1. NCDPI Information Technology k-12 Cybersecurity Study
Michael Nicolaides
Julien Alhour
January 27, 2017

2. Click image for full report
Cybersecurity Study
Click image for full report

3. Study required by - NC SL 2016-94 (HB 1030) Section 8.17:
The Department of Public Instruction shall conduct a study on cybersecurity in North Carolina public schools, including charter schools.
By December 15, 2016, the Department shall report the results of the study to the General Assembly in accordance with G.S

4. Study Approach Meetings and interviews were conducted
The North Carolina Governor’s Office
The North Carolina LT. Governor’s Office
The Department of Information Technology
MCNC
The William & IDA Friday Institute for Educational Innovation
The University of North Carolina School of Government
North Carolina School Boards Association
Secure Survey of LEAs and Charter Schools
NCDPI Technology Services
MCNC
Department of Information Technology Services (DIT) - Enterprise Security and Risk Management office

5. Online Survey Overview
37 questions were asked covering the five function areas of security as identified in the National Institute of Standards and Technology Cybersecurity Framework:
Identify
Protect
Detect
Respond
Recover

6. 6 potential answers were possible for each question:
Not Implementing = No policy, procedures or technology implemented
Emerging / Developing = Informal policies, procedures or technology implemented
Operationalized = Formalized policies, procedures or technology implemented
Optimized = Formalized policies, procedures or technology implemented which include quality control efforts such as auditing effectiveness
Not Applicable = Question did not pertain to the environment
Compensating Control = Implemented alternate security measures that met the intent of the identified controls

7. Key Analysis The survey had a very high response rate.
Hurricane Mathew did impact a few school districts and charter schools ability to respond to the survey.
Detailed analysis of the survey questions and individual responses are confidential per North Carolina General Statute (c). These are available as Appendix A and B in the Addendum.

8. General Observations
School districts and charter schools vary significantly in their portfolios of cybersecurity capacity

9. General Observations
Small school districts and charter schools are the most vulnerable

10. General Observations
The majority of school districts and charter schools surveyed are not prepared for a significant disaster or cybersecurity event

11. General Observations
Loss of federal funding for Internet content filtering and firewall Services

12. Click image for full report
General Observations
School districts and charter schools are not mandated to follow the guidelines established in the North Carolina Statewide Information Security Manual
Click image for full report

13. Recommendations from the Study
Develop Common Templates and Prioritization Guidelines
Results of this survey indicate a need for state-level guidance and support to schools in both prioritizing and implementing important cybersecurity policies and practices.

14. Recommendations from the Study
Publish a Quarterly Information Security Newsletter
Results of the survey and communications with district and charter school personnel also revealed a lack of awareness about the importance and relevance of many key cybersecurity practices.

15. Recommendations from the Study
Provide Cybersecurity Awareness Training
The survey revealed that many districts and charter schools do not have a formalized cyber awareness training program for their employees.

16. Recommendations from the Study
Require school districts and charter schools to follow the guidelines established in the North Carolina Statewide Information Security Manual
Requiring school districts and charter schools to adhere to the requirements established in the security manual would provide a unified security framework from which they could formalize their security programs. (adjust the manual for schools)
Click image for
full report

17. Recommendations from the Study
Provide Regional Cyber Security Specialists
Survey results suggest the need for experienced and knowledgeable regional staff, to support school districts and charter schools in reducing risk to cybersecurity threats.

18. Recommendations from the Study
Make Available State Funding for Internet Content Filtering and Firewall Protection
The projected cost of Internet content filtering and firewall services is $5.5 million.
Cost
Benefit

19. Questions?