How School Districts Can Take Incident Response Planning to

“Crandall is a very fast-growing district, and that growth impacts our systems,” says Teamann. “That audit helped us understand what we have, and where and what attackers might see as low-hanging fruit.”

With their immediate needs identified, Teamann and Banks secured buy-in from district leadership, including the school board and superintendent. They also approached vendors about long-term partnerships that might ease the cost of ownership of security products and services.

Teamann gained assurance that the vendor would be there when the going got tough. “We didn’t want them to just see Crandall as just another number in a time of crisis; we needed them to think, ‘It’s Amber, she needs us,’” she says.

Protect, Detect, React: “Whatever It Takes”

The tools that Crandall eventually deployed reflect industry best practices, from a Barracuda email-filtering solution to deter phishing attacks to SentinelOne endpoint security and automated incident-detection products.

According to Sander, this step is critical. “Leveraging technology enables a lightning-fast response to any cyberthreat at every step, including protection, detection, response and recovery,” he explains.

When Banks and Teamann updated the district’s incident response strategy, they also met with stakeholders across the district to ensure everyone knew their roles and responsibilities. They now regularly hold tabletop exercises and other activities designed to prepare the staff for a range of attack scenarios.

“We go over things like what to be cognizant of and what not to fall for when you get a suspicious email,” Banks explains. “We also address how to respond in the event of a breach. Just like the students have to do fire drills, we’ve got to do our cybersecurity drills.”

Crandall also has implemented Veeam backup solutions both locally and offsite, and the district has cyber liability insurance to help cover the cost of recovery in the event of a successful attack. As with the other components of their incident response plan, Banks and Teamann say they consider these investments an integral part of the business of protecting students.

“Our entire reason for being here in IT is to support our learners and support our campuses,” Teamann notes. “If there is something we can do to be proactive and prevent our district from going offline, to me it’s worth it — whatever it takes.

Keep this page bookmarked to keep up with all of EdTech‘s Cybersecurity Awareness Month coverage, including featured articles on incident response plans.