By Julia Gilban-Cohen.
A data breach in September that affected millions of current and former California public school students has raised questions about whether such incidents are becoming an unavoidable consequence of schools’ growing reliance on technology, and what education leaders and policymakers can do to prevent them.While cybersecurity experts acknowledge that no system is immune to attacks, some said many incidents could be prevented through stronger security practices, greater accountability for education technology vendors and dedicated investments in cybersecurity infrastructure.TJ Sayers, senior director of threat intelligence at the nonprofit Center for Internet Security, cautioned against accepting massive data breaches as normal.”I don’t think it’s a healthy perspective for us to just assume that this is the way things will be moving forward,” he said.The aforementioned breach involved Educational Testing Service (ETS), California’s statewide assessment contractor, which discovered in September that an unauthorized party had used a compromised login credential to access and copy student information over several months. The exposed records included names, birth dates, addresses, assessment information and certain disability-related data, according to the California Department of Education.ETS now faces a proposed class-action lawsuit alleging inadequate safeguards, while the department is reviewing the company’s compliance with applicable contractual and data-security requirements. The findings of that review have not yet been announced.Doug Levin, co-founder and national director of the nonprofit K12 Security Information Exchange, said the ETS breach highlights macro-level weaknesses in how schools and their technology providers protect sensitive information. He estimated that roughly 80 percent of cybersecurity incidents affecting schools and vendors could be prevented through basic security practices. The remaining incidents, he said, may involve sophisticated attacks, newly discovered vulnerabilities or other difficult-to-anticipate circumstances.However, implementing stronger safeguards requires funding, leadership support and sometimes additional steps that can complicate educators’ work.“[Teachers] may want to use a new app or tool they found, but it has to go through a review process, and maybe a site they relied on is determined not to meet the standard, and so there’s frustration,” Levin said.He also pointed to inconsistent cybersecurity practices across districts, including how they evaluate and contract with technology vendors.”What we see across the country is incredible variability in the practices of school systems, both for their internal systems, but also in how they select and contract with vendors,” Levin said.That inconsistency calls into question how states can ensure that companies entrusted with student information meet adequate security standards.Laurel Nava, executive director of the nonprofit professional association California IT in Education (CITE), said verifying those protections can be particularly difficult for both school districts and state education agencies.”You can ask a vendor so many times: Are they following these security practices? Are they following security standards? But we have no way to check and verify those,” she said.Nava said California lacks a dedicated state mechanism for broadly verifying the cybersecurity practices of education vendors. Establishing such oversight, however, would be a substantial undertaking, particularly given the hundreds of technology providers that individual districts may use.Levin said public education agencies could strengthen accountability by including clearer cybersecurity expectations and financial penalties in vendor contracts, and reconsidering vendors that fail to meet those expectations.But changing providers presents its own challenges. Public procurement processes can be lengthy, he said, and some schools have relatively few alternatives for essential technology services.Beyond vendor accountability, experts identified another potential vulnerability: the vast amount of student information schools and their contractors retain.The ETS breach affected not only current students but also former students whose records extended back years. According to earlier reporting, some affected records involved students dating back to 2006, and both Levin and Nava emphasized that that is relatively commonplace in breaches affecting schools.”States have record retention laws where they need to hold on to certain information, but by and large, school systems are holding on to more information than they are required,” Levin said.Nava similarly emphasized the importance of limiting the information shared with vendors, restricting access to authorized personnel and regularly removing records that are no longer needed.”Don’t keep the data sets just in case. Have really strong policies in place and get rid of it,” she said.Such practices require balancing the educational value of student information against the risks associated with storing it, she added. Investigators of the ETS incident, however, have not publicly established whether the company violated any data-retention requirements.Sayers attributed some of K-12 education’s vulnerability to historically limited investment in cybersecurity, adding that even with stronger oversight and data management, improving cybersecurity across California’s school systems — and those throughout the country — would require additional, costly resources.He cited government and nonprofit grants, dedicated security personnel and security-focused procurement as potential ways to improve protections.Nava noted that funding is particularly important for smaller districts, where technology responsibilities may fall to administrators without specialized cybersecurity expertise. She also pointed to security operations centers — referred to as SOCs — as potentially valuable but resource-intensive approaches to monitoring and responding to threats.”You may have somebody who’s wearing a superintendent hat and a CTO hat and doesn’t even know where to start with cybersecurity,” she said. “So having the resources, having the dedicated funding, would make a massive difference.”Ultimately, several experts distinguished between preparing for the possibility of a cyber attack and accepting preventable security weaknesses as inevitable.For Levin, reducing those risks is not necessarily a matter of developing entirely new solutions, but of committing to safeguards that are already available. He and Nava emphasized the importance of stronger data management practices, including limiting access to sensitive information and removing records that are no longer needed.Levin also recommended that families affected by the ETS breach freeze their own credit and that of their children, a free measure that can prevent criminals from opening new accounts using stolen personal information. Sayers similarly recommended credit freezes, along with multifactor authentication and stronger password protections.”There are commonsense steps that we can take now, many of which are free, some of some of which are low cost. That would make a difference,” he said.Still, Levin stressed that prevention requires a broader commitment from education leaders and policymakers.While calling for stronger cybersecurity protections, Nava also cautioned against placing complete blame on the California Department of Education (CDE) or ETS before more details about the incident are known.“It’s really scary … for a lot of students and families whose information is going to be affected,” she said. “But it’s also important to keep in mind that CDE itself and ETS were also victims in this breach, and we just don’t know the details yet on how exactly it happened or what’s behind the breach.”
window.fbAsyncInit = function() {
FB.init({
appId : ‘314190606794339’,
xfbml : true,
version : ‘v2.9’
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
——————————————————-
Click Here For The Original Source.
