Key Finding 3: Focus on collaboration and information sharing

Completed

In this unit, you discover a growing network for support, collaboration, and information sharing around cybersecurity in K-12 education. This focuses on CISA Key Finding 3: No K-12 entity can single-handedly identify and prioritize emerging threats, vulnerabilities, and risks. You discover and identify ways to collaborate at both the local and national levels and learn how to find your own state agencies and associations.

Focus on collaboration and information sharing

As a school leader, one way you can effectively combat ever-present cybersecurity challenges is to emphasize collaboration and information sharing within your cybersecurity networks. Through collective knowledge and shared insights, K-12 organizations can stay informed of emerging threats and allocate their limited resources strategically. With this approach, you and your IT team can make informed decisions and fortify your defenses against potential risks, ultimately safeguarding sensitive data and providing a secure digital environment for students and staff alike.

CISA recommends that K-12 school leadership teams join a growing, active network of cybersecurity collaboration groups. Membership in these groups provides several benefits, including:

• Enhanced security: Cybersecurity collaboration groups often focus on sharing best practices, threat intelligence, and security resources, allowing you to gain access to valuable information and strategies to strengthen their security posture.
• Knowledge sharing: Collaborating with other schools and organizations in the network allows schools to learn from the experiences of others, gain insights into emerging threats and trends, and exchange ideas on effective cybersecurity measures.
• Professional development: Many groups offer training programs, workshops, and seminars for their members, allowing you to stay up to date on the latest practices and technologies.
• Incident response and recovery support: In the event of a cybersecurity incident, being part of a collaborative network can provide schools access to incident response frameworks, guidelines, and experts who can help manage and recover from cyberattacks.
• Partnerships and advocacy: Joining a network enables schools to build partnerships with other educational institutions, industry professionals, and cybersecurity experts. These partnerships foster advocacy for stronger cybersecurity measures in the education sector, increase awareness about digital threats, and facilitate cooperation on cybersecurity initiatives.
• Compliance and regulatory guidance: Cybersecurity collaboration groups often stay up to date with relevant regulations, standards, and compliance requirements. By being part of such a network, schools receive guidance and resources to align their cybersecurity practices with legal and industry requirements.

Information sharing organizations, like K12 SIX, facilitate the sharing of time-sensitive information about incidents and threats facing K-12 organizations with trusted peers in an accurate and secure manner.

Next steps

1. Explore the following cybersecurity information sharing groups vetted and recommended by CISA.

   • K12 Security Information eXchange (K12 SIX): A national non-profit organization solely dedicated to protecting the K-12 community—including school districts, charter schools, private schools, and regional and state education agencies—from emerging cybersecurity threats.
   • Multi-State Information Sharing and Analysis Center (MS-ISAC): A free and voluntary membership for state and local governments, public K-12 education entities, public institutions of higher education, and any other non-federal public entity in the US.

2. Find state programs and state emergency planners that can provide school safety expertise specific to each state. To begin, visit the Schoolsafety.gov State Search Tool and select your state. Save any local programs, resources, and contacts for future reference.

3. Make a list of next steps you’ll need to take to join a collaboration, and which members of your team will be responsible for each step.

Partner to build a cybersecurity network

Partnerships with regional and national cybersecurity organizations, like CISA and the Federal Bureau of Investigation (FBI), offer schools of all sizes an exceptional opportunity to expand their cybersecurity network. Collaborating with these esteemed entities allows schools to tap into a wealth of expertise, resources, and guidance.

Aligning with these reputable cybersecurity organizations demonstrates a commitment to safeguarding sensitive student data and promoting a secure educational environment. Together, these collaborative efforts foster a stronger cybersecurity network, enabling schools to better protect their digital assets and defend against evolving cyber risks.

CISA recommends that K-12 schools report every cyber incident, every time. Reporting cybersecurity incidents, phishing attempts, malware, vulnerabilities, and cybercrimes provides several benefits, including:

• Mitigating further damage: Reporting incidents promptly allows a school's IT department or relevant authorities to take immediate action to mitigate the damage.
• Identifying patterns and trends: Reporting incidents helps to identify patterns and trends in cyber threats. Analyzing reported incidents allows schools and relevant cybersecurity organizations to identify common attack vectors, tactics, and indicators of compromise.
• Enhancing incident response capabilities: Reporting incidents helps schools refine their incident response capabilities. It allows IT teams to assess the effectiveness of existing security controls, identify areas for improvement, and fine-tune incident response plans.
• Legal and regulatory compliance: Reporting cyber incidents is often a legal and regulatory requirement. Many jurisdictions have data breach notification laws that mandate the reporting of security incidents involving personally identifiable information (PII).
• Deterrence and law enforcement: Reporting cybercrimes and incidents to appropriate law enforcement agencies contributes to deterrence and helps in holding perpetrators accountable. Schools play a crucial role in assisting law enforcement with investigations by reporting cybercrimes promptly.

Building a strong and enduring relationship with CISA and FBI regional cybersecurity personnel opens an avenue for mitigating damage, improving incident response capabilities, and contributing to the deterrence of cyber threats against schools.

Next steps

1. Explore a few resources to help you connect with regional agencies and build a strong and enduring cybersecurity network.
   • Internet Crime Compliant Center (IC3): File a complaint or report with the FBI if you have fallen victim to cybercrime and get educated about the latest and most harmful cyber threats and scams.
   • Report to CISA: CISA provides a secure means for reporting cyber incidents, phishing attempts, malware, and vulnerabilities.
   • CISA Regional Offices: Get connected with CISA Cybersecurity Advisors. To start, find and contact your regional office.
2. Reflect on your organization’s past cyber incidents. In the past, how has your organization reported cyber incidents, phishing attempts, malware, or vulnerabilities? Where do you think your organization is strong in its cybersecurity network, and where do you see opportunities?