Peter Ambs, MBA, C/CISO, PMP

This afternoon the House Subcommittee on Oversight and Investigations released two documents ahead of their hearing this Wednesday (5/1) on the Change Healthcare hacking incident. Based on the summary of planned testimony by UnitedHealth CEO Andrew Witty (UH owns Change) as well as the accompanying background document, it appears that a member of the ALPHV criminal group was able to gain access to Change's internal systems via a compromised logon and a lack of Multifactor Authentication (MFA). Worse, they apparently had unfettered access to the system for 9 days, downloading an estimated 4TB of data without being noticed or stopped. Once they had ransacked as much data as they likely felt they needed, they set off the ransomware bomb that is still impacting healthcare patients nationwide today. If all this is true, there is no way to cover up the ugliness of the fact that a few well-known and relatively cost-effective methods could have been taken that would have either entirely prevented this or seriously constrained ALPHV's access. (NOTE - Apparently the House links were changed on 4/30 - I've updated the links to new ones - MEK) https://lnkd.in/gbpjSrJa https://lnkd.in/gJf2TE8f #Cybersecurity #DataBreach #Cyberdisclosure

3

Cyberattacks are a growing threat to our schools, with 80% of K-12 institutions targeted by ransomware last year. The FCC's new $200 million cybersecurity pilot program is a significant step forward. While this funding may not cover all needs, it emphasizes the importance of cybersecurity in education. It's not just about technology—leadership, training, and capacity are key. We must continue to advocate for comprehensive strategies to protect our schools and ensure a safe digital environment for students and educators. #Cybersecurity #Education #Leadership #FCC #EdTech #DigitalSafety

7

K-12 schools cyber security challenges and mitigation K-12 schools face a variety of cybersecurity challenges that are critical to address in order to protect sensitive data, ensure the continuity of education, and maintain a safe digital environment for students, staff, and faculty. By proactively addressing these challenges, K-12 schools can better protect their digital environments and ensure a safer, more secure learning experience for all. Here are some of the key cybersecurity challenges in K-12 schools: 1. Limited IT Resources 2. Inadequate Security Awareness and Training 3. Outdated Infrastructure 4. Increased Use of Technology and Remote Learning 5. Sensitive Data Protection 6. Cyberattacks and Ransomware 7. Third-Party Vendor Risks 8. Cyberbullying and Online Safety 9. Policy and Governance 10. Physical Security   Mitigation Strategies: To address these challenges, K-12 schools can consider the following strategies: - Invest in Cybersecurity Training: Regular training for students, teachers, and staff to build awareness and resilience. - Upgrade Infrastructure: Allocate budget for updating hardware and software, and implementing modern security measures. - Develop Incident Response Plans: Establish and regularly update incident response plans to prepare for potential cyberattacks. - Enhance Data Protection: Implement strong encryption, access controls, and regular audits to safeguard sensitive data. - Engage with Vendors: Ensure that third-party vendors adhere to high security standards and conduct regular security assessments. - Implement Monitoring Tools: Use cybersecurity tools to monitor networks, detect threats, and respond promptly to incidents. For more information about XeneX support for K-12 cyber security needs and a more detailed version of this blog please visit us at www.xenexSOC.com #cybersecurity #soc #compliance #incidentmanagement #cyberinsurance

5

Kim, this article provides valuable insight, yet it overlooks some crucial points. The behavior and lack of discipline in schools nationwide have reached an abysmal state. Many school "Code of Conduct" (CoC) documents are ineffective because they lack enforcement. For instance, a CoC document I recently reviewed stated that only school assaults resulting in serious bodily harm could be referred to law enforcement, allowing schools to evade scrutiny. In Worcester County, Maryland, a public dispute has erupted between law enforcement, the State's Attorney's Office, and the board of education over this very issue. The headline reads: "Worcester's School Safety Crisis: Dispute Between Educators and Law Enforcers." Your article notes a shift from 25 years ago, stating, "You'd see SROs (School Resource Officers) for sure," Pierson said. However, it's worth noting that during the Columbine massacre, there was an SRO on campus who exchanged gunfire with the killers. The article fails to mention the utilization of BIT, BAT, and TAT teams. In the Oxford shooting, the assailant attended a "behavioral meeting" shortly before committing the act. Notably, the principal and the SRO were not present at that meeting. Unfortunately, the removal of God from schools, coupled with the lack of discipline both at school and in homes, as well as the fragile state of society, contributes to escalating violence in our schools. Furthermore, some school administrators privately state they believe, "It can't happen here." The article quotes, "It's difficult to measure if schools are safer today." It is my belief that schools reflect society. Ask yourself, do you feel safer today going for a walk alone, visiting the mall, or attending church? The answer is apparent. Educators emphasize that the culture of safety is built on fostering better relationships in schools, which has a positive impact. However, unless we adopt a mindset of preparedness and reinstate effective classroom management, catastrophic events will persist in our schools.

1

7 Comments

FCC Launches $200M Cybersecurity Pilot Program to Protect K-12 Schools and Libraries https://buff.ly/3VrJMBs In a major step to bolster cybersecurity for the nation's schools and libraries, the Federal Communications Commission (FCC) has announced the establishment of a three-year, $200 million Cybersecurity Pilot Program . Through this initiative, eligible K-12 schools and libraries can apply for funding to procure advanced cybersecurity services, equipment, and training to better safeguard their networks and data from growing cyber threats.

5

This is definitely one for districts and edtech companies to watch. (And if you’ve not already done so, read more about how it all unfolded here: https://lnkd.in/evsTxGbj)

1

How can you secure funding to enhance #SchoolSafety, protect students and tackle crime in your #school?  🗓️ Join us on April 16 for an insightful conversation about the SVPP grant to learn:  💰 What is the SVPP program and who is eligible?  📚 What do schools need to know to position themselves for a successful application? 📚 Where can schools get help throughout the process? 🖥️ How to create a technology strategy to optimize your #security and funding?  Register now: https://hubs.li/Q02qW0Km0 #SolvingForSafer

13

🚨 Digital Arrest Scam Alert! 🚨 Beware of digital arrest scams, where cybercriminals impersonate law enforcement to trick you into paying fines or sharing personal information. These scams can be convincing, but there are ways to protect yourself. Learn how to identify these threats and keep your data safe. Stay informed and stay safe! #CyberCrimeAwareness #StaySafeOnline #DigitalScams Cyber Security Association of India CMAI Association of India Col (Dr.) Inderjeet Singh Rajesh Pant Prof NK Goyal Navtesh Goyal Hemlata Chaudhary

14

How is your cybersecurity hygiene? This state's Chief Information Security Officer says things are not looking so great in this area. https://lnkd.in/g9fiMDM2 #Cybersecurity #InfoSec #CISO #CyberHygiene #DataProtection #SecurityAwareness #ProtectYourData #OnlineSafety

1

Not all cyber security products are created equal. Do you know what you have running in your environment? Incorrectly configured or improper AV software gives a false sense of security and may put your organization at more risk. All Covered can asses your security posture and recommend solutions. #allcovered #allcoveredsecurity #allcoverededucation

3

Online PDF editing can be secure and efficient! 🔒💻 I used to believe it was risky, but I was wrong. 🤯 1. Encryption and authentication are your digital locks. 2. Look for AES-256 encryption for top-notch security. 3. Strong passwords and 2FA are key defenses. 4. SSL/TLS encryption ensures safe data transfer. 5. Choose editors with encrypted cloud storage. #SecurePDFEditing #DataProtection #EfficientWorkflows #CyberSecurity #InnovativeTools #BusinessSolutions Follow @rajibimran for more insights

3

"Large cybersecurity breaches in the healthcare sector have increased by 256% in the last five years, and ransomware incidents have increased by 264%, according to HHS data." "A massive cyberattack against Change Healthcare began in February, for example, and lasted over a month, costing providers an estimated $100 million per day." Some pretty staggering numbers here.....If your healthcare practice is struggling with how to address your security and compliance needs, reach out to us at SkaleSmart. We can help.

7

What policies made healthcare more vulnerable to hacking and made taking care of patients even more difficult? "Don't put all your eggs in one basket" #EMR #EHR #CyberSecurity #CyberAttacks #Advocacy #HealthcareAdvocacy #Healthcare #Medicine #Patients #HealthcareHeroes #HealthcareProfessionals #FirstResponders #Pharmacists #Nurses #Doctors #NursesOnLinkedin #Nursing #HealthcareOnLinkedin #AMA #ANA "Hackers targeting healthcare in order to divert payments" https://lnkd.in/g_yxT4Dg

1

1 Comment

🚨 Exciting Update for "On the Right Track: CISA’s Impact on Rail Networks" Presentation 🚨 Cyber Senate are thrilled to announce that Sean Letona, Chief of Operations for Vulnerability Management at CISA, will be joining Gary Hopewell, Cyber Security Advisor, in a comprehensive dual presentation. Together, they will delve into crucial topics affecting our rail networks: 🌀 The Volt Typhoon Threat: Understanding its specific impact on rail infrastructure. 🔍 CISA’s Scanning and Vulnerability Management: Learn about the no-cost services provided by CISA to enhance your network's security. 🛡️ Free Cyber Security Assessments: Available for both IT and OT networks to bolster your cyber defense. 🔐 Best Practices for Cybersecurity: Strategies for moving towards zero trust architectures. Don’t miss this opportunity to gain valuable insights from leading experts in the field! 🗓️ Mark your calendar: June 11th, 12 PM, Celebration Florida 🔗 Register now: [https://lnkd.in/dPqd3nR] Join us to ensure your network is on the right track towards enhanced cybersecurity! #Cybersecurity #RailNetworks #CISA #VulnerabilityManagement #ZeroTrust #CyberDefense #ITSecurity #OTSecurity #InfrastructureSecurity #CyberRisk

7