Cybersecurity Knowledge Base

Old servers (2012 or older) are the most commonly exploited vulnerability by hackers.

The next two most commonly exploited vulnerabilities are network design flaws and endpoints.

One Ohio city suffered a ransomware attack in 2023. As a result, the City Council approved up to $800,000 to be spent to recover from the ransomware attack. They ended up spending $350,000 of that in the first month. Five months following their ransomware attack, they hit the 1 million dollar mark in recovery spending.

As of January 1, 2024, every public entity that gets hit with a cyber attack must report it to the U.S. government within 72 hours.

250 records or 250 individual student lives constitute a breach. If you have a breach, you must report it.

• Social security numbers
• Anything that has to do with medical billing
• Anything that has to do with the Treasurers department

An education record on average sells for $254.00 on the dark web.

• K-12 systems locked down - no security systems work, HVAC, door locks, data systems, etc.
• Title 9 information gets leaked - videos, data, child abuse information, psych evaluations
• If all important data (such as IEPs) is only maintained online, you may not be able to gain access to that information.

The Ohio Cyber Reserve usually sees most city schools insured for $500,000 - $1,000,000.

If your K-12 organization is a 25-30 million dollar organization then you want to seriously consider carrying 2 million dollars in cyber insurance.

If your organization is handling electronic personal health information then you want to seriously consider carrying 3 million dollars in cyber insurance.

The Ohio Cyber Reserve believes that 5 million dollars is the maximum amount.

You must check with your cyber insurance provider. The ESCEO's cyber insurance provider does not offer cyber insurance discounts for being compliant with cybersecurity frameworks.

Cyber control requirements evolve and change with the threat landscape and market conditions. As such, we are unable to provide a concrete answer in terms of what future control requirements may look like.

From a federal level, which will trickle its way into the private sector, National Institute of Standards and Technology (NIST) is the letter of the law. It's universal. If you’re NIST compliant, you will most likely be 75% compliant with all other frameworks. You will only need to make subtle tweaks for everything else.

All 107 NIST 4.2.0 data security controls can be broken down into the five Ohio Cyber Reserve seminars that were held at ACCESS over 2023 and 2024.

You must review the NIST data security controls with the Ohio Cyber Reserve. If the Ohio Cyber Reserve scores your district well enough on all 107 controls, they can certify your district as being NIST compliant.

The ultimate goal is to mitigate your exposure to cyber attacks so that when that day comes, the severity of the attack is minimized and you can recover quickly. We’re trying to hedge against the inevitable and make the impact as soft as possible.

End user security awareness training and phishing campaigns are most important. All it takes for ransomware to be installed across your network is one individual clicking on an email link. This scenario has actually happened at organizations in Ohio. 83% of cyber insurance claims are due to human error.

The second most important cybersecurity measure is having backups of critical data in place so that you can quickly recover if your data is encrypted by ransomware. 81% of claims are ransomware.

Even if staff members are only using their personal phone for email, the phone should still be encrypted and have a 6 digit pin.

The best practice is to put MFA on anything that is an entry point to your network: VPN, cloud (Google Workspace), and remote access are the main items.

All admin (privileged) accounts and third party accounts (treat them like an admin account) should also have MFA.

As long as the Windows account doesn’t give access to email or remote access, you don’t need MFA on your Windows accounts.

From a best practice/security perspective, yes, Windows Hello is an acceptable form of MFA. In other words, Windows Hello is a biometric authentication method that would serve as a form of MFA to verify a user's identity during the authentication process. More info linked here from Microsoft on Windows Hello and if it qualifies as MFA: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq#is-windows-hello-for-business-considered-multifactor-authentication.

Windows Hello is more secure than weaker forms of MFA that can be bypassed such as SMS / email based one-time codes.

• Code of Ethics Policy: po0123 CODE OF ETHICS/CODE OF CONDUCT
• Data Access and Password Policy: po7540.01 TECHNOLOGY PRIVACY
• Data Classification Policy: ag8305 COLLECTION, CLASSIFICATION, RETENTION, ACCESS, AND SECURITY OF DISTRICT DATA/INFORMATION
• Data Retention Policy: ag8305 COLLECTION, CLASSIFICATION, RETENTION, ACCESS, AND SECURITY OF DISTRICT DATA/INFORMATION
• Facility Security Policy: po7440 FACILITY SECURITY
• Information Security Policy: po8305 INFORMATION SECURITY
• Information Security Risk Assessment Policy: po8305 INFORMATION SECURITY
• Social Media Policy: po7544 USE OF SOCIAL MEDIA