Grand Jury Commends SDCOE for Leadership, Support, and Innovation in Cybersecurity

A recent report by the San Diego County Grand Jury commended the San Diego County Office of Education (SDCOE) for the resources and guidance they provide county school districts and charter schools, as well as their leadership at the local and national levels in addressing cybersecurity challenges in K-12 education.

The report noted that while SDCOE has no oversight on what school districts do around cybersecurity, they “exert influence by providing a broad set of products and services to help them improve their cybersecurity readiness.”

SDCOE technology services include vulnerability assessments and remediation, setup and configuration guidance for critical security controls, cybersecurity best-practices, and post-incident review. SDCOE also offers San Diego County districts the Red Herring software solution for free to provide phishing awareness training, and risk management and insurance products are offered through the Joint Powers Authority.

“While cybersecurity attacks in K-12 have increased in both frequency and complexity over the last decade, SDCOE and its ITS Cybersecurity team have been leading the effort to meet these challenges,” said Terry Loftus, assistant superintendent and chief information officer. “It's affirming for SDCOE to receive positive recognition in this report.”

The grand jury interviewed seven districts and determined these districts are at varying stages of cybersecurity preparedness. Collectively, it rated the group of districts at a moderate level of cybersecurity readiness.

The grand jury’s findings were presented in general terms to avoid exposing any security vulnerabilities, examining human readiness, technical readiness, and organizational readiness as it relates to cybersecurity.

Human readiness refers to how prepared employees and students are to notice potential phishing attacks through suspicious emails or other means. The grand jury recommended that all employees and students, with a particular focus on new hires, receive annual cybersecurity training and implement a phishing awareness solution such as Red Herring.

Technical readiness factors they examined at each district included multi-factor authentication (MFA) and password management, patch management procedures, backup management procedures and disaster recovery, distribute denial of service protection, and vulnerability scanning.

The report noted that MFA “is one of the most critical tools in defending against cyberattacks,” and recommended all districts in the county implement these measures for all staff members.

Organizational readiness looked at the districts’ staffing around cybersecurity and technical expertise, the importance leadership placed on cybersecurity, and cyber insurance. Experience varied widely based on the district’s size. While the grand jury found there is no one-size-fits-all solution, they determined one best practice is clear: “there should be one individual who is responsible and accountable for cybersecurity readiness in the district.”

To ensure all districts in San Diego County are prepared for cyberattacks, the Grand Jury encouraged all districts to review and implement recommendations highlighted in the report.

The report concluded with recommendations for training, MFA, and cyber insurance, and recommended SDCOE continue supporting school districts and charter schools with their cybersecurity efforts.