Keeping Schools Safe Takes All of Us

On average, five school districts across the United States are hit by cyberattacks every week. Why are schools so frequently targeted by cybercriminals? Simply put, schools are "high-value, data-rich, resource-poor" targets, says Corey Lee, a Microsoft K–12 cybersecurity expert. This means schools hold a lot of sensitive data and have valuable assets, including students' personal information, such as addresses, photographs, birthdays, and more, that scammers target to extort money from schools.

These school attacks often work because of just a few simple tactics:

• Staff, students, or parents clicking on an unfamiliar link or phishing email, instead of pausing to consider whether they are legitimate.
• If people use the same login credentials for multiple accounts, and credentials are compromised in some way, data leaks of unrelated systems can be used to infiltrate school platforms.
• Trusting edtech companies with sensitive data without using proper safeguards to protect from breaches.

Attacks may be less likely when everyone follows recommended cybersecurity practices. Through collaborative effort, students and their families can do their part to reduce risk by practicing good cyberhygiene, including using strong passwords (which can be easier to do using a password manager), setting up multifactor authentication, and questioning suspicious links by taking just nine seconds to examine the source and look for unusual domains or requests.

Microsoft's Lee recommends three easy and effective steps to maintaining cybersecurity:

1. Download reputable antivirus or security software on your mobile device, which can help identify potentially malicious websites and online threats.
2. Use multi-factor authentication or a phishing-resistant authenticator, like a passkey. You use a lock and deadbolt to help keep your home safe, so why should your accounts and personal information be any different?
3. Complete a cyberhygiene education course. Learning what warning signs to look for in phishing attempts and dangerous websites is an important step in helping reduce cybersecurity risks.

Teachers can make cybersecurity a classroom effort by integrating Common Sense Media's free privacy and safety courses into their curriculum, fostering an environment where students feel comfortable asking questions or speaking up if they see something unsafe online.

Global Cyber Alliance's Cybersecurity Toolkit is full of free resources for individuals and organizations to learn how to keep their information safe. For high school students, we recommend checking out CyberFlex by the GCA. This is a resource designed for young adults to learn and share about cybersecurity and online scams.

Lee also recommends subscribing to an identity monitoring service as another great preventive measure. Although these services are most commonly used to avoid credit card fraud, identity monitoring services can help individuals identify whether personal information, such as phone number, email address, or even Social Security number, may have appeared in known data breaches or monitoring databases.

While most credit cards and the credit bureaus -- Equifax, Experian, and TransUnion -- offer monitoring services for free, there are many companies such as Aura and LifeLock offering paid, comprehensive monitoring alongside various online safety and security tools depending on you and your family's needs.

Ultimately, protecting personal information from cyberthreats not only helps individual households, it can also help to keep entire schools safe from scams and attacks. Cyber defense in schools isn't solely the IT department's responsibility; it also relies on each individual's caution.

And finally, don't be ashamed or embarrassed about online scams and fraud. We are all vulnerable. If you think you or your child may have clicked a phishing link, shared personal information, or been scammed, act quickly. Report the incident to your school or district IT team, avoid engaging further with the suspicious message, change any affected passwords, and turn on multi-factor authentication.

You can also visit Take9's "Got Scammed?" page, which points to the Better Business Bureau Scam Survival Toolkit for step-by-step guidance on limiting damage and deciding what to do next. Keeping these suggestions in mind, parents, students, and teachers alike can work together to keep their school communities safe from cyberattacks.

Ready to take the next step towards greater online safety? Check out Consumer Report's Security Planner to get a customized plan based on your devices and concerns.