Back-to-school season means new and returning students as well as their devices. There will be new accounts and a fresh wave of activity across your school’s tech systems. This makes it a great time to review the basics of security that can help protect students, staff, and school operations. 

Unfortunately, K-12 schools remain frequent targets for cybercriminals. Universities are common targets, too. This hasn't changed after another summer, but you can help keep school-provided devices safe and start the school year on a secure footing with a few tasks. 

1. Take inventory of devices and systems

Do you know what’s connected to your network? Before the school year gets too busy, update your inventory of school-owned laptops, tablets, phones, servers, software, and other technology.

Identify which systems and data are most critical to operations. An accurate asset inventory can help you prioritize security efforts and recover more effectively if an incident occurs. This is a key step toward making your school cyber resilient.

2. Update everything

Apply available updates to operating systems, applications, browsers, and other software. Attackers often exploit known vulnerabilities that already have patches available. This is especially true with the latest AI platforms.

Don’t forget devices that may have been sitting off and unused over the summer. Before handing out laptops and tablets, make sure they’re running current software and security updates. This can take a while, but it is well worth the effort. Schedule some time to do this, and alert everyone with devices that updates are headed their way and that they should restart.

3. Review accounts and access 

The beginning of the school year is the perfect time to clean up accounts, i.e. an account audit. Remove access for former employees and students, review administrative privileges, and make sure people have access only to the systems and information they need. This principle of least privilege can limit the damage if an account is compromised.

Take the opportunity to review internal processes for account management, too. Because of turnover, review existing processes and ensure that everything is updated. 

Encourage long, unique passwords for every account and enable multifactor authentication (MFA). MFA remains one of the most impactful cybersecurity measures schools can implement. If your school doesn't already use a password manager system, consider one now! 

This is also a great time to think about what websites student laptops can access. Talk to leadership about what sites to block—YouTube and social media are probably high on your to-block list.

4. Prepare staff for phishing 

A new school year brings plenty of legitimate emails about schedules, payroll, benefits, student records, and technology. That creates opportunities for scammers to send convincing phishing messages.

Remind employees to slow down and verify unexpected requests, especially those involving passwords, money, or sensitive information. Just as important, make sure everyone knows how to report a suspicious message.

Phishing awareness shouldn’t be a one-time back-to-school training. Build reminders and cybersecurity education into the school year. Participate in Cybersecurity Awareness Month in October—we have a free toolkit! 

5. Protect and back up important data 

Schools handle sensitive information about students, families, and employees. Review where that information is stored and who can access it. Review your data management policy and examine how it’s being implemented – if you don’t have such a policy, explore bringing one to life! 

Make sure critical systems and data are backed up and that those backups are ransomware-resistant. Think about this before you face a real ransomware attack! Most importantly, test your backups. A backup you can’t restore when you need it won’t help during an incident. 

Ensure backups are encrypted and that a backup system is managed by non-domain-joined accounts with separate credentials to reduce the chance the backups are compromised if an incident occurs. 

6. Review your incident response plan

Cybersecurity incidents can happen despite strong defenses. Before one occurs, make sure the right people know what to do. During the summer or the first few weeks of the school year, review your incident response plan, including who handles technical response, communications, and decision-making. You can even walk through a realistic scenario with relevant staff to identify gaps before a real emergency.

Engaging other schools and school districts nearby has real value. This provides many benefits, including crowdsourcing solutions. As an example, one school’s IT team can send notices to other security leaders about phishing campaigns they’ve seen at their school.

Keep your school safe! 

No school can eliminate every cyber risk, and many districts face limited budgets and IT resources. The goal isn’t to do everything at once. Start with the most impactful actions: update systems, protect accounts with strong passwords and MFA, prepare people to recognize phishing, maintain reliable backups, and know how you’ll respond when something goes wrong. These fundamentals can go a long way toward helping your school start—and stay—secure throughout the year. For more cybersecurity tips and tricks, sign up for our free email newsletter!