|
It is 10:17 a.m. on a Tuesday.
Teachers suddenly cannot take attendance. The student information system is unavailable. Email is down. Staff cannot access shared drives. The transportation department is having trouble reaching routing information.
Then someone notices the message… “Your district has been hit by ransomware.”
Now what?
Who has the authority to shut down systems? Who calls the superintendent? When do you contact law enforcement? Does the school board need to know? What do you tell employees? Parents? The media? Your cyber insurance carrier?
And here is an especially uncomfortable question: If email and your network are unavailable, how are all of those people going to communicate with one another?
Happy Cybersecurity Awareness Month.
Having a Plan Is Not the Same as Being Ready
Most districts understand that they need a cybersecurity incident response plan. Somewhere, hopefully, there is a document explaining what should happen when things go wrong. But there is a significant difference between writing the plan and actually being able to execute it.
CISA's K-12 cybersecurity guidance recommends that every school organization establish and regularly exercise a written incident response plan. The agency specifically recommends attack simulations, often called tabletop exercises, involving the people identified in the plan. The idea is simple: successful teams rehearse before the emergency arrives.
Schools understand this concept better than almost anyone. We don't create a fire evacuation plan and assume everyone will figure it out when they smell smoke. We practice.
We conduct lockdown drills. We prepare for severe weather. We rehearse reunification procedures. Cybersecurity deserves the same muscle memory.
Put the Right People Around the Table
A cybersecurity tabletop exercise is not an IT department meeting.
Certainly, your technology leaders need to be there. But so should the superintendent, communications, operations, business officials, legal counsel and anyone else who will have a meaningful role during an actual incident.
Then give them a scenario.
The network is unavailable.
What do you do first?
Twenty minutes later, someone reports that confidential student information may have been accessed.
Now what?
Ten minutes after that, a reporter calls the communications office asking whether the district has suffered a data breach.
What do you say?
You are not trying to “win” the exercise. You are trying to discover the questions nobody thought to answer when the incident response plan was written.
Who makes the decisions? Who has current contact information? Where is the offline copy of the plan? How do you communicate if your normal communication tools are unavailable? Which vendors need to be contacted? Who knows how to reach your cyber insurance provider? What information can be shared publicly, and who has authority to share it?
That is where the value lives.
Find the Problems While They Are Still Hypothetical
A tabletop exercise should uncover gaps. In fact, you should be a little disappointed if it doesn't.
Maybe the emergency contact list includes someone who left the district eight months ago. Maybe everyone assumed the superintendent would make a certain decision, while the superintendent assumed the CTO would. Maybe your communications plan depends entirely on systems that could disappear during the very incident you're planning for.
CISA's tabletop guidance even warns about surprisingly basic problems: teams failing to have the incident response plan available during the exercise, outdated contact lists, unclear incident leadership and forgetting important stakeholders.
Those are inexpensive problems to discover on a Wednesday afternoon around a conference table. They are much more expensive to discover at 10:17 on the worst Tuesday of your year.
And districts do not have to invent an exercise from scratch. CISA provides free tabletop exercise packages, including scenarios involving ransomware, phishing and other cybersecurity threats, along with facilitator materials and after-action templates.
Practice Recovery, Too
The exercise should not end when someone says, “We restored from backup.”
Can you, really? CISA recommends not only backing up critical systems but regularly testing restoration of those backups. That may be one of the most important questions leaders can ask their technology team: When was the last time we actually restored something from our backup system?
A backup strategy that has never been tested contains an uncomfortable amount of hope.
Cybersecurity Awareness Month will bring plenty of reminders about passwords, phishing and multifactor authentication. All of those things matter. But perhaps one of the most valuable things a district leadership team can do this October is simpler. Pick a day. Put the right people in a room. Turn to page one of your incident response plan and say: “It is 10:17 a.m. Our systems just went down. What happens next?”
The scariest cybersecurity plan isn't the one with a few holes in it. It's the one you don't discover has holes until you need it.
| 
