We’ll look at one example of an attack on a Michigan school district. In January 2020, according to edscoop.com, an entire school district was shut down because ransomware made its way into their education system’s network. How? Through the HVAC system.
The heating and cooling system, printers, phones, and educational technology were all running off the same network, so once the attackers got into the HVAC system, they had access to the entire school district. It may seem like a massive oversight to connect all these systems to the same network (and it was), but the truth is, this problem is not uncommon. Unfortunately, IT is often an afterthought, which leads to lack of budgeting and subpar work occurring on large and complicated school system networks. This leaves glaring issues in the technological infrastructure of school systems and allows for avoidable issues such as this one to occur.
Unfortunately, no one caught this particular problem and fixed it before criminals got hold of the system. But, we can always learn from events like this. What would we have done differently? Network segregation. Network segregation (or network segmentation) separates different networks from each other in an effort to protect sensitive data. In the context of this security event, network segmentation would look like putting the HVAC system, the printers and phones, and the educational system all on separate networks. Then, if hackers get into the HVAC system, the issue is contained to that system. Instead of being able to spread the ransomware to the other systems through the shared network (and shutting down the district), the problem would have been contained to the HVAC. Sure, losing heating and cooling is frustrating, but it’s vastly preferable to losing an entire school district’s functionality.
Here at Sterling Ideas, we value education. We see how technology can be used for the benefit of students, we understand the potential vulnerabilities of educational technology, and we’ve studied how it’s gone wrong before (and what to do about it). It’s not an easy task, but education is worth protecting. Here’s to the school year ahead of all of us. Let’s make it a safe one!