Building a Culture for Cyber and Data Security

By Ed Snow, DPI Instructional Technology Services and Annette Smith, DPI Director of Instructional Media and Technology

As technology has advanced so has the opportunities for the bad actors to compromise our district staff and students. K-12 school districts are incredibly data rich and those seeking to do digital harm have a widening attack surface. Every single person in your school district is a potential target and vulnerable to being tricked by the bad actors.

Working to infuse cyber and data hygiene into your district's culture of learning is the most effective way to improve your district's digital security posture.

Just as the culture we create empowers students to be successful in the world they will live in, we must also utilize culture to improve cyber and data security. What can you do every day to protect digital assets and also to empower staff and students for a safe digital world. Data and cyber security have moved beyond the responsibility of our district technology staff. It needs to be a part of our daily life and culture. Here are the top 5 things an administrator can do to help make data and cyber a part of your district's culture fabric.

Training and awareness: Staff and students have a plethora of distractions daily and have to prioritize what is truly important. Cyber and data security is easy to dismiss as some else's problem. If administration leadership reﬂects the importance of cyber and data security, more people are likely to make room for it in their daily life. Dedicating time to bin building your positive cyber culture
Standard procedures: Users have unlimited resources available to them. Taking time to stop and vet apps and extensions not only helps to vet out sketchy products, it also teaches good acquisitions habits.
Risk assessment and mitigation: Take time to identify not only your physical technical blindspots, but also your human blindspots. The aforementioned training can help you determine necessary positive reinforcement training needed.
Information Sharing & Collaboration: Knowledge is power. Make time to learn about cyber and data security as well as taking time to talk about it. Shining the occasional but consistent light on cyber and data security in routine communications reminds stakeholders of the importance of cyber and data security and keeps it in the forefront of our mind.
Incident response planning: Everyone knows what to do in the event of a tornado or physical building compromise, because we practice it regularly. Responding to any form of cyber or data compromise should not be handled with a ﬁgure it out as we go mentality. By preparing to respond to a cyber or data incident you not only improve your response posture but also you emphasize the importance of cyber and data security in your culture.

The threat to school’s is real. K-12 school districts are data rich and the bad actors are well aware that school districts are often easy targets. We do have however one trump card that we can and must play. The bad actors succeed by preying on those who are uninformed and ill prepared. Fortunately education is what we do. By taking time to fold cyber and data education into our daily culture, we increase our defense posture by empowering our end users with knowledge.

For resources to help build your districts cyber and data culture please visit https://dpi.wi.gov/cyber-security

For a free webinar on creating culture of cyber and data security , please visit https://youtu.be/FgNlehsYtgY

WETL CTO clinic on Incident planning https://login.myquickreg.com/register/user/register.cfm?eventid=28381

If you would like to engage in a conversation or have questions please feel free to contact Ed Snow or Dr. Annette Smith at the Wisconsin Department of Public Instruction with any questions. [email protected], [email protected]