How to protect your school from a cyberattack

In the past, we've blogged about the top cybersecurity threats to schools — but with limited resources and shrinking budgets, how can you protect your school from a cyberattack? Ultimately, you’ll sleep better at night if you do five things:

• Educate your end users

• Prioritize patch management

• Develop a strong password policy

• Invest in proactive measures

• Have a strategic backup plan

Educate your end users through cybersecurity awareness training 

You know that feeling when you could swear that today's fifth graders are covering skills you didn’t learn until eighth grade? That’s what dealing with cybercriminals is like these days. 

Sure, you have the occasional script kiddie — but many hackers who launch attacks on schools are part of organized ransomware groups. We’re no longer handling hackers in hoodies; we’re grappling with grifters in groups. As a sysadmin in a K–12 environment, it’s important not to underestimate what hackers are capable of — and education is key. 

Anyone can fall victim to a phishing attempt, even trained professionals. But teaching your users the common signs of a phishing attempt can help curb the threat. Consider giving age-appropriate training to help your end users — faculty, staff, and students — know what to look for. 

For example, at PDQ, we use KnowBe4 to train our employees to be vigilant against cyberthreats. Other companies offer free or low-cost security awareness training for school students and staff. One such company is Fortinet, which offers student- and staff-friendly training modules, quizzes, and other awareness assets. 

Prioritize patch management 

When software vendors unearth a vulnerability in their software, they release a patch to fix it. And vendors do their due diligence to get the word out about the vulnerability and the associated patch. But you know who’s eagerly awaiting those vulnerability announcements? Threat actors. 

Hackers love to exploit vulnerabilities to conduct nasty attacks. You can make life harder for them by prioritizing patch management and vulnerability management.

Patch your systems and software frequently and regularly — at least every two to three weeks, or within 24 hours if you’re dealing with a zero-day vulnerability. You can rely on tools to help make this otherwise grueling process manageable.

Develop a strong password policy

We know — we’re talking about passwords again, and you’re already envisioning a million help desk tickets every Monday morning from users who forgot their passwords. But a strong password policy is such a crucial part of preventive cybersecurity that we have to restate its importance here.

Credential compromise is often low-hanging fruit for threat actors. Verizon’s 2023 Data Breach Investigations Report claims that stolen credentials were present in 31% of breaches in the education sector. And credentials made up 40% of all data compromised in this sector. Once a threat actor cracks the right password, they’re free to lie in wait until the perfect opportunity arises — or strike immediately.

Creating a password policy doesn’t have to be difficult. You should think about these considerations when developing your password policy: 

• Password history (only use Ilovemydogawholelot475 once) 

• Password age (you should love your dog — not your password — as it ages) 

• Password length (eight characters minimum, but more is better) 

• Password complexity (a chance to feature your favorite symbol) 

• Account logout (after five incorrect guesses, lock the user out for half an hour) 

And while a strong password is great, a strong passphrase is even better.

Invest in proactive security measures 

Might we suggest an alternative proverb to Ben Franklin’s “an ounce of prevention is worth a pound of cure”:

Make sure that you don’t overlook proactive security measures when it comes to your school’s security. Proactive security measures are likely things you’ve heard of: multifactor authentication (MFA), firewalls, antivirus, traffic analyzers, etc.

These common tools can help combat a few of the major cyberthreats schools and school districts face, including distributed denial-of-service attacks (DDoS), that can cause major outages on your network.

Have a strategic backup plan 

It’s unfortunate, but hackers can still pwn your environment even if you have the best proactive security measures in place. 

That’s why a disaster recovery plan should be locked in the glass box next to the fire extinguisher in the hallway. One of the most important parts of any disaster recovery plan is a strategic backup plan. How — and where — you back up your data matters. 

For a strong, strategic backup plan, implement at least one immutable backup. Immutable backups ensure that your stored data can’t be changed, deleted, or altered — not even by you, my sysadmin friend who holds the keys to the kingdom. In a ransomware attack, you may be crying — but your immutable backups will be laughing in its ugly, nasty face. 

Keep in mind that there are some types of attack tactics, such as data exfiltration, where even a million immutable backups won’t do much good. A strategic backup plan, while an important part of a disaster recovery plan, shouldn’t be the disaster recovery plan.

Grade-specific cybersecurity tips for sysadmins

Your cybersecurity strategy should evolve as students progress through their educational journey. Cybersecurity best practices for first graders undoubtedly look different from the cyber strategy you put in place for students nearing high school graduation.

Here are some cybersecurity best practices specific to grade levels.

Cybersecurity tips for elementary schools 

Elementary school students need the most limited access among all the grade levels. If students use the internet, teachers are close by to supervise and direct them toward specific websites.

Because elementary school students’ internet usage is so limited, some sysadmins choose to implement a safe browser (like Google’s Kiddle) and restrict all other browsers. Depending on the browser, you can allowlist specific URLs that encourage learning (and discourage cyberattacks and other nefarious activities).

At the elementary school level, you might issue students iPads for use in the classroom. You can lock these down via your management console or mobile device management solution. For example, you can set up these devices to access only one app, such as an app that allows students to read as if their device were an ebook. For Android devices, you can accomplish this through kiosk mode. This gives you greater control over how your students can use their devices.

It’s also important to note that cybersecurity education for students begins now. You can discuss how students should use their devices with their teachers and parents — and teachers can and should make cyber safety part of their lesson plans whenever students use technology. Naturally introducing cyber concepts to children sets the foundation for more in-depth learning later on.

Cybersecurity tips for middle schools 

Middle school students may bring their personal devices to school, warranting the creation a bring your own device (BYOD) policy for the sake of your school network. Students might also use computer labs more frequently, which is where security awareness training becomes particularly useful.

You might consider using your device management solution to push out profiles and configurations to issued devices, such as Chromebooks and laptops. This allows you to limit applications and the content visible to students. In some wireless controllers, you can even set a specific rating (e.g., G, PG, PG-13) for content visible to students. 

Middle school students should continue to progress through their cybersecurity education as well. Students at this age should understand the risks of internet usage and learn how to avoid common threats, such as phishing.

Cybersecurity tips for high schools 

Congratulations to those sysadmins who work with high school students — you’re officially dealing with little adults! 😅 The good news is all the prep work you’ve done for your elementary and middle school students will serve you well here. 

Your cybersecurity strategy for high school students should be more sophisticated than those for elementary and middle school students. At this level, we flip the script in a few ways. Instead of allowlisting websites, we denylist far more frequently to meet students’ growing needs to access more internet resources. And you may find that you use your management console a little less frequently. 

High school students should understand the real-world risks and implications of poor cyber hygiene. They should know about phishing, smishing, ransomware, and so on. (And while you’re at it, now is a good time to stress that once something goes live on the internet, it’s never truly gone.) 

In short, teenagers are akin to puppy dogs with ears too big for their bodies. Part of them is fully developed, while an equally important part is not. And that can lead to poor decision-making. 

Educating teenagers on the real-world risks of internet usage is critical. They should know that nothing truly disappears from the internet once it’s out there, and what’s said online can have real-world implications. A good rule for teenagers is to avoid sending anything online or via text that they wouldn’t want to see plastered on the side of their house for everyone to view. 

In fact, online safety precautions would make a great class for high school students. Teachers may be met with eye rolls and groans, and students may not listen, but as IT professionals … we can dream, right?

A few more general tips

To wrap up, here are a few tips that can be applied for each grade level — and their nuances.

While you can establish an acceptable use policy for all grade levels, high schoolers might be more involved with reading and agreeing to the policy themselves versus needing a guardian’s signature. You might also consider penalties, such as suspension or losing their computer privileges, for students who don’t follow the rules.

You should consider segmenting, isolating, and restricting guest traffic as well, which makes it more difficult for threat actors to gain access to your school network and main environment. These restrictions will likely look different at each grade level. (For example, you might monitor children’s devices differently than you’d monitor a 17-year-old's device). You can put these rules in place on your wireless controller or your firewall.

It’s never too early to educate students on the internet's inherent risks, and making cybersecurity part of their educational journey puts them well on their way to becoming responsible adults.