NIST Cybersecurity Protect Function for K-12

by Katie Fritchen on November 5, 2020

The Protect Function brings your district closer to better cybersecurity and data privacy compliance

One of the most critical issues facing K-12 IT leaders is cybersecurity. The importance of addressing cybersecurity has risen significantly because cybercriminals are increasing their attacks on K-12 systems, and hackers are taking advantage of the COVID-19 outbreak.

Typically, overworked and underfunded IT teams are faced with the requirement to set up a cybersecurity infrastructure to protect their data and their community members. The National Institute of Standards and Technology (NIST) has developed a cybersecurity framework that many school districts are using to manage the problem due to its adaptability and scalability.

Today, there are more resources available to help districts implement a K-12 NIST Cybersecurity Framework. We started this series of posts by describing the NIST Cybersecurity Identify Function, which is the starting point for using the Framework. This post will describe how the next step, the Protect Function, will bring you closer to your goal.

Sponsorships Available

About the NIST Cybersecurity Protect Function

Completing the Identify Function allows you to set the foundation for your cybersecurity framework by identifying the things you need to protect. The next step is the Protect Function, which helps you plan and implement appropriate safeguards to ensure your district can deliver critical services while limiting or containing the impact of a cybersecurity event.

Once you have completed the NIST Cybersecurity Protect Function, you’ll be in a position to implement the safeguards you identified that can result in the following:

Plans to protect identities and control access both physically and remotely
An Awareness and Training schedule to empower staff that includes role-based and privileged user training
Plans for data security protection based on your district’s risk tolerance that will ensure your data’s confidentiality, integrity, and availability
Implementing the processes and procedures you developed to protect your data and information systems
Implementing the maintenance plans you made to protect your resources, including regular and remote maintenance procedures
Implementing the plans you made to use protective technology to secure your systems in a way that is consistent with your district’s policies, that complies with regulations, and that supports agreements you have with third-party vendors

Getting Started with the NIST Cybersecurity Protect Function

This is where many district IT teams stall due to budget constraints. While it’s true that implementing technology to protect your district’s data properly is going to cost money, there are steps that you can take to support your initiative that are either free or low-cost.

For example, many data breaches happen because of relatively simple errors that usually fall into two categories.

Human Error: You may think that teaching all of your users not to click on phishing links is an exercise in futility. But, you’ll be glad to know that regular training and reinforcing the need to be alert is helping to reach that goal.
Misconfigured Technology: As the admin, you can make sure you have the strongest security settings configured correctly within an app’s native controls. To help you accomplish that goal, you can use our free Cloud App Security Checklist that will show you the steps to secure G Suite and Office 365 using the features offered in those applications.

Pro Tip: During our recent webinar, Neal Richardson, the Director of IT at Hillsboro-Deering School District, offered advice for his peers based on his experience in implementing the NIST Cybersecurity Framework in his district.

One thing he recommends is having a zero-trust cybersecurity mindset. His team takes the stance that they don’t “trust” any of their endpoints, and take nothing that they are doing at face value. This is important because today’s cyberattacks often use account takeovers, which are notoriously difficult to detect in cloud applications like G Suite and Office 365.

Neal has also adopted a maximum 5-year hardware refresh cycle to help keep ahead of those hardware-based protections that just can’t be handled without replacing the hardware. He has also implemented split DNS and uses a next-generation antivirus.

The Cybersecurity and Infrastructure Security Agency (CISA), part of the Department of Homeland Security, is another excellent resource for keeping up to date with the latest cybersecurity threats. The agency publishes Alerts, Analysis Reports, Current Activity reports, and Bulletins you can use to access timely information about security topics and threats. You can subscribe or use their syndicated feeds to keep yourself updated.

As a K-12 systems admin, you have a lot on your plate. Hopefully, the NIST Cybersecurity Framework will make your job easier. Stay tuned as we will continue our series to address the other three Functions within the Framework over the coming weeks.

You can hear the entire recorded interview with Neal Richardson, detailing his experience and advice, by watching the on-demand webinar recording here.