BY MIKE ADAMS AND FRANK RIZZO
Great Neck Public Schools Director of Technology Marc Epstein said the district is looking into ways to revamp its cybersecurity measures following a string of prominent incidents at Nassau County schools over the past few months.
“In response to what we have seen, learned, and heard, we have undertaken an internal review of our network security practices,” Epstein said. “The issue of cybersecurity and data privacy has been placed on the agenda for the December Board of Education meeting, when a presentation will be made to the board and public to raise awareness about these issues, review steps previously taken to tighten network security, and highlight possible additional action steps for the future.”
The constant battle between hackers and those who protect computer networks took an ominous turn earlier this summer, when the Rockville Centre School District had to pay an $88,000 ransom to a shadowy group that encrypted the district’s server files.
The district stated that experts from Homeland Security and the FBI were called in and were able to identify the Ryuk virus, which evaded all firewalls and other security software.
According to the district, “Neither agency, however, had a decryption tool that would effectively enable us to restore our data and emails and no other aid was offered to us.”
An analysis determined that retrieving and safely restoring the data would not be cost-effective, and it was decided to pay the ransom.
“While it was certainly a difficult decision, the district was made aware that many of its files would not have been recovered without paying the ransom,” district officials wrote in a compendium of frequently asked questions following the attack. “That was particularly true of files involving student work and projects. In addition, there was no guarantee that email records could be recovered in a timely manner, but it would take months of extensive work and considerable expense to restore them. The cost-benefit comparison clearly showed that the least expensive and most time effective restorative process was to pay the ransom.”
Rockville Centre isn’t the only district to deal with a potentially devastating ransome attack this year. A few weeks after news of Rockville Centre’s incident spread, the Mineola School District discovered that a virus had been lying dormant in its network for about six months, sifting through its the district’s data and looking for vulnerabilities. A timely purging after word of Rockville Centre’s attack, and the foresight to store sensitive data off network, saved Mineola from having to pay a similar ransom.
“Our network engineer started to cut things off,” Mineola Superintendent of Schools Michael Nagler said. “He closed ports and closed any outgoing communications. He took our backups offline, which turned out to be our most fortunate occurrence. When the virus struck it did cripple our network, but it did not infect all our data. So therefore, we had no reason to pay a ransom.”
The Center for Internet Security revealed that “ransomware” is an increasing problem, affecting government, public and private entities alike. By just Sept. 24, the center found that reports of ransomware attacks on databases at all levels of government had increased 60 percent compared to all of 2019.
“The public sector has been pummeled recently by ransomware,” Benjamin Dynkin, CEO of Great Neck-based Atlas Cybersecurity, a company that provides digital protection for large public and private entities across the country, said. “There’s definitely been a turn in the appreciation of the threat.”
Public bodies that have long ignored the risk of a cyber attack, Dynkin said, are not growing wise to the risk they pose and the extent of the work that needs to be done to properly protect digitized information.
“It’s not just ‘I buy this new, shiny box’,” Dyknin said. “I have to change the processes I have, I have to implement better technology, I have to get more trained people and I have to get better partners.”
Dynkin was unable to say what Nassau municipalities and school districts Atlas works with, but mentioned several nearby public bodies have contacted the company since word of the ransomware attack on Rockville Centre spread.
“The Westbury School District has put in place what we think is going to prevent any kind of cybersecurity attack within our system and we are hopeful that we have all the necessary equipment and software to prevent things from happening,” Westbury School District Superintendent Eudes Budhai said. “However, the inevitable is the inevitable. We’re all concerned about this across the board.”
Above the district level, concerns about cyber attacks have grown prevalent enough that Town of North Hempstead Supervisor Judi Bosworth and challenger David Redmond were asked what they would do to prevent one from hitting the town at an Oct. 17 League of Women Voters panel.
“We’re constantly updating our software,” Bosworth said. “There’s not a meeting that goes by where we’re not updating our software. There are measures in place to ward against this, so I’m confident that we are doing what we need to do to avoid any kind of situation.”
At the county level, Nassau County Executive Laura Curran introduced the county’s information technology (IT) team at an August press conference and promised to send them out in the community to help residents keep their computers safe. Nassau County BOCES has also held forums on cybersecurity for school district officials.
“It is estimated that in the year 2021, $6 trillion in damages worldwide will be caused by cybercrime,” Curran said. “There’s a hacking attack every 39 seconds in the U.S., affecting one of three Americans every year. In Nassau County, we have seen 95 cybercrimes so far in 2019, 42 of which are cases of grand larceny. I imagine there are many more. These are the ones that are being reported. But many are not.”
—Additional reporting by Anthony Murray
[…] Town, County, Schools And Private Sector Prepare For Cyberattacks. […]