybersecurity awareness.

Smart Solutions for IT Professionals

Those looking to improve their personal, school, or district information security may be interested in TCEA’s System Administrator and Technical Support Conference, online October 20–21. This annual event is designed for CTOs, network managers, and tech support pros — and this year we’re bringing you up-to-the-minute solutions, all online and available on-demand following the live, virtual event.

Click the link here to see the list of topics, the schedule, and to register. 

More on Cybersecurity from TCEA

Image by methodshop from Pixabay

0 comment
1 FacebookTwitterPinterestLinkedinEmail