The White House Back-to-School Cybersecurity Summit focused national leaders around a charged issue: Cyberattacks are increasingly and indiscriminately threatening the security of K-12 schools, educators, and students, as evidenced by the 1,619 reported cyberattacks on these institutions between 2016 and 2022.  

The Biden Administration continues to advance grounded solutions and actively engage with industry to consult and provide intelligence and free resources to better secure K-12 cyber infrastructure. This deep industry involvement is crucial for many reasons, particularly because K-12 cybersecurity isn’t ‘one size fits all,’ and as important as funding is, so is the know-how to make the best use of it. 

As I like to say, tools before strategy and you’re headed for tragedy. While big sums of funding get headlines, it’s the thoughtful, planned action that really makes cyber space secure, and that’s reflected in the Administration’s initiatives.  

The White House’s plan includes a Department of Education Government Coordinating Council (GCC) that will bring together and coordinate formal activities amongst leaders of all levels of government and the education sector, across tribal, territorial, local, state, and federal bodies. Another key aspect of the plan is Cybersecurity & Infrastructure Security Agency’s (CISA) commitment to providing tailored assessments and training for 300 K-12 institutions and 12 K-12 cyber exercises in just the coming school year alone.  

The Biden Administration’s initiatives drive to the heart of this need for expert guidance, and luckily the cybersecurity industry already has a history of meaningful government cooperation to improve U.S. cyberspace. For example, intelligence sharing U.S. nonprofit the Cyber Threat Alliance (CTA) was chartered by major cyber industry leaders, including Palo Alto Networks, that recognized the need to coordinate efforts on emerging threats and broadly improve the digital ecosystem. Palo Alto Networks has also long invested in improving K-12 cybersecurity through its programming, partnerships, and resources, which are centered in part on building up a sufficient workforce by expanding opportunity and disseminating knowledge through high-quality training initiatives like Cyber Academy and Cyber Aces. Palo Alto Networks also works closely with agencies, particularly CISA and the Department of Homeland Security (DHS), as a vendor but also as a collaborative partner on addressing academic, mentorship and workforce development issues.  

What we’ve found is that each and every K-12 institution, whether big or small, urban or rural, is at risk of a cyberattack. That’s no surprise when resources for K-12 institutions are consistently scarce – only 6 percent of education leaders surveyed for the 2022 State EdTech Directors Association’s Trends Report agreed that their state provides ample cybersecurity funding. But just as each institution is different, the means to identify, mitigate and respond to these attacks varies immensely by school. Many are modernizing their infrastructure to take advantage of the opportunities that rapid technological changes like AI pose, but the rate of these changes also fosters uncertainty around the rising risks from those same technologies. Take ChatGPT as an example – it only emerged a year ago and it’s already roiled entire industries across the economy, leading simultaneously to some of the biggest labor strikes and business efficiencies we’ve ever seen. 

Many of K-12’s cybersecurity challenges lay in the growing sophistication and profitability of attackers and the ever-expanding footprint of institutional digital infrastructure. Attackers are now timing their threats for maximum disruptive impact for schools, and new vulnerabilities abound with our increasing reliance on the cloud, remote learning and a huge range of new devices, third party vendors and applications.  

The profitability equation of K-12 cyber threats has also shifted dramatically, as technology enables automated attacks that can be set to run with minimal ongoing effort. This same AI technology also enables us to let computers to do much of the heavy lifting to protect our networks from threats, however there will always need to be a human element – we need experts who can handle the real threats that escalate, and understand the evolving cybersecurity landscape, such as next-generation firewalls, secure access service edge, and incident response planning. 

All in all, the White House’s Summit drew great excitement for advancing real, concrete measures and drawing attention to achievable solutions. The K-12 sector is eager for the funding that comes with it, but also the intellectual support that can guide them to realizing their goal of intentional cybersecurity, with an understanding of K-12’s unique dynamics: 

• Awareness and Urgency: Educational continuity is on the line as is data security and the safety of students both within and beyond school premises.  
• Resource Allocation and Expertise: Adequate resources are needed to empower cybersecurity practitioners by investing in cutting-edge tools, recruiting adept experts in a competitive talent landscape, and fostering a secure operational environment. 
• Sustained Commitment: For many, laptops are the new classroom, and that calls for integrating cybersecurity seamlessly into each institution’s fabric. Just as fire drills prioritize student safety, cybersecurity should be ingrained in daily practices and marked by incident response plans and routine preparedness exercises. 

These unique challenges and the White House initiatives both underscore the importance of the cybersecurity community providing accessible, meaningful, and continued support as K-12 institutions modernize their cybersecurity.  

These educational institutions need to assess their existing needs and devise a comprehensive cybersecurity plan. Essentials to implement include next-generation firewalls, advanced URL protection, DNS security, multi-factor authentication, rigorous patch management, as well as an incident response plan and continuing cybersecurity awareness through training and strong password practices. We always say it’s “when” not “if” a school is cyber attacked, so if your school isn’t on the path to being cyber secure today, it’s critical to be proactive and take that first step today.  

The author, Fadi Fadhil, is Palo Alto Networks’ Field Chief Technology Officer.