Threats facing K-12 schools - report
K-12 Report
A Cybersecurity Assessment of the 2021-2022 School Year
November 2022
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Contents
Who We Are 3 First-hand Data Sources 4 Intended Audience and Application 4 Executive Summary 5 K-12 Community Assessment 6
Nationwide Cybersecurity Review (NCSR) 7 Maturity Findings of the K-12 Sector 7
K-12 Cybersecurity Threat Assessment 9 Ransomware: A Persistent Threat 9 Top 10 Malware Affecting K-12 Schools 10 Initial Infection Vectors (How Threat Actors Got In) 11 Top 5 K-12 Non-malware Threats 12 K-12 Web Security Trends 12 Top 5 Recommendations 13
Services Available to MS-ISAC Members 14
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Who We Are
The Center for Internet Security, Inc. (CIS®) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation. CIS is a community- driven nonprofit, responsible for the globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. CIS is home to the Multi-State Information Sharing and Analysis Center® (MS-ISAC®), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities.
CISA focuses on the cybersecurity of all critical infrastructure within the United States
The MS-ISAC is federally funded by CISA and a division of the Center for Internet Security (CIS). The MS-ISAC is autonomously guided by its Executive Committee and member organizations. The mission of the MS-ISAC is to improve the overall cybersecurity posture of over 14,000 U.S. State, Local, Tribal,
and Territorial (SLTT) government organizations through coordination, collaboration, cooperation,
and increased communication. The MS-ISAC offers members no-cost incident response and remediation support through our team of security experts and develop tactical, strategic, and operational intelligence, along with advisories that offer actionable information for improving organizational cyber maturity.
The Nationwide Cybersecurity Review (NCSR) is
a no-cost, anonymous, annual self-assessment.
All states (and agencies), local governments
(and departments), tribal nations, and territorial governments are encouraged to participate. It is designed to measure gaps and capabilities of SLTT governments’ cybersecurity programs and is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
The MS-ISAC is a trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial (SLTT) government entities.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Who We Are 3
First-hand Data Sources
The following information details first-hand reported data from the 2021-2022 school year, as submitted to the MS-ISAC from multiple sources. Sources include the 2021 NCSR, MS-ISAC member feedback, service and direct reporting data from the CIS Security Operations Center (SOC), and threat data and analysis by the CIS Cyber Threat Intelligence (CTI) Team.
Intended Audience and Application
The intention of this report is to provide K-12 leaders, like superintendents and principals, insights that
they can use for making informed decisions around cyber risk. The information in this report can also help IT professionals prioritize cyber defense measures
to keep up with evolving cyber threats targeting school districts.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
First-hand Data Sources 4
Executive Summary
K-12 leaders and IT/cyber professionals have faced significant challenges over the last several years. The complexities of shifting between in-person, virtual, and hybrid schooling have been met with an increasingly complicated and evolving cyber threat landscape where K-12 schools have become primary targets of cyber threat actors. At the Multi-State Information Sharing and Analysis Center (MS-ISAC), K-12 schools represent more than a quarter of our more than 14,000-member organizations across the country. This MS-ISAC K-12 Report is intended to arm K-12 leaders with the information to make informed decisions around cyber risk while giving K-12 IT and cyber professionals a healthy understanding of the cyber threat landscape and practical guidance for improving cyber defenses.
If your school or district is not currently a member of the MS-ISAC, you’re missing out on some powerful no-cost and low-cost tools and resources to assist your cybersecurity program. Learn more at https:// www.cisecurity.org/ms-isac.
Karen Sorady
Vice President for Member Engagement at the MS-ISAC and a former state CISO
“One of the most powerful decisions a K-12 school district
can make is to become an active member of the MS-ISAC.
In my 35 years in the K-12 community, I have not found a better way to receive the intelligence and cybersecurity resources to help mount an effective cyber defense—and at little-to-no cost.”
John Wargo, Director of Technology at K-12 Educational Service Agency and MS-ISAC Executive Committee Member
ALERT LEVEL Threats facing K-12 schools
Guarded We assess that cyber threat actors (CTA) are highly likely to target K-12 school districts and associated data in the 2022-2023 school year, primarily as part of financially motivated cybercrime and secondarily via hacktivist-driven campaigns. Many K-12 school districts are data-rich and resource-poor, making them attractive targets for financially motivated CTAs, such as ransomware operators, and relatively easy targets for hacktivists, those who break into a computer system for politically- or socially-motivated purposes, determined to grow their reputations and name recognition.
Preparedness of K-12 schools
AVG. CYBER MATURITY
3.55 out of 7
Recommendations
K-12 organizations have limited internal resources for confronting sophisticated threats. Nearly a fifth of K-12 schools commit less than 1% of their IT budget on cybersecurity, making it difficult to address ransomware attacks that may take months and over $1 million to remediate. As a K-12 leader, you can effectively defend against ransomware and other digital threats by taking these five actions:
The K-12 community displayed an overall average maturity score of 3.55 on the 2021 NCSR’s 1 through 7 maturity scale. Results from the Nationwide Cybersecurity Review (NCSR) risk-based assessment have shown the K-12 sector is improving in its cybersecurity capabilities over time, though the sector lags behind other sectors when comparing cybersecurity program maturity.
Build Your Cyber Community
Conduct Cyber Assessments
Grow Your Cyber Intelligence
Leverage Network and Endpoint Defense Services
Implement Best Practices
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Executive Summary 5
K-12 Community Assessment
The MS-ISAC supports more than 14,000 organizational members from among U.S. State, Local, Tribal, and Territorial (SLTT) governments. More than a quarter of these members are K-12 schools and districts, which has been the fastest-growing MS-ISAC member sector for the past three years, surpassing local government in 2022 as the single largest MS-ISAC member segment, apart from the incorporated EIections Infrastructure-Information Sharing and Analysis Center (EI-ISAC). While the cyber threat against K-12 schools has increased significantly since 2020, these schools continue to face the challenges of limited personnel and financial resourcing to enact cybersecurity measures.
K-12 respondents to the 2021 NCSR reported their top five security concerns as follows:
Lack of sufficient funding
Increasing sophistication of threats
Lack of documented processes
Lack of a cybersecurity strategy
Inadequate availability of cybersecurity professionals
Budget
• The average K-12 school allocated 8% or less of their IT budget for cybersecurity
• 18% of schools dedicated less than 1% of IT budget to cybersecurity
Frequent Target of Cyber Threats
• 29% of K-12 member organizations* reported that they were victims of a cyber incident
Processes
• 37% of K-12 members* did not have an incident response plan
Cybersecurity Strategy
• 83%* had cyber insurance to mitigate their cyber risk
• 81%* had not fully implemented multi-factor authentication (MFA) • 29%* had not implemented MFA on any systems
Staffing
• 49% of K-12 schools had between one and five cyber/IT employees
*This data was derived from MS-ISAC K-12 member feedback meeting the threshold for a statistically-significant sample size, with a confidence level of 99% and a margin of error of 8%. This means that 99 out of 100 times, we could expect the same results within 4% on each side of a response.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year K-12 Community Assessment 6
Nationwide Cybersecurity Review (NCSR)
Maturity Findings of the K-12 Sector
The NCSR is designed to help organizations
obtain a baseline and annual assessments of their cybersecurity maturity according to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Numerous grant programs require completion of the NCSR in order to qualify for funding. The 2021 NCSR results highlighted numerous trends in K-12 cybersecurity maturity.
Overall
2021 saw the highest participation rate for K-12 school districts in the NCSR’s 10-year history, with 197 completing the NCSR assessment. The K-12 sector reported a 3% year-over-year average increase in maturity scoring.
High Maturity Categories
Areas where K-12 schools are generally performing well:
Identity Management and Access Control
Access to assets and associated facilities is limited to authorized users, processes, or devices and to authorized activities and transactions.
Awareness and Training
Organizations’ personnel
and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.
Business Environment
Organizations’ missions, objectives, stakeholders, and activities are understood and prioritized. This information is used to inform cybersecurity roles, responsibilities, and risk management decisions.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Maturity Findings of the K-12 Sector 7
Maturity Findings of the K-12 Sector (continued)
Low Maturity Categories
Areas where K-12 schools are generally performing poorly:
Capabilities with High Adoption Rates
• Antiviral Tools
• Endpoint Protection Tools
Capabilities with Low Adoption Rates
• Penetration Tests
• Automated Tools for Managing and Controlling
Removable Media
NIST Cybersecurity Framework Category
Protective Technologies
Supply Chain Risk Management
Data Security
Associated Best Practices to Implement
CIS Critical Security Control
CIS Control 3: Data Protection
CIS Control 8: Audit Log Management
CIS Control 10: Malware Defenses
CIS Control 11: Data Recovery
CIS Control 15: Service Provider Management
CIS Control 16: Application Software Security
Recommended Actions
Encrypt Data on Removable Media
Collect Audit Logs
Disable Autorun and Autoplay for Removable Media
Establish and Maintain a Data Recovery Process
Assess Service Providers, including review
of standardized assessment reports,
such as Service Organization Control 2
(SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes.
Conduct Threat Modeling, the process
of identifying and addressing application security design flaws within a design, before code is created.
The above categories reflect the three NIST CSF categories with the lowest maturity as reported by K-12 schools in the 2021 NCSR. These have been mapped to the corresponding CIS Critical Security Controls (not presented in order of importance). To ensure that you are meeting the minimum standard of security maturity, we recommend K-12 schools start with Implementation Group 1 (IG1) of the CIS Controls.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Maturity Findings of the K-12 Sector 8
K-12 Cybersecurity Threat Assessment
Ransomware: A Persistent Threat
Ransomware attacks are the most impactful cybersecurity threat in terms of total cost and downtime for K-12 schools and districts. As such, they are regularly reported to the MS-ISAC.
Snapshot of a
K-12 Cyber Incident
What Happened? In July of 2022 an MS-ISAC member K-12 district serving less than 5,000 students was impacted by ransomware. They notified the MS-ISAC of the incident.
How Did the MS-ISAC Respond? The CIS SOC supporting MS-ISAC members took
the initial incident report, collecting incident details, offering initial recommendations, and connecting the member to the CIS Cyber Incident Response Team (CIRT).
CIRT analyzed more than 100gb of data provided by the impacted member organization to understand actions taken by the threat actor and any indicators of compromise (IOCs). The CIS CTI team provided additional intelligence on the threat actor. CIRT provided scripts
to the impacted school district to determine
if identified IOCs were present. CIRT also provided guidance to assist with ongoing recovery efforts and identified the binary used to encrypt the files by the threat actor.
What Was the Impact? The MS-ISAC response by CIRT, CTI, and SOC teams helped the affected school district understand how to identify and investigate the threat activity. Scripts provided by CIRT helped the organization investigate additional machines. The district indicated that the MS-ISAC response was instrumental in understanding the incident timeline, developing IOCs, and obtaining necessary guidance to help restore the network.
Ransomware incidents are inherently disruptive to both in-person and remote learning
Ransomware attacks resulting in network-wide encryption make
IT systems and IT educational resources unavailable to faculty and students. The length of time they are unavailable depends on the severity of the attack and an organization’s ability to recover. Furthermore, systems oftentimes need to be taken offline to contain, eradicate, and recover from a ransomware attack. For example, one K-12 ransomware incident encrypted all the servers on the network, taking down the district’s entire IT infrastructure.
Ransomware attacks against the K-12 sector lead to in-person and virtual learning cancellations
Additionally, some K-12 ransomware attacks take months, if not longer, to remediate and can cost over $1 million. Many reported incidents involve data exfiltration and public data leaks, which can compound the impact to staff and students. In some cases, the stolen and leaked data includes sensitive personally identifiable information (PII), such as Social Security Numbers.
Cyber threat actors (CTAs) are becoming more brazen with their actions.
For example, to apply further pressure on victims to pay the ransom, threat actors sometimes email students, parents, and faculty about a ransomware attack.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 9
K-12 Cybersecurity Threat Assessment
Top 10 Malware Affecting K-12 Schools
The MS-ISAC maintains the largest database for security threats against U.S. SLTT governments, including K-12 schools. This SLTT-specific threat database is informed by hundreds of intelligence sources, including National Council of ISAC members, federal and international government partners,
as well as more than 200 commercial and open- source vendors.
5% 6%
7%
8% 8%
2% 2% 3% 3%
56%
Top 10 Malware
Shlayer CoinMiner ZeuS NanoCore
From August 2021 through May 2022, Shlayer and Coinminer were the top two malware affecting K-12 entities, making up 64% of the top 10 malware. These two threats have been opportunistically targeting K-12 entities for the last couple of years.
Shlayer
Shlayer is a type of malware that targets Apple macOS devices. It functions as a dropper for other MacOS malware and adware,
or software whose purpose is to spam victims with online ads.
The malware infects systems through malicious websites, hijacked domains, and malicious advertising or “malvertising.” It does this by posing as a fake Adobe Flash updater, a once- common piece of software. K-12 entities are at a higher risk for Shlayer infections due to the large presence of Mac computers in their networks. Currently, Shlayer has a high infection rate with a low impact; however, due to its ability to drop other malware, Shlayer could potentially cause greater impacts if other types of malware like ransomware are dropped.
CoinMiner
CoinMiner is a malicious cryptocurrency miner that
uses Windows Management Instrumentation (WMI), a legitimate function on Windows systems, along with known exploits to spread across a network. CoinMiner uses legitimate scripts to make it more difficult for K-12 organizations
to remove it. CoinMiner spreads through malicious spam (malspam) or is dropped by
other malware. Once a system
is infected, Coinminer uses the infected system’s resources to mine cryptocurrency, such as Bitcoin, Ethereum, or Monero. SLTTs with larger network resources and publicly accessible networks, such as K-12 entities, are at higher risk of infection.
Jupyter
Another notable malware is Jupyter, which was first discovered in 2020 and has spread rapidly since that time. Jupyter, also known as SolarMarker, is a malware that primarily seeks to steal data stored in browsers
such as Chrome, Chromium, and Firefox. It is highly adaptable,
and it uses several techniques to evade detection by security tools.
Agent Tesla Gh0st Kovter Delf Hupigon
Jupyter
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 10
K-12 Cybersecurity Threat Assessment
Initial Infection Vectors (How Threat Actors Got In)
The MS-ISAC tracks potential initial infection vectors for our Top 10 Malware each month based on open- source reporting. We currently track four initial infection vectors: Dropped, Malvertisement, Malspam, and Network. Some malware employ different vectors in different contexts. They are tracked as Multiple.
4% 19%
21%
56%
Top 10 Malware: Initial Infection Vectors
Malvertisement Multiple Malspam Dropped
From August 2021 through May 2022, Malvertisement remained as the top initial infection vector.
Dropped
Malware delivered by other malware already on a system that contains exploit code for known vulnerabilities, infected third-party software, or manually by a cyber threat actor.
Malspam
Unsolicited emails that either direct users to malicious web sites
or trick users into downloading or opening malware. Agent Tesla, Kovter, and NanoCore are using this technique.
Malvertisement
Malware introduced through legitimate,
but infected, advertisements. Currently, Shlayer is the only Top 10 Malware using this technique.
Multiple
Malware that currently favors at least two vectors, such as Dropped and Malspam.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 11
K-12 Cybersecurity Threat Assessment
Top5K-12 Non-malware Threats
From August 2021 through May 2022, exploitation activity—using a known vulnerability to gain access
to a system or data—made up 91% of the Top 5 Non- malware activity. The top two non-malware threats affecting K-12 entities were MobileIron Exploit Activity and ColdFusion Exploit Attempt, making up 58% of the Top 5 Non-malware seen by K-12 entities over that time period.
K-12 Cybersecurity Threat Assessment
K-12 Web Security Trends
The MS-ISAC Malicious Domain Blocking and Reporting (MDBR) service is a secure recursive DNS solution offered at no cost to K-12 schools that prevents IT systems from connecting to harmful web domains, helping limit infections related to known malware, ransomware, phishing, and other cyber threats. MDBR is funded by the Cybersecurity and Infrastructure Security Agency (CISA) for all SLTT organizations in the MS-ISAC.
9% 14%
19%
22%
36%
Top 5 Non-malware
MobileIron Exploit Activity
Cold Fusion Exploitation Attempt FxCodeShell
CTAs are expanding their use of exploits, and this trend will continue, as it allows them to conceal their presence and obtain access more easily. MobileIron Exploit Activity alert is triggered for Possible MobileIron RCE (where an attacker can run their own commands) Attempt Inbound (CVE-2020-15505). If successful, exploitation of this vulnerability can lead to remote code execution in the targeted environment. Meanwhile, a successful ColdFusion Exploitation Attempt (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631, and CVE-2013-0632) allows an
attacker to exploit default blank Remote Development Services (RDS) passwords to gain unauthorized access to server resources.
Apache Struts Exploitation Attempt ScreenConnect
2% 9%
6% 6% 17%
MDBR Blocked Activity
60%
Malware
Risky Domains C&C
Phishing
Other
DNS Exfiltration
From August 2021 through May 2022, this MS-ISAC’s cost-free service handled over 225 billion DNS requests and blocked over 423 million malicious DNS requests for the 677 K-12 entities enrolled. The top threat categories of the blocked malicious DNS requests were malware-related DNS requests and potentially malicious domains, which made up 78 percent of all blocked activity.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 12
K-12 Cybersecurity Threat Assessment
Top5 Recommendations
The K-12 community faces a persistent cybersecurity threat that demands an active defense. We recommend that K-12 public schools and districts take the following five actions to build an effective cybersecurity program able to prevent and defeat cyber attacks.
Membership in the MS-ISAC is available at no cost to K-12 public schools. MS-ISAC members have access to numerous benefits, including a 24x7x365 Security Operations Center and Cyber Incident Response Team (CIRT) offering threat intelligence; detection and response assistance; regular webinars examining critical cybersecurity issues; no-cost cybersecurity tools and resources, including a free CIS SecureSuite Membership; and timely cybersecurity advisories and notifications. K-12 schools can claim their no-cost membership at https://learn. cisecurity.org/ms-isac-registration.
Community
Join the MS-ISAC to gain a valuable partner in your cyber defense.
Join the MS-ISAC K-12 Working Group to connect with peer organizations and help improve the overall cybersecurity posture of the community.
Network and collaborate
with other cybersecurity professionals in the CIS WorkBench Community about best practices for securing the technologies you use.
Assessment
Complete the NCSR to gauge your cyber maturity.
Request information
about the abbreviated Foundational Assessment at foundationalassessment@ cisecurity.org. The 32-question Foundational Assessment is for organizations looking to assess their cybersecurity programs but have
not yet taken the more comprehensive NCSR.
Best Practices
Complete Implementation Group 1 (IG1) of the CIS Critical Security Controls to protect your organization with globally-recognized cybersecurity best practices.
Claim your no-cost CIS SecureSuite Membership to chart and guide your path toward IG1 implementation, which has proven to be between 77 and 86% effective at defending against common cyber attacks.
Intelligence
Sign up for the MS-ISAC Indicator Sharing Program to receive near real-time cyber threat intelligence you can act on.
Network
and Endpoint Defense
Implement an intrusion detection system (IDS) and endpoint detection and response (EDR) to protect your IT environment.
Learn more about Albert Network Monitoring and Management and Endpoint Security Services (ESS), solutions offered by the MS-ISAC, to see if they are right for your organization.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 13
Services Available to MS-ISAC Members
MS-ISAC membership is available at no-cost to all U.S. State, Local, Tribal, and Territorial (SLTT) government organizations. Members benefit from numerous no- and low-cost services and resources to help build and maintain effective cybersecurity programs.
Cybersecurity Services Description
Cyber Threat Intelligence
NO COST
LOW COST
Cyber Alerts & Advisories
Brief, timely emails containing information on specific cyber incidents/threats and vulnerabilities in software and hardware
✓
Quarterly Threat Report
Analysis of SLTT-focused cyber threat intelligence trends and threat forecasting
✓
Regular IOCs
Weekly, monthly reports on malicious IPs/domains
✓
White Papers
Technical papers providing relevant information on cyber threat topics
✓
Cyber Threat Briefings
Informative sessions on the cyber threat landscape to SLTTs
✓
Real-time Intelligence Feeds
Easy-to-implement real-time cyber threat intelligence indicator feeds derived from more than 200 sources and specific to SLTTs
✓
Cybersecurity Services
24x7x365 Security Operations Center (SOC)
Full-time cyber defense partner to member organizations that monitors, analyzes, and responds to cyber incidents affecting members
✓
Malicious Domain Blocking & Reporting (MDBR)
Web security service that proactively blocks network traffic to known harmful web domains, protecting IT systems against cyber threats
✓
Endpoint Security Services (ESS)
Device-level protection and response for active defense against both known (signature-based) and unknown (behavioral-based) malicious activity
✓
Albert Network Monitoring and Management
Cost-effective network Intrusion Detection System (IDS) tailored to SLTT governments’ threat profile and security needs
✓
Managed Security Services (MSS)
Cost-effective log and security event monitoring of devices like IDS/IPS, firewalls, switches and routers, services, endpoints, and web proxies
✓
Penetration Testing
Services that simulate a real-world cyber attacks on network and web applications and enable organizations to safely identify exploitable vulnerabilities.
✓
Security Best Practices
Other Member Services & Resources
CIS SecureSuite Membership
Comprehensive set of cybersecurity resources and tools to implement the CIS Critical Security Controls (CIS Controls) and CIS Benchmarks.
✓
MS-ISAC Webinars
MS-ISAC Working Groups
CIS CyberMarket
Voluntary committees focused on collaboration among SLTT organizations to help drive MS-ISAC initiatives and member enrichment and growth
A collaborative purchasing program available to SLTTs that leverages collective purchasing power of our 14,000+ member organizations to provide low-cost security solutions from industry-leading cybersecurity providers
✓
Nationwide Cybersecurity Review (NCSR)
Monthly member calls and webinars on topics of interest to the SLTT community
Anonymous, annual self-assessment designed to evaluate cybersecurity maturity and set a baseline for organizational improvement
✓
✓
✓
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Services Available to MS-ISAC Members 14
The Center for Internet Security, Inc. (CIS®) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation.
We are a community-driven nonprofit, responsible for the CIS Critical Security Controls® and CIS BenchmarksTM, globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. Our CIS Hardened Images® provide secure, on-demand, scalable computing environments in the cloud.
CIS is home to the Multi-State Information Sharing and Analysis Center® (MS-ISAC®), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities, and the Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®), which supports the rapidly changing cybersecurity needs of U.S. election offices. To learn more, visit CISecurity.org or follow us on Twitter: @CISecurity.
We’d like to thank our K-12 MS-ISAC members for their strong collaboration and hard work to improve cybersecurity across this vital community. Special thanks to the following individuals who went above and beyond to support this K-12 report: Josh Bauman, Jarrod Claar, John Flanagin, April Mardock, Raymond Medeiros, Doug Olson, Dellea Underwood, and John Wargo.
cisecurity.org
[email protected]
518-266-3460
@CISecurity
TheCISecurity
cisecurity
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year Services Available to MS-ISAC Members 15 Center for Internet Security
A Cybersecurity Assessment of the 2021-2022 School Year
November 2022
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Contents
Who We Are 3 First-hand Data Sources 4 Intended Audience and Application 4 Executive Summary 5 K-12 Community Assessment 6
Nationwide Cybersecurity Review (NCSR) 7 Maturity Findings of the K-12 Sector 7
K-12 Cybersecurity Threat Assessment 9 Ransomware: A Persistent Threat 9 Top 10 Malware Affecting K-12 Schools 10 Initial Infection Vectors (How Threat Actors Got In) 11 Top 5 K-12 Non-malware Threats 12 K-12 Web Security Trends 12 Top 5 Recommendations 13
Services Available to MS-ISAC Members 14
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Who We Are
The Center for Internet Security, Inc. (CIS®) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation. CIS is a community- driven nonprofit, responsible for the globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. CIS is home to the Multi-State Information Sharing and Analysis Center® (MS-ISAC®), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities.
CISA focuses on the cybersecurity of all critical infrastructure within the United States
The MS-ISAC is federally funded by CISA and a division of the Center for Internet Security (CIS). The MS-ISAC is autonomously guided by its Executive Committee and member organizations. The mission of the MS-ISAC is to improve the overall cybersecurity posture of over 14,000 U.S. State, Local, Tribal,
and Territorial (SLTT) government organizations through coordination, collaboration, cooperation,
and increased communication. The MS-ISAC offers members no-cost incident response and remediation support through our team of security experts and develop tactical, strategic, and operational intelligence, along with advisories that offer actionable information for improving organizational cyber maturity.
The Nationwide Cybersecurity Review (NCSR) is
a no-cost, anonymous, annual self-assessment.
All states (and agencies), local governments
(and departments), tribal nations, and territorial governments are encouraged to participate. It is designed to measure gaps and capabilities of SLTT governments’ cybersecurity programs and is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
The MS-ISAC is a trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial (SLTT) government entities.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Who We Are 3
First-hand Data Sources
The following information details first-hand reported data from the 2021-2022 school year, as submitted to the MS-ISAC from multiple sources. Sources include the 2021 NCSR, MS-ISAC member feedback, service and direct reporting data from the CIS Security Operations Center (SOC), and threat data and analysis by the CIS Cyber Threat Intelligence (CTI) Team.
Intended Audience and Application
The intention of this report is to provide K-12 leaders, like superintendents and principals, insights that
they can use for making informed decisions around cyber risk. The information in this report can also help IT professionals prioritize cyber defense measures
to keep up with evolving cyber threats targeting school districts.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
First-hand Data Sources 4
Executive Summary
K-12 leaders and IT/cyber professionals have faced significant challenges over the last several years. The complexities of shifting between in-person, virtual, and hybrid schooling have been met with an increasingly complicated and evolving cyber threat landscape where K-12 schools have become primary targets of cyber threat actors. At the Multi-State Information Sharing and Analysis Center (MS-ISAC), K-12 schools represent more than a quarter of our more than 14,000-member organizations across the country. This MS-ISAC K-12 Report is intended to arm K-12 leaders with the information to make informed decisions around cyber risk while giving K-12 IT and cyber professionals a healthy understanding of the cyber threat landscape and practical guidance for improving cyber defenses.
If your school or district is not currently a member of the MS-ISAC, you’re missing out on some powerful no-cost and low-cost tools and resources to assist your cybersecurity program. Learn more at https:// www.cisecurity.org/ms-isac.
Karen Sorady
Vice President for Member Engagement at the MS-ISAC and a former state CISO
“One of the most powerful decisions a K-12 school district
can make is to become an active member of the MS-ISAC.
In my 35 years in the K-12 community, I have not found a better way to receive the intelligence and cybersecurity resources to help mount an effective cyber defense—and at little-to-no cost.”
John Wargo, Director of Technology at K-12 Educational Service Agency and MS-ISAC Executive Committee Member
ALERT LEVEL Threats facing K-12 schools
Guarded We assess that cyber threat actors (CTA) are highly likely to target K-12 school districts and associated data in the 2022-2023 school year, primarily as part of financially motivated cybercrime and secondarily via hacktivist-driven campaigns. Many K-12 school districts are data-rich and resource-poor, making them attractive targets for financially motivated CTAs, such as ransomware operators, and relatively easy targets for hacktivists, those who break into a computer system for politically- or socially-motivated purposes, determined to grow their reputations and name recognition.
Preparedness of K-12 schools
AVG. CYBER MATURITY
3.55 out of 7
Recommendations
K-12 organizations have limited internal resources for confronting sophisticated threats. Nearly a fifth of K-12 schools commit less than 1% of their IT budget on cybersecurity, making it difficult to address ransomware attacks that may take months and over $1 million to remediate. As a K-12 leader, you can effectively defend against ransomware and other digital threats by taking these five actions:
The K-12 community displayed an overall average maturity score of 3.55 on the 2021 NCSR’s 1 through 7 maturity scale. Results from the Nationwide Cybersecurity Review (NCSR) risk-based assessment have shown the K-12 sector is improving in its cybersecurity capabilities over time, though the sector lags behind other sectors when comparing cybersecurity program maturity.
Build Your Cyber Community
Conduct Cyber Assessments
Grow Your Cyber Intelligence
Leverage Network and Endpoint Defense Services
Implement Best Practices
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Executive Summary 5
K-12 Community Assessment
The MS-ISAC supports more than 14,000 organizational members from among U.S. State, Local, Tribal, and Territorial (SLTT) governments. More than a quarter of these members are K-12 schools and districts, which has been the fastest-growing MS-ISAC member sector for the past three years, surpassing local government in 2022 as the single largest MS-ISAC member segment, apart from the incorporated EIections Infrastructure-Information Sharing and Analysis Center (EI-ISAC). While the cyber threat against K-12 schools has increased significantly since 2020, these schools continue to face the challenges of limited personnel and financial resourcing to enact cybersecurity measures.
K-12 respondents to the 2021 NCSR reported their top five security concerns as follows:
Lack of sufficient funding
Increasing sophistication of threats
Lack of documented processes
Lack of a cybersecurity strategy
Inadequate availability of cybersecurity professionals
Budget
• The average K-12 school allocated 8% or less of their IT budget for cybersecurity
• 18% of schools dedicated less than 1% of IT budget to cybersecurity
Frequent Target of Cyber Threats
• 29% of K-12 member organizations* reported that they were victims of a cyber incident
Processes
• 37% of K-12 members* did not have an incident response plan
Cybersecurity Strategy
• 83%* had cyber insurance to mitigate their cyber risk
• 81%* had not fully implemented multi-factor authentication (MFA) • 29%* had not implemented MFA on any systems
Staffing
• 49% of K-12 schools had between one and five cyber/IT employees
*This data was derived from MS-ISAC K-12 member feedback meeting the threshold for a statistically-significant sample size, with a confidence level of 99% and a margin of error of 8%. This means that 99 out of 100 times, we could expect the same results within 4% on each side of a response.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year K-12 Community Assessment 6
Nationwide Cybersecurity Review (NCSR)
Maturity Findings of the K-12 Sector
The NCSR is designed to help organizations
obtain a baseline and annual assessments of their cybersecurity maturity according to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Numerous grant programs require completion of the NCSR in order to qualify for funding. The 2021 NCSR results highlighted numerous trends in K-12 cybersecurity maturity.
Overall
2021 saw the highest participation rate for K-12 school districts in the NCSR’s 10-year history, with 197 completing the NCSR assessment. The K-12 sector reported a 3% year-over-year average increase in maturity scoring.
High Maturity Categories
Areas where K-12 schools are generally performing well:
Identity Management and Access Control
Access to assets and associated facilities is limited to authorized users, processes, or devices and to authorized activities and transactions.
Awareness and Training
Organizations’ personnel
and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements.
Business Environment
Organizations’ missions, objectives, stakeholders, and activities are understood and prioritized. This information is used to inform cybersecurity roles, responsibilities, and risk management decisions.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Maturity Findings of the K-12 Sector 7
Maturity Findings of the K-12 Sector (continued)
Low Maturity Categories
Areas where K-12 schools are generally performing poorly:
Capabilities with High Adoption Rates
• Antiviral Tools
• Endpoint Protection Tools
Capabilities with Low Adoption Rates
• Penetration Tests
• Automated Tools for Managing and Controlling
Removable Media
NIST Cybersecurity Framework Category
Protective Technologies
Supply Chain Risk Management
Data Security
Associated Best Practices to Implement
CIS Critical Security Control
CIS Control 3: Data Protection
CIS Control 8: Audit Log Management
CIS Control 10: Malware Defenses
CIS Control 11: Data Recovery
CIS Control 15: Service Provider Management
CIS Control 16: Application Software Security
Recommended Actions
Encrypt Data on Removable Media
Collect Audit Logs
Disable Autorun and Autoplay for Removable Media
Establish and Maintain a Data Recovery Process
Assess Service Providers, including review
of standardized assessment reports,
such as Service Organization Control 2
(SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes.
Conduct Threat Modeling, the process
of identifying and addressing application security design flaws within a design, before code is created.
The above categories reflect the three NIST CSF categories with the lowest maturity as reported by K-12 schools in the 2021 NCSR. These have been mapped to the corresponding CIS Critical Security Controls (not presented in order of importance). To ensure that you are meeting the minimum standard of security maturity, we recommend K-12 schools start with Implementation Group 1 (IG1) of the CIS Controls.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Maturity Findings of the K-12 Sector 8
K-12 Cybersecurity Threat Assessment
Ransomware: A Persistent Threat
Ransomware attacks are the most impactful cybersecurity threat in terms of total cost and downtime for K-12 schools and districts. As such, they are regularly reported to the MS-ISAC.
Snapshot of a
K-12 Cyber Incident
What Happened? In July of 2022 an MS-ISAC member K-12 district serving less than 5,000 students was impacted by ransomware. They notified the MS-ISAC of the incident.
How Did the MS-ISAC Respond? The CIS SOC supporting MS-ISAC members took
the initial incident report, collecting incident details, offering initial recommendations, and connecting the member to the CIS Cyber Incident Response Team (CIRT).
CIRT analyzed more than 100gb of data provided by the impacted member organization to understand actions taken by the threat actor and any indicators of compromise (IOCs). The CIS CTI team provided additional intelligence on the threat actor. CIRT provided scripts
to the impacted school district to determine
if identified IOCs were present. CIRT also provided guidance to assist with ongoing recovery efforts and identified the binary used to encrypt the files by the threat actor.
What Was the Impact? The MS-ISAC response by CIRT, CTI, and SOC teams helped the affected school district understand how to identify and investigate the threat activity. Scripts provided by CIRT helped the organization investigate additional machines. The district indicated that the MS-ISAC response was instrumental in understanding the incident timeline, developing IOCs, and obtaining necessary guidance to help restore the network.
Ransomware incidents are inherently disruptive to both in-person and remote learning
Ransomware attacks resulting in network-wide encryption make
IT systems and IT educational resources unavailable to faculty and students. The length of time they are unavailable depends on the severity of the attack and an organization’s ability to recover. Furthermore, systems oftentimes need to be taken offline to contain, eradicate, and recover from a ransomware attack. For example, one K-12 ransomware incident encrypted all the servers on the network, taking down the district’s entire IT infrastructure.
Ransomware attacks against the K-12 sector lead to in-person and virtual learning cancellations
Additionally, some K-12 ransomware attacks take months, if not longer, to remediate and can cost over $1 million. Many reported incidents involve data exfiltration and public data leaks, which can compound the impact to staff and students. In some cases, the stolen and leaked data includes sensitive personally identifiable information (PII), such as Social Security Numbers.
Cyber threat actors (CTAs) are becoming more brazen with their actions.
For example, to apply further pressure on victims to pay the ransom, threat actors sometimes email students, parents, and faculty about a ransomware attack.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 9
K-12 Cybersecurity Threat Assessment
Top 10 Malware Affecting K-12 Schools
The MS-ISAC maintains the largest database for security threats against U.S. SLTT governments, including K-12 schools. This SLTT-specific threat database is informed by hundreds of intelligence sources, including National Council of ISAC members, federal and international government partners,
as well as more than 200 commercial and open- source vendors.
5% 6%
7%
8% 8%
2% 2% 3% 3%
56%
Top 10 Malware
Shlayer CoinMiner ZeuS NanoCore
From August 2021 through May 2022, Shlayer and Coinminer were the top two malware affecting K-12 entities, making up 64% of the top 10 malware. These two threats have been opportunistically targeting K-12 entities for the last couple of years.
Shlayer
Shlayer is a type of malware that targets Apple macOS devices. It functions as a dropper for other MacOS malware and adware,
or software whose purpose is to spam victims with online ads.
The malware infects systems through malicious websites, hijacked domains, and malicious advertising or “malvertising.” It does this by posing as a fake Adobe Flash updater, a once- common piece of software. K-12 entities are at a higher risk for Shlayer infections due to the large presence of Mac computers in their networks. Currently, Shlayer has a high infection rate with a low impact; however, due to its ability to drop other malware, Shlayer could potentially cause greater impacts if other types of malware like ransomware are dropped.
CoinMiner
CoinMiner is a malicious cryptocurrency miner that
uses Windows Management Instrumentation (WMI), a legitimate function on Windows systems, along with known exploits to spread across a network. CoinMiner uses legitimate scripts to make it more difficult for K-12 organizations
to remove it. CoinMiner spreads through malicious spam (malspam) or is dropped by
other malware. Once a system
is infected, Coinminer uses the infected system’s resources to mine cryptocurrency, such as Bitcoin, Ethereum, or Monero. SLTTs with larger network resources and publicly accessible networks, such as K-12 entities, are at higher risk of infection.
Jupyter
Another notable malware is Jupyter, which was first discovered in 2020 and has spread rapidly since that time. Jupyter, also known as SolarMarker, is a malware that primarily seeks to steal data stored in browsers
such as Chrome, Chromium, and Firefox. It is highly adaptable,
and it uses several techniques to evade detection by security tools.
Agent Tesla Gh0st Kovter Delf Hupigon
Jupyter
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 10
K-12 Cybersecurity Threat Assessment
Initial Infection Vectors (How Threat Actors Got In)
The MS-ISAC tracks potential initial infection vectors for our Top 10 Malware each month based on open- source reporting. We currently track four initial infection vectors: Dropped, Malvertisement, Malspam, and Network. Some malware employ different vectors in different contexts. They are tracked as Multiple.
4% 19%
21%
56%
Top 10 Malware: Initial Infection Vectors
Malvertisement Multiple Malspam Dropped
From August 2021 through May 2022, Malvertisement remained as the top initial infection vector.
Dropped
Malware delivered by other malware already on a system that contains exploit code for known vulnerabilities, infected third-party software, or manually by a cyber threat actor.
Malspam
Unsolicited emails that either direct users to malicious web sites
or trick users into downloading or opening malware. Agent Tesla, Kovter, and NanoCore are using this technique.
Malvertisement
Malware introduced through legitimate,
but infected, advertisements. Currently, Shlayer is the only Top 10 Malware using this technique.
Multiple
Malware that currently favors at least two vectors, such as Dropped and Malspam.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 11
K-12 Cybersecurity Threat Assessment
Top5K-12 Non-malware Threats
From August 2021 through May 2022, exploitation activity—using a known vulnerability to gain access
to a system or data—made up 91% of the Top 5 Non- malware activity. The top two non-malware threats affecting K-12 entities were MobileIron Exploit Activity and ColdFusion Exploit Attempt, making up 58% of the Top 5 Non-malware seen by K-12 entities over that time period.
K-12 Cybersecurity Threat Assessment
K-12 Web Security Trends
The MS-ISAC Malicious Domain Blocking and Reporting (MDBR) service is a secure recursive DNS solution offered at no cost to K-12 schools that prevents IT systems from connecting to harmful web domains, helping limit infections related to known malware, ransomware, phishing, and other cyber threats. MDBR is funded by the Cybersecurity and Infrastructure Security Agency (CISA) for all SLTT organizations in the MS-ISAC.
9% 14%
19%
22%
36%
Top 5 Non-malware
MobileIron Exploit Activity
Cold Fusion Exploitation Attempt FxCodeShell
CTAs are expanding their use of exploits, and this trend will continue, as it allows them to conceal their presence and obtain access more easily. MobileIron Exploit Activity alert is triggered for Possible MobileIron RCE (where an attacker can run their own commands) Attempt Inbound (CVE-2020-15505). If successful, exploitation of this vulnerability can lead to remote code execution in the targeted environment. Meanwhile, a successful ColdFusion Exploitation Attempt (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631, and CVE-2013-0632) allows an
attacker to exploit default blank Remote Development Services (RDS) passwords to gain unauthorized access to server resources.
Apache Struts Exploitation Attempt ScreenConnect
2% 9%
6% 6% 17%
MDBR Blocked Activity
60%
Malware
Risky Domains C&C
Phishing
Other
DNS Exfiltration
From August 2021 through May 2022, this MS-ISAC’s cost-free service handled over 225 billion DNS requests and blocked over 423 million malicious DNS requests for the 677 K-12 entities enrolled. The top threat categories of the blocked malicious DNS requests were malware-related DNS requests and potentially malicious domains, which made up 78 percent of all blocked activity.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 12
K-12 Cybersecurity Threat Assessment
Top5 Recommendations
The K-12 community faces a persistent cybersecurity threat that demands an active defense. We recommend that K-12 public schools and districts take the following five actions to build an effective cybersecurity program able to prevent and defeat cyber attacks.
Membership in the MS-ISAC is available at no cost to K-12 public schools. MS-ISAC members have access to numerous benefits, including a 24x7x365 Security Operations Center and Cyber Incident Response Team (CIRT) offering threat intelligence; detection and response assistance; regular webinars examining critical cybersecurity issues; no-cost cybersecurity tools and resources, including a free CIS SecureSuite Membership; and timely cybersecurity advisories and notifications. K-12 schools can claim their no-cost membership at https://learn. cisecurity.org/ms-isac-registration.
Community
Join the MS-ISAC to gain a valuable partner in your cyber defense.
Join the MS-ISAC K-12 Working Group to connect with peer organizations and help improve the overall cybersecurity posture of the community.
Network and collaborate
with other cybersecurity professionals in the CIS WorkBench Community about best practices for securing the technologies you use.
Assessment
Complete the NCSR to gauge your cyber maturity.
Request information
about the abbreviated Foundational Assessment at foundationalassessment@ cisecurity.org. The 32-question Foundational Assessment is for organizations looking to assess their cybersecurity programs but have
not yet taken the more comprehensive NCSR.
Best Practices
Complete Implementation Group 1 (IG1) of the CIS Critical Security Controls to protect your organization with globally-recognized cybersecurity best practices.
Claim your no-cost CIS SecureSuite Membership to chart and guide your path toward IG1 implementation, which has proven to be between 77 and 86% effective at defending against common cyber attacks.
Intelligence
Sign up for the MS-ISAC Indicator Sharing Program to receive near real-time cyber threat intelligence you can act on.
Network
and Endpoint Defense
Implement an intrusion detection system (IDS) and endpoint detection and response (EDR) to protect your IT environment.
Learn more about Albert Network Monitoring and Management and Endpoint Security Services (ESS), solutions offered by the MS-ISAC, to see if they are right for your organization.
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
K-12 Cybersecurity Threat Assessment 13
Services Available to MS-ISAC Members
MS-ISAC membership is available at no-cost to all U.S. State, Local, Tribal, and Territorial (SLTT) government organizations. Members benefit from numerous no- and low-cost services and resources to help build and maintain effective cybersecurity programs.
Cybersecurity Services Description
Cyber Threat Intelligence
NO COST
LOW COST
Cyber Alerts & Advisories
Brief, timely emails containing information on specific cyber incidents/threats and vulnerabilities in software and hardware
✓
Quarterly Threat Report
Analysis of SLTT-focused cyber threat intelligence trends and threat forecasting
✓
Regular IOCs
Weekly, monthly reports on malicious IPs/domains
✓
White Papers
Technical papers providing relevant information on cyber threat topics
✓
Cyber Threat Briefings
Informative sessions on the cyber threat landscape to SLTTs
✓
Real-time Intelligence Feeds
Easy-to-implement real-time cyber threat intelligence indicator feeds derived from more than 200 sources and specific to SLTTs
✓
Cybersecurity Services
24x7x365 Security Operations Center (SOC)
Full-time cyber defense partner to member organizations that monitors, analyzes, and responds to cyber incidents affecting members
✓
Malicious Domain Blocking & Reporting (MDBR)
Web security service that proactively blocks network traffic to known harmful web domains, protecting IT systems against cyber threats
✓
Endpoint Security Services (ESS)
Device-level protection and response for active defense against both known (signature-based) and unknown (behavioral-based) malicious activity
✓
Albert Network Monitoring and Management
Cost-effective network Intrusion Detection System (IDS) tailored to SLTT governments’ threat profile and security needs
✓
Managed Security Services (MSS)
Cost-effective log and security event monitoring of devices like IDS/IPS, firewalls, switches and routers, services, endpoints, and web proxies
✓
Penetration Testing
Services that simulate a real-world cyber attacks on network and web applications and enable organizations to safely identify exploitable vulnerabilities.
✓
Security Best Practices
Other Member Services & Resources
CIS SecureSuite Membership
Comprehensive set of cybersecurity resources and tools to implement the CIS Critical Security Controls (CIS Controls) and CIS Benchmarks.
✓
MS-ISAC Webinars
MS-ISAC Working Groups
CIS CyberMarket
Voluntary committees focused on collaboration among SLTT organizations to help drive MS-ISAC initiatives and member enrichment and growth
A collaborative purchasing program available to SLTTs that leverages collective purchasing power of our 14,000+ member organizations to provide low-cost security solutions from industry-leading cybersecurity providers
✓
Nationwide Cybersecurity Review (NCSR)
Monthly member calls and webinars on topics of interest to the SLTT community
Anonymous, annual self-assessment designed to evaluate cybersecurity maturity and set a baseline for organizational improvement
✓
✓
✓
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year
Services Available to MS-ISAC Members 14
The Center for Internet Security, Inc. (CIS®) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation.
We are a community-driven nonprofit, responsible for the CIS Critical Security Controls® and CIS BenchmarksTM, globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. Our CIS Hardened Images® provide secure, on-demand, scalable computing environments in the cloud.
CIS is home to the Multi-State Information Sharing and Analysis Center® (MS-ISAC®), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities, and the Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®), which supports the rapidly changing cybersecurity needs of U.S. election offices. To learn more, visit CISecurity.org or follow us on Twitter: @CISecurity.
We’d like to thank our K-12 MS-ISAC members for their strong collaboration and hard work to improve cybersecurity across this vital community. Special thanks to the following individuals who went above and beyond to support this K-12 report: Josh Bauman, Jarrod Claar, John Flanagin, April Mardock, Raymond Medeiros, Doug Olson, Dellea Underwood, and John Wargo.
cisecurity.org
[email protected]
518-266-3460
@CISecurity
TheCISecurity
cisecurity
K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year Services Available to MS-ISAC Members 15 Center for Internet Security
