• Apparently, the West Virginia Department of Education manages email for every educator across the state. Privacy compliance in such a scenario seems...complicated (euphemistically).  Case in point: "State Dept. of Education says it improperly provided records to departing Brooke superintendent."
• Emotet strikes again and again: In New York ("Newfane schools' computer system restored") and Ohio ("Virus shuts down Loudonville schools’ computers"). (For more on Emotet, be sure to give a listen to "Nightmare on Johnson Street.")
• While ambiguous, this report on a malware outbreak affecting a Texas district sounds not good: "Crosby ISD’s IT system hacked by ransomware virus."
• School leaders represent attractive targets for account compromise, including from students. Such was the lesson learned by one Indiana principal ("Greenfield's principal email hacked, student caught").
• Attribution is hard, so I might take the claim from this Illinois district with a grain of salt: "Foreign hackers infiltrate Mount Zion School District computer system; most data recovered, superintendent says." This is the second incident experienced by the district in recent months. Be sure to read the Cybersecurity-Related News section below for a related story about the district.
• “This was an unfortunate but serious mistake and we are reviewing our procedures to determine how best to avoid this type of accident in the future" (Manchester school officials confirm data breach, saying student scores were sent to all Hallsville Elementary families)."
•  The K-12 Cyber Incident Map keeps in sync with other public reporting on school cybersecurity incidents. A few additions that were missed earlier in 2018 (identified in preparation for the release of “The State of K-12 Cybersecurity: 2018 Year in Review”): A California district disclosed a data breach due to loss of control of an employee's laptop - the 3rd incident experienced by the district since 2017; A New York district inadvertently disclosed confidential employee data online in the process of applying for insurance coverage; An Alaska district was victimized by a(n ambiguous) phishing attack, while a Washington district fell victim to a W-2 phishing attack.  

ICYMI: The K-12 Cybersecurity Resource Center - with the generous support of Core BTS, Managed Methods, and PC Matic PRO - released the first-ever report on K-12 cyber incidents on Feb 7, “The State of K-12 Cybersecurity: 2018 Year in Review."



The interactive report - featuring detailed cyber incident and school district data, along with a timeline of TV news reports of the 'Top 10' incidents of 2018 - can be found online at https://k12cybersecure.com/year-in-review/. Alternatively, an abridged PDF version of the report is also available for direct download.

Select news coverage:

• EdSurge: “Report: A New Cybersecurity Incident Strikes K-12 Schools Nearly Every Three Days.” 
• Education Week: “Schools Suffered at Least 122 Cybersecurity Incidents Last Year.” 
• Phi Delta Kappan: "Not-so-cybersecure schools"
• Campus Safety: “Report: K-12 Schools Experienced 122 Cyber Attacks in 2018.” 
• Security Magazine: "A New Cybersecurity Incident Strikes K-12 Schools Nearly Every Three Days."
• Education Dive: “122 K-12 cybersecurity threats reported last year.” 
• CSBA: "Report: K-12 cybersecurity incidents, risks growing across the country." 

Other Updates:

• New Alerts/Commentary:
  • Podcast: Nightmare on Johnson Street (Feb 16)
  • Via Medium: The ‘Top 10’ K-12 Cyber Incidents of 2018 (Feb 16)
  • K-12 Cybersecurity News You Can Use (Jan 22)
• Upcoming Speaking Engagements/Presentations:
  • March 4. “Where School Safety, Security & Surveillance Meet.” SXSWedu 2019 (Austin, TX).
  • April 1. ” What K-12 Policymakers and Administrators Need to Know About School Cybersecurity.” National School Boards Association Annual Conference & Exposition (Philadelphia, PA).

• Phocus on Phishing: “Teachers are trusting people. They care about kids, they want to do the best for them, and they trust people.” They also are quite likely to click on phishing emails and disclose sensitive data ("Phishing attacks challenging teachers, says Utah ed director"). No surprise then that scammers are increasingly targeting K-12 schools with mass email phishing attacks, such as gift card scams ("Phishing Scheme Targets Professors’ Desire to Please Their Deans — All for $500 in Gift Cards") and direct deposit scams ("Phishing scam may target your direct deposits"). Thankfully, these attacks can be thwarted with a combination of technical controls, strong policies, and user training and awareness ("Soda Springs school district avoids fraud scam"). One new tool that may help (via Motherboard): "Google Made a Quiz to See if You Can Identify Phishing Emails". Direct link: https://phishingquiz.withgoogle.com/. I went 8 for 8, but its not easy. Be sure to read the context provided for each scenario.
• Guilty or Not Guilty? A Mount Zion (IL) high school student pleads not guilty to computer hacking charges  to avoid homework, while FBI agents in North Carolina charged 'hackers' with making hundreds of hoax bomb threats to schools. 
• Cybersecurity is a global concern, including for schools: In Australia, edtech provider SkoolBag is accused of a data breach ("SkoolBag secure says MOQ, after user creds found in massive dump"), while in the Netherlands, Magister suffered an extended denial-of-service attack ("School System Hit by DDoS Attack; Hundreds of Schools Affected"). And speaking of email phishing targeted to schools: "[UK] School says no data compromised by 'random' email phishing attempt."
• Yet another reason why password managers are good and password re-use is bad (via Wired): "Hacker Lexicon: What Is Credential Stuffing?"
• Via REN-ISAC (the Research Education Networking Information Sharing & Analysis Center): A GitHub repository entitled, "Security-Focused Office 365 Management and Log Scripts for Education." Looks to be useful stuff.