Have you ever received a suspicious email from a contact you trust? Maybe it’s from a local print shop asking for immediate payment on an invoice for flyers for your district. It could be from your business manager requiring sign off on gift cards to employees. It could even be from a third-party contractor or district administrator asking for payment information to take care of construction costs.

Unfortunately, while those communications may appear innocent on the surface, the thing they all have in common is that none of them are actually from a trusted contact. Business email compromise (BEC) occurs when bad actors portray themselves as trusted parties. While not necessarily as prevalent as ransomware attacks, this form of cybercrime is the most financially costly to organizations, and one that has become increasingly common in K-12 institutions.

These fraudulent communications are often portrayed by the perpetrator as time-sensitive, asking for immediate financial action before the reader can accurately assess the validity of the request. While the short timeframe is part of what can make attacks successful, it’s also their downfall.

Taking time to scrutinize the email is all it takes to prevent a costly mistake.

Documents and videos in the SET SEG Cyber Security Resource Center describe, in detail, the dangers of phishing attacks from cybercriminals trying to steal your data and how to mitigate them. BEC threats follow some of the same rules.

Business email compromise attacks can be a costly hazard but taking the steps to educate employees on cyber security best practices is the key to protecting your district.

• Participate in regular phishing training, like KnowBe4’s cyber awareness training.
• Put strict policies in place, only allowing the use of district-managed devices for work-related tasks.

While cyberattacks are only becoming more common, SET SEG is committed to providing members with the greatest defense against such threats: knowledge.

If you haven’t already, visit our Cyber Security Resource Center to prepare your staff for whatever cyberthreats may come your way.

Cybercriminals are attacking schools at an alarming rate. Malicious actors are exposing personally identifiable information, demanding millions of dollars of ransom, and districts are losing valuable time and money before they are able to regain control of their systems.

Threats and phishing attacks continue to become more sophisticated and difficult to spot.

“It is imperative that your staff is not only aware of these heightened attacks on the education community, but know how to stop the attack, and report it appropriately,” says Amy Guilford, Chief Program Administrator of the Property/Casualty Pool. “Early detection is the key — alerting your IT team right away gives them a better chance at shutting down the threat and minimizing damage.”

The first step for every district is to consider subscribing to a training entity, like KnowBe4 — an on-demand security awareness cyber training program. SET SEG members receive a significant discount on the highly affordable subscription. It is one of the best lines of defense you can deploy to prevent a cyber event at your district.

If an incident does occur, contact your SET SEG Account Executive immediately to deploy our team of legal and forensic specialists.

PROTECT YOUR DISTRICT IMMEDIATELY

EDUCATE:

Conduct ongoing security awareness training – sign up for KnowBe4, or another security training, to help your staff spot and stop these attacks.

SEPARATE:

Establish policies – only allow district-issued computers onto district-owned networks.

MITIGATE:

Backup data offline – keep a secure offsite copy of your information or remove any online backups from the main network.

Deploy a password management tool – utilize Multi-Factor Authentication to require individuals to verify their identities prior to logging into a system.

When it comes to communication in the workplace, email is king. With American workers receiving an average of 126 emails per day*, email also serves as one of the most vulnerable areas of your organization’s security structure. While scans and filters can assist with blocking some suspicious communications, the likelihood of falling victim to a cyberattack is directly linked to your staff’s level of security awareness and their ability to spot hackers’ attempts.

The Dangers of Operating on Autopilot

When going through your inbox becomes an everyday task, decisions on what to open, click on, and delete are made quickly, effortlessly, and even automatically. That’s why it’s no surprise that as our brains are taking shortcuts, there has been a dramatic increase in successful phishing scams.

Just like your processes for student safety require staff to be alert and responsive in the event of a potential disaster, procedures created to keep your cyber data secure are heavily reliant upon employees to respond properly in the face of an attempted cyber attack. While an investment in defensive software and preventative tools is helpful, teaching employees to be mindful and treat every email like a potentially malicious scam is still the most effective way to stop a cyber breach and protect your district.

How to Change Problematic Behaviors

Just like other employee trainings, with cyber security education, you’re aiming to build a foundation of knowledge so staff has a solid awareness and ability to respond to certain situations appropriately. However, unlike most trainings, the process shouldn’t stop after delivering education. Cyber security training must also include ways to encourage staff to change their current absent-minded, routine approach to emailing to the “system 2” approach. Keeping up with emails can be taxing, but it’s critical that you share the importance of slowing down and maintaining a controlled and mindful state.

The Fastest, Easiest Path to Change Behaviors: Purchase Training

Investing in simulated testing with a cyber security awareness training tool can help you automate testing and capture performance data to determine your risk status and monitor progress. With so many user-friendly and effective tools available, purchasing a training tool can be fast and easy. Off-the-shelf tools also streamline training implementation and offer quick deployment, so you can address this issue and make progress within a matter of weeks.

For information on discounted training subscriptions available to SET SEG members, visit setseg.org/cyber.

*“Email Usage Statistics in 2021.” Campaign Monitor, 11 July 2019, www.campaignmonitor.com/blog/email-marketing/email-usage-statistics-in-2019/.

During the second and third quarters of 2020, the number of ransomware attacks within the education sector rose by 388%.

Many have heard that malicious cyber incidents in public schools — like staff data breaches, ransomware outbreaks, phishing attacks, and social engineering scams — drastically increased throughout the previous year, but this dramatic spike equates to a rate of more than two incidents per school day over the course of 2020, according to a report by the K-12 Cybersecurity Resource Center.

The education sector is one of the most targeted industries by ransomware attackers, forcing schools to face a challenging decision:

Invest in better security and backup precautions now, or suffer the consequences and hope to be able to afford the steep ransom and recovery costs if attacked.

Small Investment Today, or Major Unexpected Cost Tomorrow

The average total cost of recovery from a ransomware attack has more than doubled since last year, according to the global survey, The State of Ransomware 2021. It’s important to understand that the “sticker price” of paying the ransom (to obtain decryption keys) is only a small piece of the larger picture to recovering data, and there are other hidden costs and losses including:

• Business interruption losses – average downtime is 21 days
• Legal expenses – to determine what breach notification laws were triggered and how to notify victims
• Reputational damage

When faced with this situation, for any organization, but especially for public schools, paying the ransom is not the best way out. Even if your organization decides to pay it, the chances of getting all your information back are very slim. The average ransomware payment is $170,404 and 92% of organizations do not get back all their data after paying.

The Only Option for a Full Recovery: Data Backups

“Despite all our efforts, it is a hard truth that network and security controls can fail,” says David Larson, Network Engineer at Livingston ESA and contributor to “Essential Cyber Security Best Practices for K12,” published by Michigan Education Technology Leaders (METL). In the event of an attack, restoring data from backups may be the only solution.

Top 4 Steps to Achieving an Optimal Data Security Structure:

1. DESIGN a robust backup procedure — utilize the 3-2-1 rule
2. INVEST in necessary backup technologies
3. MONITOR backup procedures on a regular basis
4. TEST backup recoveries on a regular basis and simulate disaster incidents

If Precautions Fail, Contact SET SEG!

Organizations targeted by a cyberattack must act quickly to report the incident and deploy the data restoration process. Develop a cyber incident response plan, educate your staff, and be prepared to contact SET SEG.

For more resources on cyber security, visit setseg.org/cyber.