Getting through the school day is impossible without technology. Teachers, staff, and students use tablets, computers, and phones every day. But there’s also hidden technology everywhere in our schools and classrooms, including cameras, printers, smart boards, and streaming devices.
The collection of these connected devices in your network is called the “Internet of Things” (IoT), and they can pose a significant risk to your school district.
Cyberattacks against K-12 school districts are on the rise, and one sneaky way cybercriminals can access your networks is through IoT devices. As technology evolves, these devices become more sophisticated. When the devices connect to your network, it creates a point of vulnerability that cybercriminals love to exploit.
For example, many schools now have security cameras. These cameras are essential in keeping your students safe throughout the school day, but they are also a portal for cybercriminals to access your network, especially if they have local network service protocols enabled. Some cloud-controlled cameras can reduce attack surface by either limiting or eliminating local network services entirely, but these continually reach out to cloud environments, which can lead to exposed security camera footage if the vendor is ever hacked.
Bad actors can access unsecured cameras, and from there “move laterally” to other devices in your network that they are targeting. For example, your Domain Controller (DC), Student Information System (SIS), or the Chief Business Officer’s (CBO) laptop.
Cameras are just one type of IoT device. Any device that connects to your network is a potential vulnerability that hackers can exploit. Even streaming devices such as Chromecast, Apple TV and Amazon Fire TV Stick are vulnerable.
Here are a few reasons why your IoT devices may be particularly at risk:
Although cameras, printers, and streaming devices come out of the package with security protocols installed, it’s hard to keep them secure for the long term. Every time there is a shift in the cybersecurity landscape, those security systems need to be updated. It’s important to install security patches in a timely manner… if they are available. But often, the manufacturers of these devices are not offering much needed patches, leaving them vulnerable to evolving cybersecurity attack techniques.
As the number of IoT devices is skyrocketing at most districts, before you know it there are dozens, if not hundreds of these devices spread across all the campuses in your district. It can be close to impossible to keep track of every one of these devices. Keeping the firmware up to date for that many devices is a lot of upkeep. Too many devices will also congest your network, making it more difficult to spot issues when something comes up.
Devices such as printers typically enable every service available by default, whether you’re using them or not, such as SSH, FTP, HTTP, and SNMP 1&2. Often, these services can’t be disabled in a centralized fashion, requiring IT admin staff to manually disable them on the printer itself, which consumes IT resources. These services/protocols can be a helpful way for network administrators to remotely fix issues with devices, but they also offer cybercriminals a direct portal to hack into your network.
Make sure to update all firmware and install security patches from the manufacturers. After that, assess the security level provided by your current devices and replace them with more secure solutions if necessary.
A Managed Security Service Provider (MSSP) provides monitoring and management of all devices and systems, including your IoT devices. Although it may seem more effective to DIY your cybersecurity protection, using an MSSP is easier, more scalable, and typically more budget friendly.
Securus360’s Managed eXtended Detection and Response (MXDR) solution provides not only monitoring and management but also threat hunting, investigation, and full-service Security Operations Center (SOC) response. Securus360 MXDR uses multi-vector monitoring to secure your entire district and close gaps in your network. This includes all points of vulnerability from IoT devices. With AI-powered monitoring, you can sleep soundly knowing your network is continually being scanned for even the latest and most advanced threats. And Securus360’s SOC team of cybersecurity experts will investigate, verify and contain threats in real time.
Even though IoT devices can pose a major cybersecurity threat, that doesn’t mean we have to stop using them. With consistent, thorough monitoring, a partner like Securus360 can keep your K-12 school district secure for the long haul.