How Can Virginia Schools Protect Against Cyberattacks?

As more Virginia schools launch virtual learning programs, districts wonder how they’ll pay for needed changes.

FALLS CHURCHㅡFairfax County Public Schools (FCPS) is the 11th largest school division in the country. Last fall, the Northern Virginia division was the victim of a cybersecurity attack involving ransomware. 

The division found out about the attack in September. On Oct. 9, the stolen information was posted on the dark web. 

After the incident, officials did what they could to contain the threat, secure school systems and restore the affected servers. The Federal Bureau of Investigation and the Virginia State Police were also brought in. 

Not surprisingly, what happened to FCPS is far from uncommon. A report from the Government Accountability Office found that more than 17,000 public school divisions and approximately 98,000 public schools have experienced cybersecurity breaches since 2016.

Becky Jones is a parent in Grayson County. Her four children range in age from 12 to 17. All four of them attended classes in-person and completed assignments via Google Classroom during the 2020-2021 school year. She expects divisions to be proactive when it comes to combating cyberattacks. 

“I feel that they should have measures in place to protect student information from cyberattacks and also to protect students participating in Google Meet/virtual classes,” she said.

Senators Look For Options 

There’s no argument Virginia schools need cyber upgrades. But the question is how will they pay for them?

“School systems must have strong cybersecurity resources available to protect themselves against cyber and ransom attacks,” Virginia Sen. Mark Warner said. “With the increasingly persistent attacks on our schools, they simply cannot wait until they are a target to take action.”

On June 17, Warner and Susan Collins (R-ME) sent a letter to U.S. Department of Education Secretary Miguel Cardona. The letter urged his department to tell school divisions they can use COVID-19 relief funds on cybersecurity resources. Division leaders told Warner that’s been a point of confusion in the past.

The senators specifically want the department to make divisions more aware of the fact they can use money from the Elementary and Secondary School Emergency Relief Fund (ESSER) and the Governor’s Emergency Education Relief Fund (GEER) for cybersecurity. Both were authorized as part of the CARES Act, with $200 billion allocated for ESSER funds and $7 billion allocated for GEER funds. 

While they pointed to a “Frequently Asked Questions” document the department put out in May as confirmation that CARES Act funds can be used on cybersecurity, they said more should be done. 

“We respectfully ask that the administration take steps to publicize this information and help school districts understand the importance of funding cybersecurity efforts,” they said. 

In addition to issuing public guidance that clearly states that ESSER and GEER funds can be used to improve cybersecurity, they want the department to provide guidance on suggested spending priorities to address ransomware attacks. 

“Because of the relief funding Congress has provided over the past year, we have a real opportunity to address accumulating cybersecurity risks in schools,” they said. 

The department didn’t respond to Dogwood’s request for comment. Warner’s office confirmed on Tuesday that he has yet to receive a response as well. 

VDOE Cybersecurity Guidance 

“Cybersecurity is of great concern to the department given the amount of student level data the department holds and our responsibilities to protect student privacy under Family Educational Rights and Privacy Act (FERPA) and state law,” Charles Pyle, director of communications for the VDOE, said. 

The department keeps divisions abreast of cybersecurity trends through bi-weekly updates and regular webinars. One specific webinar featured a guest speaker from the Federal Bureau of Investigation who investigates cyber crimes. 

To protect against ransomware and phishing attacks, the department advised divisions back in October to utilize built-in tools for spam identification and blocking, backup critical systems and institute suspicious email awareness programs for employees. 

Ken Blackstone, executive director of the Office of Communications and Constituent Services for the VDOE, noted the department is intending on issuing a model security plan in the near future. 

While the department has issued broad guidance about the use of ESSER and GEER funds, it has not issued specific guidance to divisions on the use of the funds on cybersecurity. However, the department’s director of federal pandemic relief programs conducted a training last week on permitted uses for ESSER and GEER funds, which included information on expanded cybersecurity needs.

The training said, “funds may be used to improve cybersecurity to better meet educational and other needs of students related to preventing, preparing for, or responding to COVID-19.” 

How Do Virginia Schools View Cybersecurity? 

Roanoke City Public Schools (RCPS) views safety, including cybersecurity, as a top priority. 

In an effort to make the issue top of mind, it has started posting tech tips on its website and social media platforms and holds a “Cybersecurity Month” each year with free giveaways. 

“Security tools are an important part of this work, but employee awareness is also vital. We are in the process of implementing a robust cybersecurity strategy focused on employee awareness through training at regular intervals,” Claire Mitzel, coordinator of communications and public relations, said. 

The division’s training has focused on how to recognize cyberattacks, social engineering, best practices for passwords and physical security. 

A division-wide conference focused on cybersecurity is a long-term goal RCPS is working towards. 

Virtual Learning is Here to Stay For Virginia Schools

The issue of funding cybersecurity resources is now more important than ever before, the senators said. 

Census data indicates that 93% of school-age children participated in distance learning over the past year. 

Despite the fact that many schools returned to in-person learning this spring, virtual learning will continue into the future. 

Botetourt County Public Schools is betting on the long-term demand for virtual learning. Last December, its school board approved the establishment of a virtual academy. The move was made in part based on how popular the format was with certain students and parents while at the height of the pandemic. Plans are in place to launch the academy this August. 

Dogwood reported about the launch of Region VII’s VIIRTUAL Academy in Southwest Virginia in April. 

“There is a subset of parents, though, who have found this year to be a much more effective way for their students,” Dr. Francisco Duran, a member of the Virginia Board of Education, said during a board meeting that addressed the academy.

Aila Boyd is a freelance reporter for Dogwood. You can reach her at [email protected].