How to Approach Cybersecurity Training in Schools

This guest post was written by one of our partners, 9ine, a cybersecurity consulting group for K-12 schools. 

In the digital age, cybersecurity training in schools is not just an option but a necessity. With the increasing use of technology in education, students and staff need to be well-equipped to handle potential cyber threats. Effective cybersecurity training can safeguard sensitive data and maintain a safe learning environment. Here are five key recommendations for structuring effective cybersecurity training in schools.

1. Tailor Training to Specific Systems Architecture and EdTech Platforms

Recommendation: Training for students and staff should be specific to the systems architecture and EdTech platforms used in the school. 

Each school has a unique technological setup, and effective cybersecurity training should reflect this. By focusing on the specific systems and platforms in use, the training becomes more relevant and practical. For example, if your school uses Google Workspace for Education, the training should cover secure login practices, data sharing settings, and potential threats related to this platform. Similarly, understanding the intricacies of the school’s network infrastructure can help in identifying and mitigating specific vulnerabilities. Tailored scenarios ensure that users can relate the training directly to their everyday interactions with the school’s technology, enhancing their understanding and preparedness.

2. Contextualize Training Scenarios Within an Educational Framework

Recommendation: Ensure that training scenarios follow an educational context rather than a corporate one. 

Cybersecurity threats in schools differ from those in corporate environments. Therefore, training should reflect the unique aspects of an educational setting. Scenarios should involve situations that teachers, students, and administrative staff might encounter. For instance, training can include phishing attempts disguised as school-related emails, or data breaches involving student information. By using examples and situations that are relatable to the school environment, the training will resonate more with the participants, making it more effective and engaging.

3. Use Evidence-Based Training with Relatable Examples

Recommendation: Incorporate evidence-based training that includes examples from schools of a similar demographic where cyberattacks have been successful. 

Using real-world examples from similar schools adds credibility and urgency to the training. When participants see how cyberattacks have impacted other schools, it reinforces the importance of the training. Case studies and stories about actual incidents, such as a ransomware attack on a nearby school, can provide powerful lessons. Discussing the specific steps that could have prevented these attacks helps to highlight practical measures that can be implemented. 

4. Address Current and Future Cyber Risks

Recommendation: Include training on current and future cyber risks, such as the potential of generative AI for social engineering and other threats. 

Cybersecurity is a constantly evolving field, and training should keep pace with emerging threats. One of the latest risks involves generative AI, which can be used for sophisticated social engineering attacks and automated vulnerability exploitation. Training should cover how AI-generated content can be used to create convincing phishing emails or fake social media profiles. Educating staff and students on these advanced threats ensures they are prepared not just for current risks, but also for those on the horizon.

5. Align Training with Insurance Requirements

Recommendation: Ensure the training meets the requirements of your insurance policy, including maintaining a record of who has received training, on what, and when. 

Many cyber insurance policies have specific requirements for training content and documentation. Schools must ensure that their training programs comply with these requirements to remain covered. This includes keeping detailed records of training sessions, participant attendance, and the topics covered. Such documentation not only helps in meeting insurance standards but also provides a clear picture of the school’s commitment to cybersecurity, which can be crucial in the event of an incident. 

Conclusion 

Cybersecurity training in schools is vital for protecting sensitive data and ensuring a safe learning environment. By tailoring training to specific systems and platforms, contextualising scenarios within an educational framework, using evidence-based examples, addressing current and future risks, and aligning with insurance requirements, schools can create a robust and effective cybersecurity training program.   

Partnering with a knowledgeable provider like our partners at 9ine can further enhance the training’s impact, ensuring that both staff and students are well-prepared to handle the ever-evolving cyber threats.