Cybersecurity is something that every single person should be aware of, including school systems.
Cyberattacks pose a significant risk to education systems everywhere. They can threaten the integrity and accessibility of learning platforms. With the increasing reliance on digital tools and online learning environments, educational institutions can be prime targets for malicious actors who aim to disrupt operations, steal sensitive data or propagate misinformation.
The consequences of cyberattacks extend beyond immediate disruptions; they can compromise the privacy of students and faculty, erode trust in online education and impede the educational progress of learners.
Safeguarding educational infrastructure against cyberthreats is vital to ensure the continuity and security of learning in the digital age.
With the cyber threats that lurk, New College Institute has identified an opportunity to fill a learning gap, as well as make a dent in the communication challenges experienced by K-12 administrations and IT teams across the Commonwealth.
“It’s really about awareness,” said NCI Chief Innovation Officer Ken Russell, PhD.
He said what many don’t understand is how an establishment responds to an incident is crucial.
“The idea of experiencing an event before it happens is the crux of it all,” he said. “From my experience, how you respond to a critical issue is very serious, because if you are not prepared, then when it happens in real life, you are not ready and you panic.”
The institute began discussing how they can share effective ways of response planning. This led to holding onsite events designed to give administrations the opportunity to experience how a cybersecurity incident could unfold, and how an incident response plan (IRP) can help minimize the loss of information and disruption of services.
Russell likened it to a family discussing with children what to do if there’s a fire.
“What we wanted to do is help schools -- public high schools in particular -- put together a response plan, so they know who to contact, when to contact, how to contact and how to structure their communications with everyone when there’s an incident,” he said.
He said what they realized is that different parties who would need to communicate don’t always communicate effectively now.
“What we were seeing is administration on one side and IT on the other, and they’re pleasant in the hallways, but they don’t sit down and talk about things that are germane to the health of the organization,” Russell said.
Enter NCI’s CyberSAFE program into the equation. Experts now meet with administrations, gather both parties in the same room, sit them down together and work on an IRP together.
“You’ve got to find a way to gather each side together to have a disorienting dilemma -- that moment where they confide, ‘What do we do about this?’” Russell said.
Sometimes, Russell said, they do what’s called a tabletop exercise, where they walk through what someone else has gone through, but in a way that’s meaningful to the audience.
“I think that’s why some of the folks have been responsive to the CyberSAFE program -- because it helps them not just with a plan, it helps walk them through an experiential incident that makes sense,” he said.
The goal is to get in front of cyberattacks in K-12 school districts. The institute is doing so by partnering with leading technology companies, legal teams and state and federal agencies.
They’re also partnering with schools themselves.
“Usually, you hear about some multi-billion-dollar company that’s losing $200,000 an hour or something crazy like that,” Russell said. “It’s hard to make that fit into the reality of what a rural high school in Virginia must deal with. So, our committee is writing our own scripts in an effort to convey what an incident may actually look like for them.”
They focus on the circumstances, roles, players and actors.
“We’re going to create videos that are relevant and germane to the rural high school in Virginia,” Russell said. “We’re taking what’s out there and shaping it to fit our needs for the Commonwealth.”
The NCI CyberSAFE Car
Everything NCI has done thus far has started creating waves, and it’s led institute leaders to their next big plan: the NCI CyberSAFE car -- a mobile “compromised network.” Essentially, a car will carry a moving network they can take to schools in the Commonwealth area to give them the experience of a cyberattack in real time.
“We’ve developed a network that is miniaturized, where it will fit in the back of the car,” Russell said. “The idea is very simple: The car has a network in it so it can actually be used as a training device in classroom mode and conference mode.”
Conference mode is when the car goes to an expo or a conference. People can walk up to it, interact with it and see what a ransomware situation looks like.
“You can walk them through a file tree and say, ‘OK, look at this file, how it’s changed and look at this new administrative role that’s been created, and look at this one that’s been deleted, and watch what happens in real time when someone deletes a role,’” Russell said. “That makes it very real and something you would never want to practice on your own network.”
Classroom mode is when the rig disengages from the car and is rolled into a room, where it is turned on and experts can provide a demonstration.
Russell said while the rig for the car is currently being completed, they are still taking their program to schools all over the area.
“Last month I visited Cumberland County’s high school class and we just talked about things to watch out for: cybersecurity hygiene and anything you would expect to see in an incident response plan,” he said.
NCI aims to assist schools across the state to minimize the loss of information and disruption of services by being prepared ahead of time.
To learn more about NCI’s initiative, or how you can get your school involved, click or tap here.