Discussions

On February 3, 2022, the National Association of Independent Schools (NAIS) hosted a webinar on cybersecurity and the Log4j vulnerability in collaboration with the Association of Technology Leaders in Independent Schools (ATLIS), and Ankura. ATLIS executive director Christina Lewellen, MBA, CAE served as a panelist on the webinar to represent the independent school technology leader community. Additional presenters included Tim Fish, chief innovation officer, NAIS; Bob Olsen, senior managing director, Ankura; George Mendel, senior director of IT, NAIS; Stephanie Wilkinson, senior director of engineering, NAIS; Brent Riley, managing director, incident response, Ankura; and Ankur Sheth, managing director, cloud services,  Ankura.

The webinar focused on recent Log4j vulnerabilities and how schools can protect themselves against resulting cyber threats. “The best practices that are going to help us deal with this particular threat, are the best practices we can use for other threats as well,” stated Christina Lewellen. 

The Log4j vulnerability, discovered in December 2021, is a flaw in code present on millions of Linux servers running Apache. It is not being patched effectively, leaving millions of programs vulnerable to hacks by those who leverage it. Schools should be aware that staff and students may be bringing in programs, like Minecraft, that could expose school systems to threats. 

Bob Olsen, senior managing director of Ankura, walked participants through steps to detect vulnerabilities, monitor for threat actors, investigate incidents that do occur, and remediate to undo the damage that results from an incident. Failure to patch vulnerabilities upon becoming aware of them will not only put your school at extremely high risk for an attack, but can also lead to legal repercussions from the Federal Trade Commission (FTC). 

Not only are schools responsible for managing their own systems, but they must also perform due diligence to mitigate risk from vendors who have access to school systems. “We have a perfect storm,” said Christina Lewellen. “During the pandemic, we scrambled to get solutions in place, but weren’t always diligent about security with vendors. Now we are trying to reign it in. ATLIS has been having conversations about this and sharing resources.” 

One of the first steps in defense should be implementing multi-factor authentication (MFA) for any school systems that contain privileged data. “Cyber is a team effort and resisting it is putting your entire school at risk. MFA is a baseline must-have defense,” said Lewellen. To address concerns with implementation of MFA, Stephanie Wilkinson of NAIS added “There isn’t a one size fits all solution to MFA, but you need to be flexible with staff to get everyone to start using it.” This is where technology leaders can step in and use language to reframe the narrative in their school, making it simple and effective.

Additional lines of defense include active and diligent patch management, on and off-site backups of critical systems, Endpoint Detection and Response (EDR), and having a solid incident response plan. Technology leaders should also work with their school's business office and their insurance providers to ensure that they have proper cyber liability coverage. 

ATLIS is grateful to have partnered with NAIS and Ankura to provide this webinar to the independent school community. ATLIS continues to foster partnerships and develop resources to keep the independent school community aware of, and prepared for, cyber threats. “ATLIS is a home for technology leadership, not just technology leaders,” said Lewellen. “The technical piece of this can be overwhelming, but we are here for you.”

To learn more about how to keep your schools cyber safe, consider registering for the ATLIS Spring Cyber Safety Workshop, happening March 4 and 11. This virtual workshop draws on advice from technology professionals, includes hands-on activities to jumpstart cyber safety efforts, and offers a follow-up summit with industry resources to answer your most critical questions. Special discounted registration prices for ATLIS members and regional independent school associations are available.