By Linda Dillman
Canal Winchester Schools officials are starting the new year with a checkup – a cyber checkup for the district’s information technology systems.
During the Canal Winchester Board of Education’s Jan. 22 meeting, the board approved an $18,375 agreement with DataServ to assess the district’s vulnerability by collecting data, conducting interviews and meetings, and providing a detailed final report.
“K-12 are the number one targeted accounts,” said Tom Munson, director of strategic planning. “Sixty-two percent of all these accounts involve some type of human involvement. People in education are inherently trusting and the bad actors will use that against us. Bad actors like the data school districts have. It is very clean data. They can grab it and sell it on the dark web for $200 per student record.”
According to Munson, most students do not know for years that their information was stolen until they apply for credit. He said the average ransomware payout is $500,000 and the incident generally involves three weeks of learning loss, many hours of administrative time, and costs related to the investigation and any remediation.
Also at risk is a district’s cyber insurance. Munson said what was once a policy rider is now a stand-alone policy involving assessments and lengthy applications.
“Our insurance cost is $25,000; a couple of years ago it was $8,000,” said Canal Winchester Schools Treasurer Nick Roberts. “It’s only going to keep going up. There used to be five to six vendors that would come to the table. We barely found one to two because of the K-12 risk. We see the writing on the wall. If we don’t have these things, and we don’t have an assessment, we’re not going to have cyber insurance and that’s a problem.”
The contract’s assessment categories cover engagement, administration, collaboration, computing, network, cybersecurity, and physical security. The company expects to spend 245 hours working on the project.
“DataServ’s team will continually engage your team throughout the assessment to ensure our recommendations result in developing a successful and secure IST path for the organization,” said Munson in a Dec. 27 letter to Roberts. “The end result is achieving deeper visibility so the organization is empowered to make decisions aligned to the needs of the business today and for tomorrow. The estimated timeframe for completion is 45-90 days.”
In outlining the issues prompting the assessment, there was concern about a recent cyber-attack on a neighboring district that caused their network to go down for two weeks.
In the submitted agreement, Canal Winchester expressed concern about their current state of cybersecurity, including insurance critical in protecting the district financially; execution of a response plan; policies and procedures; and information sharing.
Another concern is the proper level of IT resources and if those resources are qualified to lead the district into the future.
DataServ pointed out that visibility into support people, processes, policies and contracts…will position the district for its future with the focus on Portrait of a Graduate, new programs and tools to evaluate technology and applications.
“Bad actors come up with new things every year,” said Munson. “We try to make it difficult for the bad guys to get in. What comes out of this (assessment) is a roadmap. A complete three-year cyber security roadmap to get you up to that minimum point. Then we will give you recommendations. The final report is about 140 pages long.”
Other CW school news
The board passed a resolution establishing and maintaining a special trust fund in collecting resources to award postsecondary scholarships on behalf of the family of Marilyn “Sal” Multerer.
“I wanted to recognize the family,” said Roberts. “There’s already donations that are coming in. This lady was very instrumental in the community, in the school district.
Education was very important to her. The family is looking to contribute $50,000 in the next six months and another $50,000 in another six to 12 months to have $100,000 in the account.”
Roberts said his office is working with the guidance counselors at the high school to establish criteria in determining how the scholarships will be awarded.