Cyberthieves are Targeting Student Data, Is Your District Prepared? Part 2

In a recent post, we covered a major problem facing K-12 schools today: cybersecurity. Hackers are targeting educational institutions with alarming regularity—and the consequences of these delays can be major: If a student’s identity is stolen, it might not be discovered for years, until the student tries to take out a loan or get a credit card. 

The post highlighted how critical the issue truly is and that school districts need to be doing more. However, this is easier said than done when dealing with tight budget and resource constraints. So today, we're going to cover proactive steps the K-12 schools in your district can take to protect their data and their students.

Put an Action Plan in Place

What would you do in the event of a data breach? An action plan answers that question, so that you know exactly what steps to take when the inevitable comes to pass. An action plan should not only cover how to identify and mitigate a data breach, it should also include which parties must be notified, when you should get your legal representative involved, and whether you need to let the attorney general know.

Keep in mind, an action plan is worthless if it isn’t written down and shared widely. Make sure that everyone who needs this action plan has a copy and has reviewed it thoroughly.

Be Proactive And Minimize Remediation Expenses

There are two other ways in which you can proactively protect yourself against a data breach: Implement log management and invest in an insurance policy.

Log management tracks all of the information your system generates about itself. When you manage all of your logs, you can uncover when a breach took place and the vulnerability in your environment.

Insurance might not be a technological solution, but it’s a valuable investment after a data breach takes place. An insurance policy can cover the cost of litigation and the expense of reimbursement for remediation.

Implement Robust Data Protection Policies

Another component in your defense against hacks is to create and implement robust data protection policies. These policies dictate acceptable data usage for students, teachers, and other staff members. Enforcing those policies ensures that confidential information stays safe and that the school district complies with laws about data.

It helps to take a page from Green Bay Area School District in Wisconsin. GBASD issues a list of online resources that aren’t approved for student use because they don’t adequately protect students’ privacy or don’t align with curriculum goals.

In addition, you must develop a process to handle requests for sensitive data so that unauthorized parties can’t access it. School districts have to determine what their sensitive data is and where it is on the network, so they can secure it.

Other People and Process Improvements

In addition to the steps mentioned above, there are some other measures you should implement to keep student data safe:

• Remember that you can’t protect yourself from every risk, so identify and prioritize the ones that are the most pressing.

• Open communication and training both raise awareness. Train staff, teachers, and students about cybersecurity risks, such as phishing. Forewarned is forearmed.

• Another point to keep in mind is that security is not a set-and-forget process. It’s continually evolving, and you need to stay vigilant to keep up with emerging threats.

Implement the Right Technology

A significant component of protecting your students’ data is implementing the right technology. Security often takes a backseat due to limited time, resources, and massive influxes of students. However, you can automate a number of policies (and their execution) and maximize your data protection efforts by putting a modern identity access management solution at the core of your security program.

Features of such a solution include automated lifecycle management that eliminates human error by automating provisioning, account changes, and deprovisioning at scale. By automating deprovisioning, you mitigate the risk of orphan accounts being left open.

Privileged access management controls administrator accounts, keeping the keys to the kingdom safe. You can grant privileged access on demand, as well as temporarily elevate account privileges. In addition, two-factor authentication or multi-factor authentication secures privileged accounts and ensures only authorized personnel have access to confidential information.

Robust access controls enable you to configure role-based and attribute-based access controls to manage applications, authentication methods, file and folder access, password complexity, account claim policies, and more. This feature ensures that the right people have the right level of access when they need it, and at no other time.

Secure single sign-on provides secure, one-click access to the applications and resources that students, teachers, and staff need. The best part of it is that you only need to remember one password.

The most trusted identity access management systems comply with federal and state student data privacy laws. The vendor should work with you to ensure proper compliance with COPPA and FERPA regulations during initial deployment and over time as your identity access management needs evolve. Look for vendors that have signed the Student Privacy Pledge.