NCDPI Information Technology k-12 Cybersecurity Study Michael Nicolaides Julien Alhour January 27, 2017

Click image for full report Cybersecurity Study Click image for full report

Study required by - NC SL 2016-94 (HB 1030) Section 8.17: The Department of Public Instruction shall conduct a study on cybersecurity in North Carolina public schools, including charter schools. By December 15, 2016, the Department shall report the results of the study to the General Assembly in accordance with G.S. 120-29.5.

Study Approach Meetings and interviews were conducted The North Carolina Governor’s Office The North Carolina LT. Governor’s Office The Department of Information Technology MCNC The William & IDA Friday Institute for Educational Innovation The University of North Carolina School of Government North Carolina School Boards Association Secure Survey of LEAs and Charter Schools NCDPI Technology Services MCNC Department of Information Technology Services (DIT) - Enterprise Security and Risk Management office

Online Survey Overview 37 questions were asked covering the five function areas of security as identified in the National Institute of Standards and Technology Cybersecurity Framework: Identify Protect Detect Respond Recover

6 potential answers were possible for each question: Not Implementing = No policy, procedures or technology implemented Emerging / Developing = Informal policies, procedures or technology implemented Operationalized = Formalized policies, procedures or technology implemented Optimized = Formalized policies, procedures or technology implemented which include quality control efforts such as auditing effectiveness Not Applicable = Question did not pertain to the environment Compensating Control = Implemented alternate security measures that met the intent of the identified controls

Key Analysis The survey had a very high response rate. Hurricane Mathew did impact a few school districts and charter schools ability to respond to the survey. Detailed analysis of the survey questions and individual responses are confidential per North Carolina General Statute 132 -6.1(c). These are available as Appendix A and B in the Addendum.

General Observations School districts and charter schools vary significantly in their portfolios of cybersecurity capacity

General Observations Small school districts and charter schools are the most vulnerable

General Observations The majority of school districts and charter schools surveyed are not prepared for a significant disaster or cybersecurity event

General Observations Loss of federal funding for Internet content filtering and firewall Services

Click image for full report General Observations School districts and charter schools are not mandated to follow the guidelines established in the North Carolina Statewide Information Security Manual Click image for full report

Recommendations from the Study Develop Common Templates and Prioritization Guidelines Results of this survey indicate a need for state-level guidance and support to schools in both prioritizing and implementing important cybersecurity policies and practices.

Recommendations from the Study Publish a Quarterly Information Security Newsletter Results of the survey and communications with district and charter school personnel also revealed a lack of awareness about the importance and relevance of many key cybersecurity practices.

Recommendations from the Study Provide Cybersecurity Awareness Training The survey revealed that many districts and charter schools do not have a formalized cyber awareness training program for their employees.

Recommendations from the Study Require school districts and charter schools to follow the guidelines established in the North Carolina Statewide Information Security Manual Requiring school districts and charter schools to adhere to the requirements established in the security manual would provide a unified security framework from which they could formalize their security programs. (adjust the manual for schools) Click image for full report

Recommendations from the Study Provide Regional Cyber Security Specialists Survey results suggest the need for experienced and knowledgeable regional staff, to support school districts and charter schools in reducing risk to cybersecurity threats.

Recommendations from the Study Make Available State Funding for Internet Content Filtering and Firewall Protection The 2016-2017 projected cost of Internet content filtering and firewall services is $5.5 million. Cost Benefit

Questions?