KPS Director of Technology Systems and Services Ian Haight recently sent two important emails regarding cybersecurity measures in the district. They outline required actions for all employees: one was regarding phishing training and the other provided information on turning on two-factor authentication.
Phishing Training
Schools are becoming a lucrative target for cyber criminals. Grand Rapids Public Schools recently disclosed a $2.8 million cyber attack that could have been prevented with more user training and security enhancements. Click here to read an article about their cyber attack.
Due to the increase in these attacks, the district’s insurance company is requiring us to implement additional security features, as well as, train and test any staff member with an email address. For the training, we will be using an online platform to provide short lessons in cyber security. These trainings are mandatory for all KPS employees. The initial training should take about 10 minutes. Subsequent trainings will be less than five minutes in length.
All staff have received an email from system@litmos.com with the subject "Kalamazoo Public Schools Security Training Course Assigned." This is a legitimate email and will have a link to create an account or log in to the training system. (Note: The required security training invitation email went out to all staff Tuesday afternoon. Google accidentally marked it as potential spam/phishing and had the giant yellow banner warning you not to click the link. To reiterate, that email is legitimate and contains the login for the required security training.)
Two training sessions have been assigned to you that will help you identify "phishing" scam emails that are designed to steal your login credentials. Phishing is the most common form of cyber attack and also one of the easiest for you to help defend against by practicing constant vigilance. Always be on the lookout for suspicious emails.
If you receive an email that you are unsure about, please email the help desk at help@kalamazoopublicschools.net with the details of the email before you open it. It is best practice not to forward the email onto the help desk or anyone else as that just propagates the attack.
This initial training will need to be completed by the last day of school. If you have not done so, the system will periodically remind you to complete the training. If you have not received the login email by the end of the week, please email help@kalamazoopublischools.net.
Two-Factor AuthenticationAs of June 1st, as an insurance requirement, all KPS staff email accounts must have 2-factor authentication turned on. If you understand 2-factor authentication and just want to enable it please click here to enroll. For a step-by-step guide click here. Otherwise, keep on reading for more information.
In my email about security training, I referenced the district’s insurance provider requiring stronger security measures going forward. This new requirement is the most impactful security update we can implement. The $2.8 million scam that targeted Grand Rapids Public Schools would have been prevented with 2-factor authentication. The ransomware that shut down Kellogg Community College last week could have been stopped with 2-factor authentication.
2-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) is the use of “something you know” like a password and “something you have” like a phone call, text, app, or hardware token. This allows for additional security even if a password is stolen and can prevent the vast majority of cybersecurity breaches. It is likely you already use systems like this when accessing your bank account.
As of June 1, 2022, any staff email account that has not already enrolled will be forced to enroll on the next login. We will be using Gmail’s built-in authentication methods, which include a phone call, text, app, or hardware token. Other districts that have implemented this already have reported that using a cellphone with the Gmail app is the easiest way for staff to authenticate themselves and about 90 percent of staff members choose that option. Trusted devices tend to have a 30-day window before being asked to authenticate again.
Enrollment will need to happen before the end of the school year so staff have ample time to get assistance if they need it. Google has a very thorough guide to enrolling in multi-factor and it should take less than 5 minutes to accomplish. We will have open office hours virtually and in-person for staff members that need it. More information on that will come out in follow-up emails.
Once enrolled, you will be asked to authenticate on new logins from unrecognized devices and once every 30 days on recognized devices. Authentication is smooth. On an Android phone, there will be a pop-up asking you to approve or deny the login. On an iPhone, one of the Google apps (Gmail, YouTube, Authenticator) will ask you to open it and approve the login.
As always, you are our first line of defense and your constant vigilance helps keep our student data and systems safe.
