Establishing a Proactive Defense Against Evolving Cyber Threats

• By Melissa Tebbenkamp
• 05/22/25

Cybersecurity is the process of protecting your systems and your data from unauthorized access or attack. The fact that people play such a significant role in cybersecurity makes it much more than just a technology function. For K-12 school leaders, this means fostering a culture of cybersecurity awareness, where every member of the school community — from students and teachers to administrators and support staff — understands their role in safeguarding sensitive information.

If your technology department handles all things related to cybersecurity, then you've already lost the game because successful data security and cybersecurity requires all stakeholders within the organization — leadership included — to create and maintain a culture of "trusted data."

So, what is trusted data, you ask? Well, we all know that the educational system relies heavily on data. We use data for operations, to help guide instruction, to monitor achievement, and for many other activities. The data itself must have integrity, and its accuracy must be trusted — from the person who is entering it, to systems that store and process it, to the person who is using it.

The data also has to be safeguarded in a world where cybersecurity threats are lurking around every corner. By creating a culture of data focused on keeping the information safe and trusted, schools can begin to prioritize cybersecurity investments, ensuring that adequate resources are allocated to both technology and human capital, and establish a proactive defense against evolving cyber threats.

Here are six good starting points for K-12 districts that want to improve their cybersecurity mitigation strategies and take a more proactive approach to mitigating risk:  

1) Constantly monitor your network and know the triggers.

When we conduct cybersecurity evaluations for schools, one of the biggest questions we ask is, "Do you know what normal looks like?" Because if you don't know, how do you know when something's going wrong? How do you know when there's just a slight uptick in traffic going out because somebody is siphoning off data? By staying abreast of the situation, you can be sure what those systems should and shouldn't be doing. That way, as soon as the uptick starts, you recognize the trigger and take immediate action.

2) Restrict privileged accounts to only those who need it.

Use multifactor authentication (MFA) to ensure only authorized users can access, change, and use the data. If a malware program tries to execute on a device that it doesn't have permission to execute, they'll be stopped in their tracks at that point. When you restrict access, you force the bad actors to work even harder to infiltrate your systems. There are a couple different approaches you can use to manage privileged accounts. One is to make sure all privileged accounts have MFA — a step that we highly recommend no matter which approach you go with. Privileged accounts should also be prompted to reset their passwords periodically as yet another safeguard that helps keep cybercriminals on their toes and away from your accounts.

3) Always back up your data.

School districts are getting better with their backups, which is why many attackers and cyber criminals are changing their approach. There was a time when many districts did not use secure backups so they couldn't restore from backups and recover from ransomware attacks, for example. They would just pay a ransom to get their data back. As schools get better at backing up, most do not need to pay the ransom because they just restore their encrypted backups and move on. This allows schools to restore the backup in a controlled environment and reduce any risk of the hackers re-triggering that IT attack.  

4) Use the cybersecurity tools at your avail.

CoSN adapted the higher education Cybersecurity Vendor Assessment Tool (CVAT) to create a more streamlined version tailored for K-12 schools. This tool helps schools assess the cybersecurity and data security practices of their vendors. Vendors complete the assessment once and can then share it with any school that requests it. As a district, you have to know what you're looking at to know whether or not their answers meet your needs and whether or not they answer appropriately to what I call my non-negotiables. Within the last year CISA also launched the K-12 Secure by Design Pledge, which is another useful tool for vetting vendors. This is basically the federal approach to helping schools on this journey to finding safe tools. Some vendors have signed on to the pledge, which incorporates some very good best practices.

5) Ask about your vendors' own data security practices.

At a very minimum, districts should review the best practices that CISA recommends for vendors and integrate those into the questions that they ask vendors as they're vetting them. For example, the NIST Cybersecurity Framework is a widely adopted standard for organizing and measuring security programs. This framework is complemented by compliance with various privacy regulations such as GDPR, and COPPA, and modern engineering practices and continuous innovation in security that assists schools in ensuring their FERPA compliance.

6) Create plans and practice your response.

If you don't practice and do scenario planning, you really won't know how to respond when something happens. As part of the planning process, districts may also have a natural disaster response plan that requires regular testing. Create those plans and practice them. This will help you determine which do and don't meet your school's needs and will help you refine the plans on a constant, predictable cycle. These regular simulations and debriefings will help everyone understand their respective roles and responsibilities, fostering more effective responses in real-world scenarios.

Start with the Easy Wins

Many believe cybersecurity stifles innovation, but that's not the case. When you take a problem-solution center approach, innovation thrives in a safe, secure environment. By tackling it in small steps and starting with quick, impactful wins, you can maintain both security and progress. When you can show staff that it's not only safe but doable, you'll be able to get more people supporting an all-important culture of trusted data.

Districts should also find an accountability partner that supports the effort. It's pretty easy to just say you're going to do something and then run into stumbling blocks that impede progress.

Schedule it, send out calendar invites, and then hold those appointments sacred versus just continually "pushing them to next week." Finally, do the work in small chunks; you'll be surprised at the progress you can make within a short period of time.