Cyber Defense eMagazine February 2021 Edition

More documents

Recommendations

Info

udget to include a dedicated Information Security asset and, at best, add InfoSec to the stack of responsibilities their team has. That is, if they haven’t outsourced their entire IT infrastructure to a Managed Service Provider (MSP) who may, or may not, have it in their contract to handle the added burden of managing the district’s cybersecurity. This all combines to leave school districts especially vulnerable to a range of attacks. Some of these attacks are, on some level, understandable if not forgivable. “Zoom-bombing” a class, while disruptive, may be nothing more than a prank staged by a student, sibling, or school rival. It’s the kind of stunt some of us would have likely considered during our own school days. A DDoS, again, may be a poorly conceived student prank rather than part of a criminal effort to disrupt the school’s operations. The CISA alert covers attacks that are much more intrusive and damaging than simple pranks or minor disruptions. Attackers have dropped malware into school environments to disrupt systems, steal personal information for sale or extortion, and they have used ransomware against districts and even individual students. With the state of Public Education budgets in the United States and the stresses brought on by the shift to distance learning amidst a global pandemic, cybercriminal attacks against K-12 organizations count as kicking someone while they’re down. Not that it’s unexpected. After all, we can’t exactly expect ethical behavior from people who are making a living from openly criminal pursuits. What we can do, is try and help educational organizations defend themselves during these extraordinary times. With restricted budgets, educational institutions need to carefully allocate their limited resources to get the best bang for the buck. Whether they are using a dedicated IT organization in their district or school, are relying on SaaS services, or an MSP, the situation is the same. They need to meet their operational requirements first and foremost, providing the best education possible to their students, while still maintaining adequate security. It’s a daunting challenge, but the CISA alert has some solid advice on best practices to stay secure against these attacks. The obvious suggestions of keeping patches up to date, making sure systems are configured according to industry best practices, enabling Multi-Factor Authentication, auditing user accounts and systems, and the rest, are simply the start. Of course, organizations should already be doing all this. That we need to remind people in the alert speaks more to districts having limited resources than it does to them having a lack of knowledge, will, or intent. Perhaps the most effective way to use limited resources in K-12 Education is through user awareness and improved user training. After all, who better to educate people on how to best deal with social engineering, phishing, and other basic user security concepts, than professional educators? While Teachers are already over-worked, under paid, and under-appreciated, they are also well positioned to become an effective part of the solution rather than part of the threat surface. They can also effectively relay security awareness on to their students who may be at risk as social engineering and phishing targets themselves. There is an old saying about knowing being half the battle, and in this case a lack of knowledge is a serious issue. Where adding technical solutions to the security stack can be beyond the resources of a stressed school district, improving user education and training is a reasonably cost effective and rapid way to improve K-12 security. Cyber Defense eMagazine – February 2021 Edition 40 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
About the Author Saryu Nayyar is the CEO of Gurucul. She is an internationally recognized cybersecurity expert, author and speaker with more than 15 years of experience in the information security, identity and access management, IT risk and compliance, and security risk management sectors. She was named EY Entrepreneurial Winning Women in 2017. She has held leadership roles in security products and services strategy at Oracle, Simeio, Sun Microsystems, Vaau (acquired by Sun) and Disney, and held senior positions in the technology security and risk management practice of Ernst & Young. She is passionate about building disruptive technologies and has several patents pending for behavior analytics, anomaly detection and dynamic risk scoring inventions. Saryu can be reached on Twitter at @Gurucul and at https://gurucul.com/ Cyber Defense eMagazine – February 2021 Edition 41 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2: The 2021 Perspective - Challenges a
Page 3 and 4: Does Sunburst Have Your Confidentia
Page 5 and 6: @CYBERDEFENSEMAG InfoSec Knowledge
Page 7 and 8: Cyber Defense eMagazine - February
Page 21 and 22: The 2021 Perspective - Challenges a
Page 23 and 24: A slice of the anti-virus pie? We s
Page 25 and 26: Additionally, we saw explosive grow
Page 27 and 28: 2021 Predictions: Addressing the Ch
Page 29 and 30: About the Author Ankur is the found
Page 31 and 32: An independent study conducted by P
Page 35 and 36: The Boomers’ lack of trust in Fac
Page 37 and 38: While it’s unclear if historical
Page 39: Cyberattacks On K-12 Education Care
Page 43 and 44: Third-party vendor risk management
Page 45 and 46: Cyber Resiliency Will Become the Ne
Page 47 and 48: About the Author Drew Daniels is th
Page 49 and 50: Phishing Threat actors are taking a
Page 51 and 52: Vulnerability Patching: Why Does It
Page 53 and 54: with any degree of efficiency is to
Page 55 and 56: the nature and its technological ou
Page 57 and 58: kind of the communication streaming
Page 59 and 60: it’s logical to realize that the
Page 61 and 62: eason they will be that hidden part
Page 63 and 64: channeling hotspots are diverse and
Page 65 and 66: Ransomware is Evolving - Agencies M
Page 67 and 68: About the Author Nick Psaki is the
Page 69 and 70: 3GPP Release 15 defines the 5G secu
Page 71 and 72: • Suppliers must prioritize cyber
Page 73 and 74: Does Sunburst Have Your Confidentia
Page 75 and 76: About the Author Randy Reiter is th
Page 77 and 78: Global Reach and Accessibility Plan
Page 79 and 80: About the Author Trevor Daughney is
Page 81 and 82: typical work environment. Public Wi
Page 83 and 84: increasingly interested in implemen
Page 85 and 86: Approach cybersecurity as an org-wi
Page 87 and 88: Are Encrypted Communication Apps us
Page 89 and 90: How SaltDNA’s platform prevents c
Page 91 and 92:
are turning to new technologies lik
Page 93 and 94:
The Best Network Protection: Go Dee
Page 95 and 96:
Top Tips For Securing Your DevOps E
Page 97 and 98:
Continual Learning Is Necessary The
Page 99 and 100:
a prime target for cyber attacks. I
Page 101 and 102:
Cyber Defense eMagazine - February
Page 103 and 104:
Page 105 and 106:
FREE MONTHLY CYBER DEFENSE EMAGAZIN
Page 107 and 108:
show all

Cyber Defense eMagazine February 2021 Edition

Create successful ePaper yourself

Delete template?

Save as template?