Antivirus software, firewalls and other solutions are a necessity for any organisation operating in the digital age, and your school likely already has a range of systems in place to protect your systems.
However, even top-of-the-line security systems aren’t a foolproof way to protect your school – not when research shows that 88% of data breaches can be traced back to ‘human error’
Often called the ‘weakest link’ in an organisation’s cyber security efforts, well-meaning, uninformed, or distracted humans can pose one of the greatest threats to your security, but this doesn’t have to be the case.
Rather than thinking of your community as a ‘weak link’, consider that they’re actually one of the most important lines of defence between your school and any number of cyber threats, alongside your dedicated security systems.
Arming your staff, students and parents with the skills and knowledge to detect and avoid cyber threats can greatly reduce security risks to your school – and can help them keep their personal information safe online as well.
So, where do you start improving cyber security in your community?
Before launching into anything, you need to evaluate where your school is in its cyber-security journey. If you haven’t recently undertaken some form of evaluation, doing one is a great way to identify potential gaps in your security efforts so that you know what risks and education opportunities should be addressed first.
There are a number of different frameworks available to measure an organisation’s cyber security maturity level. For some common starting points, you could consider:
Both of these models, along with many others available online, provide specific guidance on progressing from one stage to the next. A lower maturity level generally signifies a greater vulnerability to common incidents, whereas a higher maturity level necessitates attackers to employ more advanced tools or techniques to breach systems or data.
For this reason, the steps for earlier stages are crucial in defending against the most common attacks, so don’t try to skip ahead. Any further stages will build on the knowledge and awareness required for early stages, and none of the recommendations will be instant fixes – time and effort will be needed for any changes to school culture around cyber security.
Once you’ve measured your school’s security maturity level, you’ll have a better idea of what risks to target first and be able to better tailor your efforts to the current level of knowledge across your community.
Now that you know what you want to address first, it’s time to consider who will lead this charge. As we’ve discussed before, getting the right person to influence change in your school can make a huge difference.
With a single person leading cyber security awareness initiatives, you reduce the risk of missed messages and make it easier for people with questions to know who to talk to.
This doesn’t have to be an expert - it can be anyone at your school who’s interested in learning more about security and is willing to spread awareness.
As it’s common for people to think of cyber security as purely a technical issue, it's advantageous to have someone outside of the IT department champion the importance of security and help make people aware that everyone, not just the IT team, has a part to play.
There’s a very common but often not considered side effect of conducting security training or improving awareness – the rush of ‘confessions’ and reports that come through all at once.
Before you launch any education efforts, it’s important to nail down a process for how people can report an incident, ask questions, or even just flag something they’ve noticed. If you already have a process in place, make sure it will be able to handle a potential onslaught of new reports.
If you don’t make it clear how to report these issues or ask questions, IT teams can end up trying to manage a slew of random phone calls or get bombarded with questions over lunch, which makes it easy for reports or issues to get lost or forgotten.
Support tickets are a common way to manage this if your school already has a solution in place, but make sure you consider how easy it is for each member of your community to engage with it—will students and parents submit tickets the same way, and who is responsible for responding if a parent reports a concern?
Keep in mind that students may be reluctant to report issues if they think they’ll get in trouble for something that they’ve ‘stumbled upon’ accidentally. You may want to make it clear in your messaging for students that if they can find a weak point, so could a potential hacker – so IT staff will be grateful to learn about the issue regardless.
It’s no secret that security can be a bit of a dry topic, and many people are not going to be particularly excited to learn more about it. Teachers especially receive dozens of emails a day, so to stand out, your security awareness activities will have to be as interesting as possible.
Finding ways to make it enjoyable – or at least more fun or engaging, is the key to getting people to actually absorb the information you’re giving them.
People tend to think of cyber security as a very abstract concept, so visualisations are important to help people understand key concepts. Offering multiple ways for people to learn will also better cover the wide spectrum of technological skills/experiences at your school.
Whilst the way this is done will depend on the unique environment at your school, we’ve outlined a few ideas for this below:
Communication and resources should focus on making concepts easy to understand rather than exhaustively delving into complex cybersecurity terms and practices.
Multi-Factor Authentication (MFA), for instance, is a common security measure that staff and parents are likely already using for some services—but they may not be familiar with the actual term. Whilst saying ‘MFA’ might garner a blank stare, explaining that this is when they use a password and an SMS code to log into their bank account will make a lot more sense to someone who’s not as comfortable with technical lingo.
Explaining these concepts in simple terms can help to combat the idea of cyber security as a mammoth, complex concept that only IT people need to worry about or understand.
Another way to engage staff, in particular, is to share real-life examples of things like phishing emails that your team have intercepted or reported. This can help them understand that anyone can be a potential target, by connecting the threat to someone they know, rather than thinking of the abstract ‘hacker’ concept.
For a simple way to keep security in focus, Posters can be highly effective.
As with games and quizzes, there are plenty of pre-made posters and resources available, such as this… eye-catching design from cyber security company SANS.
To encourage further engagement, you could hold a competition for poster designs on various cybersecurity concepts and display the winners across the school.
It’s also possible to incorporate interactive elements like QR codes, to quickly report an incident or get more information on a topic.
Posters are most effective in places where people tend to stand or gather, for instance, near offices or in parent pickup areas, rather than in hallways or thoroughfares where people don’t have time to stop.
Significant research has been done on gamification strategies in the classroom, but studies have also shown that the practice can be successful outside the classroom in workplaces with a range of ages or demographics.
Quizzes are one form of this that offer a great way to drive engagement from your community, with the same study noting that
“When learners receive content on a daily or weekly basis and are quizzed on that content with some additional game elements, the effect is long-term retention and knowledge application.” (CLO Media, 2014)
Depending on the topics your school needs to cover, this can be implemented through your existing platforms, like Google Classroom, Canvas, or Microsoft Teams, or via a dedicated quiz platform like Kahoot!
For some starting points, check out the resources below:
Once you’ve started, it’s important to keep security front of mind for everyone going forward. The only way to make cultural change is to continue with consistent messaging and activities, so plan ahead for what your school could do on a regular basis.
Monthly emails or other regular communication can keep cyber security front and center without distracting too much from day-to-day work.
Consistency is important here—align your messaging with wider security awareness activities and try to send them from the same individual to make it easier for people to search their inboxes. A consistent subject line format, such as “Cyber Security: (Specific topic),” can help with this, too, to help people refer back to any resources they’ve been sent.
If your school has a newsletter, consider adding tips or other discussion around the importance of cyber security in a dedicated column. This will help keep the topic front of mind for parents and potentially start conversations between students and parents to reinforce cyber security topics at home.
Finally, the Australian Government distributes a range of useful resources that your school could utilise for ongoing security awareness by: