LEDGER — With school systems across the state and nation relying more heavily on technology during the ongoing pandemic, cybersecurity is taking on increased importance.
At the onset of the pandemic this past March, Mitchell County Schools was subject to a ransomware cyberattack. Hackers infiltrated the district’s network and posted a ransom note, demanding payment via cryptocurrency in exchange for the return of district-owned data.
Mitchell County Schools Technology Director Casey Johnson said that while the attack wasn’t ideal, the district dodged a bullet.
The information hijacked wasn’t sensitive and remote lessons were still able to continue.
“We were really fortunate,” Johnson said. “We were the best case scenario for a bad situation.”
The attack did, however, put the school system on high alert and prompted the installation of new safeguards to further protect the system’s network.
“The thing is that it came from a third party,” Johnson said. “It’s not like a teacher got something in an email and accidentally clicked it. Teachers had no control over that actually happening. We’re tightening things down.”
As schools lean more on virtual learning, hackers are ramping up their efforts.
Mitchell County was one of three school districts in North Carolina to suffer a ransomware attack this past March. Burke County and Allegheny County Schools also reported attacks just days prior to Mitchell’s.
Surry County and Haywood County Schools reported ransomware attacks in July and August, respectively.
Johnson said MCS has tightened up its offsite access security and has moved most data to cloud storage. For data that can’t be stored in the cloud, the school system has invested in extra, more secure local servers.
In addition, all devices that students take home utilize two separate content filtering systems. Even when they access the network remotely, all student activity runs through the content filtering systems, which block content that could be malicious.
The filtering systems also monitor what students type. If a student types “red flag words” such as guns or drugs, a message is sent to school administrators so that they can take appropriate action.
Ransomware attacks are constantly evolving and come in many different forms.
Some attackers work as a group and others run their attacks solo.
Sometimes, attackers target specific organizations. Often, they send out mass messages in the hopes of someone clicking a malicious link or sharing their login information.
School systems are far from the only victims of such attacks.
Attackers have also recently and successfully targeted the county government systems of Orange, Mecklenburg, Davidson, Pasquotank, Robeson and Duplin.
The ABC Board, Richmond Community College, Onslow Water and Sewer Authority and the North Carolina State Bar have also been victims of attacks.
The uptick in attacks combined with the nation’s suddenly increased reliance on technology during the pandemic prompted legislators to include millions in last spring’s federal Coronavirus Aid, Relief and Economic Security (CARES) Act for schools to beef up their cybersecurity for the fresh academic year.
The CARES Act provided $4.5 million of funding to the North Carolina Department of Public Instruction, about $3.5 million of which was distributed to North Carolina public schools.
The act also provided approximately $550,000 to train school staff in the state on cybersecurity.
Johnson said MCS used CARES Act funding to move data to cloud storage and improve servers.
Johnson said information technology staff in small school systems across the state are unsung and largely underpaid heroes during this time.
“What the state is paying in salary for IT folks, they could go and move to the city and make triple,” Johnson said. “And, they deserve triple. The people that are staying here are people that are good at their jobs but also like the convenience of working from home and having a work schedule like their children’s schedule. Not many IT folks are doing the job for the pay.”