Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Education Security Government

White House Holds First-Ever Summit On the Ransomware Crisis Plaguing the Nation's Public Schools (pbs.org) 76

Posted by BeauHD from the borderless-threats dept.
The White House on Tuesday held its first-ever cybersecurity "summit" on the ransomware attacks plaguing U.S. schools, in which criminal hackers have dumped online sensitive student data, including medical records, psychiatric evaluations and even sexual assault reports. PBS reports: At least 48 districts have been hit by ransomware attacks this year -- already three more than in all of 2022, according to the cybersecurity firm Emsisoft. All but 10 had data stolen, the firm reported. Typically, Russian-speaking foreign-based gangs steal the data -- sometimes including the Social Security numbers and financial data of district staff -- before activating network-encrypting malware then threaten to dump it online unless paid in cryptocurrency. "Last school year, schools in Arizona, California, Washington, Massachusetts, West Virginia, Minnesota, New Hampshire and Michigan were all victims of major cyber attacks," the deputy national security advisor for cyber, Anne Neuberger, told the summit.

An October 2022 report from the Government Accountability Office, a federal watchdog agency, found that more than 1.2 million students were affected in 2020 alone -- with lost learning ranging from three days to three weeks. Nearly one in three U.S. districts had been breached by the end of 2021, according to a survey by the Center for Internet Security, a federally funded nonprofit. "Do not underestimate the ruthlessness of those who would do us harm," said Homeland Security Secretary Alejandro Mayorkas during the summit, noting that even reports on suicide attempts have been dumped online by criminal extortionists and urging educators to avail themselves of federal resources already available.

Among measures announced at the summit: The Cybersecurity and Infrastructure Security Agency will step up tailored security assessments for the K-12 sector while technology providers, including Amazon Web Services, Google and Cloudflare, are offering grants and other support. A pilot proposed by Federal Communications Commission Chair Jessica Rosenworcel -- yet to be voted on by the agency -- would make $200 million available over three years to strengthen cyber defense in schools and libraries.
This discussion has been archived. No new comments can be posted.

White House Holds First-Ever Summit On the Ransomware Crisis Plaguing the Nation's Public Schools More

White House Holds First-Ever Summit On the Ransomware Crisis Plaguing the Nation's Public Schools

Comments Filter:

  • A lesson to learn on display,
    If you leave doors ajar,
    Security won't go far,
    Penetrated, your data might stray!

    • In the realm where networks connect,
      A risky path some select.
      Through gaps in defense,
      Intruders commence,
      Penetration's price they collect!

    • Re: (Score:2)

      by xeoron ( 639412 )
      And if you have ipadOS/ChromeOS it keeps being, thus far, immune to these attacks in those environments. Does not mean it does not affect all the other systems, just that coping with recovery gets a lot easier when you can hand Chromebooks to staff until their windows devices are cleaned and various network services are back.

  • Try the obvious last of course (Score:4, Insightful)

    by ne0n ( 884282 ) on Tuesday August 08, 2023 @09:32PM (#63751996) Homepage
    There's no reason schools should have their records accessible from outside. Nor should they run Windows. Air gap those motherfuckers.

    • Re: (Score:1, Informative)

      by guruevi ( 827432 )

      There's no reason those schools should even have the records, period. They have proven they can't keep them safe. Back in the day, we didn't keep medical records in school, if you got sick, your parents were to pick you up or if it was real bad, an ambulance was called.

      • Fuck school in the first place, amirite?

      • Back in the day, there was a school nurse who kept paper records on students with specific conditions. Computerized records in my district kept a one character health code per student, and that code was printed in the class roster that the teacher kept in the classroom. Teachers also had a sheet that listed the meanings of the health codes. The two that I recall were seizure disorder and ulcerative colitis, both directly relevant for immediate safety and decency in a classroom setting. Early 70s, 911 no
      • And then someone's kid broke a fingernail at school and the parents hit the school with a $10M negligence lawsuit, after which things changed...

    • There's no reason schools should have their records accessible from outside. Nor should they run Windows. Air gap those motherfuckers.

      This.

      And if your school is also still forcing students to carry around those old-fashioned things called books, then revert to them and prove why you're still carrying that corrupt book contract.

    • Re: (Score:3)

      by AmiMoJo ( 196126 )

      There goes remote learning. Would probably become an ADA issue.

    • You mean that lesson they should have learned 40 years ago when War Games hit the theaters?
  • Running one public school district should be pretty much the same as running another. Yet every school district has its own unique collection of software tools, processes and procedures. Where are the states? Or the ridiculous US Department of Education? Why are all of these districts on their own when it comes to buying and configuring technology? The way we go about this is completely nuts. We need School Tech as a Service (STaaS) to support our school districts.

    • STaaS must user windows for schools at $25/mo seat

    • Re: (Score:3, Informative)

      by Moryath ( 553296 )

      Conservative states have been defunding and demanding schools "do more with less" for decades now. And the statewide infrastructure isn't any better.

      Just look at Texas, the TEA still requires schools (especially charter schools) to upload reports through an ancient and crappily maintained interface that requires a user to be running Internet Explorer. It desperately needs replacing but that would require spending money and hiring actual professionals, which won't happen while crazy creationist cultists of

      • "Conservative states have been defunding and demanding schools "do more with less" for decades now. "

        But the fine article says the list of victims includes California, Washington, Massachusetts, and Minnesota. None of those states are conservative. In fact I believe they are all one party socialist worker's paradises.

        Your wrath seems to be badly misguided.

        • You [intentionally] left out Arizona and West Virginia. Minnesota is all red counties except for population centers. Michigan was listed as well, and they are another red county state with a blue population center.
      • Citation please.

    • Re: (Score:1)

      by Anonymous Coward

      Running one public school district should be pretty much the same as running another. Yet every school district has its own unique collection of software tools, processes and procedures. Where are the states? Or the ridiculous US Department of Education? Why are all of these districts on their own when it comes to buying and configuring technology? The way we go about this is completely nuts. We need School Tech as a Service (STaaS) to support our school districts.

      Why do we need to have more than one political party? Why do we even have 50 individual States when we are a United States?

      Careful what you ask for. Next thing you know your government will become the kind of entity they have been describing as "evil" for decades.

  • ...how about all the dummies just stop putting computers with sensitive student data on the fucking internet like morons.

    Solving the problem really that easy.

  • Most public schools have the lamest IT infrastructure pennies can buy. Stop funding the schools who buy consumer grade network equipment (not to name names, what the hell, UBIQUITI I'm talking about you) and hires the principles Nephew (who has subscribed to PC Magazine for the last 3 years) to be their district wide IT Director (Might have to pay more then $60K/year to get real qualified IT people).

  • Going old fashioned hardcopy records is still often the most secure solution, and it has many century's long track record of working. It even has the advantage of putting a human in the loop for every access to the data. Computers are not always the answer.

  • Somebody smells a payday (Score:3)

    by bradley13 ( 1118935 ) on Wednesday August 09, 2023 @02:14AM (#63752382) Homepage

    First, ransomware gangs are scum. With that obvious statement out of the way: 28 school districts is a fraction of a percent of the school districts in the US. The problem is not that big. This is not something that should be discussed at the federal level at all, much less at the level of the President.

    Second, and more importantly, there is zero reason why a ransomware attack should lead to lost learning time. Teachers can still teach.

    Finally, we see the actual reason for this article: "Education tech experts...lamented that limited federal funds currently exist for them to tackle a scourge..." Someone is looking for pork. Schools work best, when they are run locally. Federal programs (like NCLB) have proven may times that federal involvement is counterproductive. But the feds are great at spending other people's money, and those "education tech experts" smell a payday.

    • The problem is not that big. This is not something that should be discussed at the federal level at all, much less at the level of the President.

      It was either this, or answer questions about Hunter, so...clickbait it is.

  • Todays word is "W" .. the root cause of the malware infestation, whose name must never be metioned /s
  • In countries where governments control the money in schools and hospitals you find ransomware attacks are rare because governments will never pay, giving little reason to attack them. Why go to the effort if you know you will never get paid?

    I realise it is different in the USA where schools and hospitals are basically privately run businesses and therefore paying up is seen by victims as the cheap option. I do wonder if making paying ransomware operators illegal, how much that would reduce the number o

    • Re: (Score:1)

      by guruevi ( 827432 )

      Why do you have to lie? There are plenty of articles about schools in the UK, Netherlands, Germany being attacked by ransomware and that is just this year's reports. I'm sure you didn't hear about the MOVEit breach and the number of European institutions that are on the list.

      Just because you don't speak the language and thus don't see the news in your curated feeds, doesn't mean it doesn't happen. Infrastructure and funding for schools in Europe is probably even more atrocious than the US.

      • Re: (Score:2)

        by ukoda ( 537183 )
        Lie, what lies? Are those UK etc schools public or private? Name a single government run school in the UK, Netherlands, Germany who paid a non-trivial ransomware demand. I bet the ones that did were all private schools. The thing with trying to get money out of governments in countries with low corruption rates is it is near impossible for hackers. Here in New Zealand we have only had one hospital hacked. The hackers got nothing. Yes it took weeks to recover normal operations but no other public hospi

        • Re: (Score:1)

          by guruevi ( 827432 )

          Very few schools or hospitals in the US are paying either, hence they dump the data online in a desperate attempt to still extort the place. The University of Maastricht in Netherlands paid 30 bitcoins, a government institution, notable because they actually made a profit on the Bitcoins when police recovered them.

          The primary problem is finding whether an institution paid the ransomware, because the criminals and the organizations keep it as quiet as possible. If you have cyberinsurance, in many cases, they

          • Re: (Score:2)

            by ukoda ( 537183 )
            Good reply, needs up rated as informative. No university here could pay, there is simply no procedure available to staff to pay non-tirval amounts. I wonder if in the University of Maastricht case if they allowed it as they were doing it as part of tracking the hackers and expected to recover the money?

            You are probably right about automated attacks, but for big budget attacks you would need to manually workout how back ups were being handled and deal with that first, to stop them locking the hackers ou

            • Re: (Score:1)

              by guruevi ( 827432 )

              Speaking from experience, you’d be surprised to hear, MOST ORGANIZATIONS do not have proper backup and restore procedures. I would guess 30% don’t have them, 60-70% that have them never test them and well over 90% are unlikely to hit either or both of their RTO and RPO.

              Yes, if you are targeting a high profile system as a foreign state entity, you don’t use ‘regular’ ransomware, but for most attacks it is just boring, even if they end up recovering from backup, you have still st

    • No, most primary and secondary schools in the US are run by the local governments. And the high-profile breech cited at the beginning of the article was at the LA Unified School District, which is run by the city of Los Angeles.

      But forget about making the ransom payments illegal, instead make it illegal for a government at any level to buy, hold or use any cryptocurrency, making pointless to target them. Unless someone wants to try and hop a flight from Moscow and collect cash in person.

      • Re: (Score:2)

        by ukoda ( 537183 )
        Sound idea. Why are schools being targeted in the USA if they are government run? Are they actually paying up sometimes?

        Here in New Zealand I we have had one hospital attacked a while back. Not sure about schools, must be rare as I would normally remember if one had been attacked. In the case of the hospital it took several weeks to restore operation but the hackers got nothing for their effort. Not sure WTF they though would happen? There is no way for a hospital or school here to pay a hacker, as

  • ahh windows (Score:4, Interesting)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Wednesday August 09, 2023 @08:07AM (#63752778) Homepage Journal

    You can't solve this problem by continuing to use the absolutely lowest quality software.

  • Public schools are a nest of incompetence. Ransomware exploits just one type of their incompetence.

  • I do not think it's something the Federal government, which does not have an extra $0.50 lying around let alone $200 mil, should be trying to take responsibility for.

    Schools are a STATE matter, let the States fund a security push. It's their job, not DC's.

  • Hacker with the best service "TECHSPYHACKERPRO" and the earlier you work with them the better your chances of escaping fake hackers and get your service done without stress. They have saved me countless times and same with my friends. He helped me recover my lost documents that belongs to the company i'm working for. Also helped me hack my partner phone, now i know my man is cheating but he is not aware of it cos it is done secretly. Contact them now if in need of any hacking service like deleting criminal

Slashdot Top Deals

Make sure your code does nothing gracefully.

Close