School district leaders from throughout Nassau County got a lesson in cybersecurity during a special summit held by Nassau BOCES on September 6. The summit was developed following a string of cyberattacks targeting five New York school districts. The attacks crippled the districts’ systems for days to weeks, depending on the severity of the attack. The speakers included two superintendents from impacted districts, the Federal Bureau of Investigation (FBI), Homeland Security and Emergency Services, the New York State Education Department (SED) and Nassau BOCES’ technology experts. “It’s not if your district will be attacked, it’s when,” said Rose LeRoy, Director of Educational Data and Research for SED.
The criminals who commit cyberattacks consider school districts easy targets, according to the panel of experts. There are steps that districts can take to reduce the impact of an attack. The speakers all emphasized serving up verified backups that are cut off from the district’s servers – either using a cloud-based or tape system. Some of the other actions districts were urged to take include: Creating a disaster recovery plan and conducting drills; Providing district staff with ongoing professional development about how to know if an email is real or fake; and developing a way to communicate with their community if their website and e-mail are compromised by an attack.
“I walked through a dark world that I never knew existed,” said Dr. William H. Johnson, Rockville Centre UFSD Superintendent. He shared a first-hand account of how his district’s technology systems — including telephones, emails and many of their files — were held for ransom. The district ended up paying $88,000 in bitcoin via insurance to the assailants. One of his tips to the other districts was to review their insurance policies to ensure that they have a high enough limit and that the policies cover ransom.
The viruses for both Rockville Centre UFSD and Mineola UFSD came in through e-mails with infected links or attachments. The infection lay dormant in their systems for months before the attacks started. Mineola UFSD Superintendent Dr. Michael P. Nagler urged his colleagues to monitor outgoing traffic on their systems with as much care as they do incoming. He thinks his district fared better because they took some of their backups offline and closed some of the system ports. One of those ports was the one being used by the attacker. Because the district had solid backups, they were able to ignore the requests for ransom. “Now, we back-up five times a day and have a tape backup in a safe,” Dr. Nagler said.
The FBI representative urged district leaders to “Get law enforcement involved as soon as possible.” The FBI and Homeland Security and Emergency Services can use their experience with the different types of attackers to help districts figure out what they can expect and help them deal with next steps.
“I want to thank all of these agencies for coming together today to help districts navigate this important topic,” said Dr. Robert R. Dillon, Nassau BOCES District Superintendent.
Nassau BOCES’ technology experts offered tips and resources, and promised to set up other meetings to continue the discussion.
The names of the FBI and Homeland Security and Emergency Services representatives have been left out of this story intentionally.
Photo Caption: Educational leaders from throughout Nassau County gathered at a recent cybersecurity summit to combat cyberattacks on school districts. On hand to share vital information are (left to right): Dr. Robert R. Dillon, Nassau BOCES District Superintendent; Rose M. LeRoy, Director of Educational Data and Research for the NY State Education Department; and Marlowe Cochran, Chief Security Officer for the NY State Education Department.
Recent Comments