WEBVTT 00:00:05.880 --> 00:00:08.758 Alright, good afternoon everyone, 00:00:08.758 --> 00:00:12.637 and welcome back to the final panel of this digital forum, 00:00:12.637 --> 00:00:15.098 which will be focused on cybersecurity 00:00:15.098 --> 00:00:17.225 and building resilience. 00:00:17.225 --> 00:00:18.226 My name is Lindsay Burton 00:00:18.226 --> 00:00:21.312 and I am the Acting Deputy Associate Director 00:00:21.312 --> 00:00:23.732 for CISA Schools Safety Taskforce. 00:00:23.732 --> 00:00:26.401 And we are proud to be co-hosting this event today 00:00:26.401 --> 00:00:30.864 with our partners at CP3 and the Department of Education. 00:00:30.864 --> 00:00:33.366 And really this panel is designed to discuss ways 00:00:33.366 --> 00:00:35.785 in which the federal government, private sector, 00:00:35.785 --> 00:00:37.746 and civil society are working together 00:00:37.746 --> 00:00:40.832 to prioritize cybersecurity and technology systems 00:00:40.832 --> 00:00:42.125 for K-12 schools. 00:00:42.125 --> 00:00:43.626 So I'm honored, again, 00:00:43.626 --> 00:00:46.254 to be here with our esteemed moderator and panelists. 00:00:46.254 --> 00:00:48.465 I'm really looking forward to all the great insights 00:00:48.465 --> 00:00:50.300 that we're going to hear from each of them. 00:00:50.300 --> 00:00:53.136 So with that I'm going to quickly introduce our panel, 00:00:53.136 --> 00:00:55.096 and then hand it over to our moderator. 00:00:55.096 --> 00:00:58.224 And I'll start with our moderator, Marlon Shears. 00:00:58.224 --> 00:01:01.311 Marlon is the Chief Information Officer 00:01:01.311 --> 00:01:03.897 for the Fort Worth Independent School District. 00:01:03.897 --> 00:01:05.732 With over twenty years of experience 00:01:05.732 --> 00:01:07.066 in information technology, 00:01:07.066 --> 00:01:10.403 Marlon has been helping K-12 education entities 00:01:10.403 --> 00:01:13.281 grow their technological capabilities. 00:01:13.281 --> 00:01:15.325 In his current role Marlon is responsible 00:01:15.325 --> 00:01:17.660 for strategic alignments and governance, 00:01:17.660 --> 00:01:20.830 and assessing internal technological capabilities. 00:01:20.830 --> 00:01:22.916 Next we have Kristina Ishmael 00:01:22.916 --> 00:01:25.210 who serves as the Deputy Director 00:01:25.210 --> 00:01:28.004 for the Office of Educational Technology 00:01:28.004 --> 00:01:30.048 within the Department of Education. 00:01:30.048 --> 00:01:31.925 In this role she is leading the office 00:01:31.925 --> 00:01:34.302 in its vision and execution of priorities 00:01:34.302 --> 00:01:37.472 focused on improving teaching and learning. 00:01:37.472 --> 00:01:38.723 Next we have Sean McAfee 00:01:38.723 --> 00:01:40.475 who is the Deputy Branch Chief 00:01:40.475 --> 00:01:43.311 of Cyber Defense, Education, and Training, 00:01:43.311 --> 00:01:45.772 or CDET for short, within CISA. 00:01:45.772 --> 00:01:48.524 Within CDET Sean leads strategic planning efforts 00:01:48.524 --> 00:01:50.735 around training and education to assist 00:01:50.735 --> 00:01:55.240 in combatting the national, I'm sorry, 00:01:55.240 --> 00:01:59.077 to bolstering the National Cybersecurity workforce as well. 00:01:59.077 --> 00:02:01.913 Next we have Doug Levin who is the cofounder 00:02:01.913 --> 00:02:04.707 and National Director for the K-12 00:02:04.707 --> 00:02:07.919 Security Information Exchange, or K-12 SIX. 00:02:07.919 --> 00:02:10.546 K-12 SIX is a non-profit membership community 00:02:10.546 --> 00:02:13.341 dedicated to helping the K-12 sector 00:02:13.341 --> 00:02:16.719 defend itself against emerging cybersecurity threats. 00:02:16.719 --> 00:02:18.012 We also have David Mendez 00:02:18.012 --> 00:02:19.722 who is the Information Security Lead 00:02:19.722 --> 00:02:21.266 and Technical Project Manager 00:02:21.266 --> 00:02:24.394 for Region 10 Education Service Center in Texas. 00:02:24.394 --> 00:02:26.896 And finally we have Rod Russeau 00:02:26.896 --> 00:02:28.106 who is the Director 00:02:28.106 --> 00:02:30.900 of Technology and Information Services 00:02:30.900 --> 00:02:33.111 at Community High School District in Illinois 00:02:33.111 --> 00:02:35.488 and also the Chairperson for the Consortium 00:02:35.488 --> 00:02:38.241 for School Networking Cybersecurity Initiative. 00:02:38.241 --> 00:02:39.575 So, a big mouthful there. 00:02:39.575 --> 00:02:41.202 I know we only have an hour, 00:02:41.202 --> 00:02:44.205 so I'm excited to go ahead and turn it over to Marlon 00:02:44.205 --> 00:02:47.041 so we can go ahead and get the panel discussion going. 00:02:47.041 --> 00:02:48.751 Marlon, over to you. 00:02:48.751 --> 00:02:50.378 >> Thank you, Lindsay, appreciate it. 00:02:50.378 --> 00:02:52.630 Good morning, good afternoon everyone, 00:02:52.630 --> 00:02:54.257 and welcome to this panel. 00:02:54.257 --> 00:02:56.676 I think you'll find it very informative. 00:02:56.676 --> 00:02:59.095 I haven't seen such a great group of people 00:02:59.095 --> 00:03:02.056 put together to discuss such a topic before. 00:03:02.056 --> 00:03:04.183 So we're going to kick it off. 00:03:04.183 --> 00:03:06.728 And Rod, I just want to jump right into you, Rod. 00:03:06.728 --> 00:03:09.814 Rod, why do you feel it's important for states, 00:03:09.814 --> 00:03:12.817 counties, government organizations, 00:03:12.817 --> 00:03:17.280 and state leaders to focus on cybersecurity? 00:03:17.280 --> 00:03:18.489 >> Thanks, Marlon. 00:03:18.489 --> 00:03:20.700 I really appreciate, I'm honored 00:03:20.700 --> 00:03:23.119 and humbled to be here with all of you. 00:03:23.119 --> 00:03:26.873 I look forward to learning as much as I do sharing. 00:03:26.873 --> 00:03:30.585 I think school districts are businesses 00:03:30.585 --> 00:03:32.462 but our business is learning. 00:03:32.462 --> 00:03:35.631 So I think the first thing that comes to mind, 00:03:35.631 --> 00:03:39.635 one of the first things is just the continuity 00:03:39.635 --> 00:03:41.179 of learning is so important. 00:03:41.179 --> 00:03:44.766 So that loss or interruption of learning 00:03:44.766 --> 00:03:48.811 really is something that is challenging these days 00:03:48.811 --> 00:03:52.774 with all of the cybersecurity threats that exist, 00:03:52.774 --> 00:03:55.693 whether it be phishing, ransomware, 00:03:55.693 --> 00:03:59.238 denial of service attacks, and so on. 00:03:59.238 --> 00:04:03.576 Also, life safety, our students' safety, 00:04:03.576 --> 00:04:06.120 is number one. 00:04:06.120 --> 00:04:08.206 Our learning institutions are important 00:04:08.206 --> 00:04:11.167 but there's the safety of our human beings 00:04:11.167 --> 00:04:13.544 is most, most important. 00:04:13.544 --> 00:04:17.840 And data is so connected with students, 00:04:17.840 --> 00:04:23.721 with all of us now, that the data privacy aspect, 00:04:23.721 --> 00:04:27.058 the security of our data you can't really separate, 00:04:27.058 --> 00:04:29.727 or I don't think you can really separate security 00:04:29.727 --> 00:04:31.062 from data privacy. 00:04:31.062 --> 00:04:34.565 I think they're very, very closely intertwined. 00:04:34.565 --> 00:04:37.318 And the consequences of a data breach 00:04:37.318 --> 00:04:42.156 that it might have on one of us is somewhat more immediate. 00:04:42.156 --> 00:04:45.826 Data theft, data privacy issues for students 00:04:45.826 --> 00:04:49.705 could affect them later on in life. 00:04:49.705 --> 00:04:52.375 Two other quick things, Marlon, if I could. 00:04:52.375 --> 00:04:57.421 One is that any school districts 00:04:57.421 --> 00:05:01.968 that's tried to get their cybersecurity insurance renewed 00:05:01.968 --> 00:05:05.179 as of late will find that the requirements 00:05:05.179 --> 00:05:08.099 for that have just skyrocketed. 00:05:08.099 --> 00:05:12.270 And number one, it's the best practice thing to do 00:05:12.270 --> 00:05:14.230 but number two it kind of speaks 00:05:14.230 --> 00:05:18.192 to why we all need to really be focused on this 00:05:18.192 --> 00:05:22.238 because it's such a growing concern. 00:05:22.238 --> 00:05:28.577 And finally, really it just, it's important for our future, 00:05:28.577 --> 00:05:32.206 that we keep ourselves safe 00:05:32.206 --> 00:05:34.542 against the threats that are out there. 00:05:34.542 --> 00:05:39.255 And through our work with staff and with students, 00:05:39.255 --> 00:05:43.050 cybersecurity technology use doesn't start and end 00:05:43.050 --> 00:05:45.177 when people walk in and out of our doors. 00:05:45.177 --> 00:05:50.516 It's so much of a human, part of all of our lives now, 00:05:50.516 --> 00:05:54.520 that the better we can process that ourselves, 00:05:54.520 --> 00:05:56.063 that we can help our students 00:05:56.063 --> 00:06:00.192 and our staff kind of develop that culture and awareness 00:06:00.192 --> 00:06:03.738 that they can bring to all aspects of their lives. 00:06:03.738 --> 00:06:05.156 >>Thank you, Rod. 00:06:05.156 --> 00:06:08.951 Doug, would you like to put a state or local spin on that? 00:06:08.951 --> 00:06:10.995 >>Yeah. And let me if I can, Marlon, 00:06:10.995 --> 00:06:13.039 and thanks very much and thank you, Rod, 00:06:13.039 --> 00:06:16.876 and also to DHS, CISA, US Department of Education. 00:06:16.876 --> 00:06:20.838 I'm thrilled to have such a group of auspicious folks 00:06:20.838 --> 00:06:23.549 together on such an important topic. 00:06:23.549 --> 00:06:25.468 This is an issue that I've been passionate about 00:06:25.468 --> 00:06:26.886 for a number of years. 00:06:26.886 --> 00:06:31.974 And in fact, I've been conducting research on publicly 00:06:31.974 --> 00:06:34.977 disclosed school cybersecurity incidents since 2016. 00:06:34.977 --> 00:06:37.354 I've written now three reports 00:06:37.354 --> 00:06:38.981 on the state of K-12 cybersecurity, 00:06:38.981 --> 00:06:43.402 and have another one coming out in about a month and a half. 00:06:46.030 --> 00:06:50.201 Absolutely everything Rod has suggested 00:06:50.201 --> 00:06:53.120 is absolutely the case. 00:06:53.120 --> 00:06:56.582 But the reason that these risks, that we're facing these risks, 00:06:56.582 --> 00:06:58.542 is based on what we've been seeing 00:06:58.542 --> 00:07:00.878 from publicly available data, 00:07:00.878 --> 00:07:03.464 not only have the frequency of incidents 00:07:03.464 --> 00:07:05.257 that schools are experiencing 00:07:05.257 --> 00:07:06.717 has been dramatically increasing, 00:07:06.717 --> 00:07:08.886 but the significance of them. 00:07:08.886 --> 00:07:11.806 And we can argue significance really any way 00:07:11.806 --> 00:07:14.391 that you talk about it and I think Rod laid out 00:07:14.391 --> 00:07:18.187 a number of those risks quite clearly. 00:07:18.187 --> 00:07:23.609 So, clearly concerns about the physical and emotional safety 00:07:23.609 --> 00:07:28.405 of the students that we have a duty of care to protect, 00:07:28.405 --> 00:07:30.825 but also of our employees. 00:07:30.825 --> 00:07:32.576 Rod also talked about money. Right? 00:07:32.576 --> 00:07:34.787 And so there's sort of the operational costs 00:07:34.787 --> 00:07:36.080 of doing business, 00:07:36.080 --> 00:07:38.249 but also schools have been subject 00:07:38.249 --> 00:07:41.085 to multi-million dollar business 00:07:41.085 --> 00:07:43.963 email compromise fraud and phishing. 00:07:43.963 --> 00:07:45.881 They've been targeted for ransomware attacks, 00:07:45.881 --> 00:07:49.051 where the attackers have been demanding millions of dollars 00:07:49.051 --> 00:07:52.972 to restore school IT systems. 00:07:52.972 --> 00:07:55.558 Rod also talked about continuity of operations. 00:07:55.558 --> 00:07:57.560 And the impact then on the school community 00:07:57.560 --> 00:08:00.563 when schools have literally had to close, 00:08:00.563 --> 00:08:03.983 in some cases for days or a week or more, 00:08:03.983 --> 00:08:05.317 in responding to these incidents. 00:08:05.317 --> 00:08:07.820 Literally not able to provide any services 00:08:07.820 --> 00:08:11.240 to students whatsoever. 00:08:11.240 --> 00:08:14.868 I think one thing that also resonates very strongly 00:08:14.868 --> 00:08:18.372 in the education sector is trust, right? 00:08:18.372 --> 00:08:23.877 Our communities, our parents, put trust in schools. 00:08:23.877 --> 00:08:26.589 And they can lose that trust, 00:08:26.589 --> 00:08:28.799 not necessarily if they experience an incident 00:08:28.799 --> 00:08:31.885 because frankly I think experiencing an incident 00:08:31.885 --> 00:08:33.887 unfortunately is not atypical now, 00:08:33.887 --> 00:08:37.850 but in responding to that incident. Right? 00:08:37.850 --> 00:08:40.686 And that can then make it very difficult 00:08:40.686 --> 00:08:42.688 for schools to regain that trust back. 00:08:42.688 --> 00:08:44.732 For that superintendent, for the IT team, 00:08:44.732 --> 00:08:48.152 for all of the leadership, the school board members, 00:08:48.152 --> 00:08:49.820 to get that trust back. 00:08:49.820 --> 00:08:53.324 And then finally, and this is maybe a little bit beyond 00:08:53.324 --> 00:08:54.700 what we tend to think about, 00:08:54.700 --> 00:08:56.577 but we've seen some evidence of this. 00:08:56.577 --> 00:08:58.704 I'd be curious if Sean for instance 00:08:58.704 --> 00:09:01.749 has seen evidence for this work over in the CISA side. 00:09:01.749 --> 00:09:05.919 Which is that sometimes threat actors attack schools 00:09:05.919 --> 00:09:10.549 because they can be a platform then to attack other entities 00:09:10.549 --> 00:09:13.761 that are maybe even more valuable. Right? 00:09:13.761 --> 00:09:17.056 That might be other government sectors. 00:09:17.056 --> 00:09:19.725 Certainly like around elections. 00:09:19.725 --> 00:09:21.727 It could be other critical infrastructure. 00:09:21.727 --> 00:09:25.481 And if criminals can repurpose 00:09:25.481 --> 00:09:29.360 someone else's IT systems for their ends, 00:09:29.360 --> 00:09:31.362 they will certainly do that. 00:09:31.362 --> 00:09:33.238 And I am aware of some school districts 00:09:33.238 --> 00:09:37.576 that have suffered those sorts of issues. 00:09:37.576 --> 00:09:40.454 And that means that it is a broad issue. 00:09:40.454 --> 00:09:43.082 It is an issue that I know policymakers are hearing 00:09:43.082 --> 00:09:45.000 about at the state level. 00:09:45.000 --> 00:09:45.959 People are asking them, 00:09:45.959 --> 00:09:48.295 like how can we better protect the schools? 00:09:48.295 --> 00:09:51.465 What resources do the schools need? 00:09:51.465 --> 00:09:57.137 And how, where are resources that already exist 00:09:57.137 --> 00:10:00.349 that we can just sort of direct and get to schools' hands? 00:10:00.349 --> 00:10:02.559 So, this has become a policy issue 00:10:02.559 --> 00:10:05.020 because it has bubbled up from the field. 00:10:05.020 --> 00:10:07.397 This is not something that's getting pushed down 00:10:07.397 --> 00:10:09.316 because someone on high decided 00:10:09.316 --> 00:10:11.068 that this is the new trend of the month. 00:10:11.068 --> 00:10:14.488 No. This is something that we are dealing with, 00:10:14.488 --> 00:10:16.532 whack-a-mole, day in and day out. 00:10:16.532 --> 00:10:18.909 And I think it's coming to the attention of folks 00:10:18.909 --> 00:10:20.202 at the state level 00:10:20.202 --> 00:10:22.579 and they're very interested in learning more. 00:10:22.579 --> 00:10:24.748 And I would say that in many respects people 00:10:24.748 --> 00:10:27.960 also have been reticent to talk about this issue, 00:10:27.960 --> 00:10:29.211 which is a challenge. 00:10:29.211 --> 00:10:30.379 And I understand, 00:10:30.379 --> 00:10:34.091 if you've experienced an incident in your district, 00:10:34.091 --> 00:10:37.052 you know, you don't want to necessarily seek more publicity 00:10:37.052 --> 00:10:40.973 for something that maybe didn't go as the way that you'd hoped. 00:10:40.973 --> 00:10:43.225 But unless we are able to share these stories 00:10:43.225 --> 00:10:45.269 and have these conversations like we're having now, 00:10:45.269 --> 00:10:47.896 and share that with people who can help us, 00:10:47.896 --> 00:10:50.232 they don't have the information they have to do that. 00:10:50.232 --> 00:10:54.319 So I think that's why state level folks are interested, 00:10:54.319 --> 00:10:56.071 and I think that's why we also need to reach out 00:10:56.071 --> 00:10:58.782 and make sure that they, 00:10:58.782 --> 00:11:00.492 that we inform them about what's going on. 00:11:00.492 --> 00:11:02.619 And that's why I'm thrilled to have this conversation today. 00:11:05.998 --> 00:11:08.500 Oh, you're muted there, Marlon. 00:11:08.500 --> 00:11:09.751 >>It happened to me. 00:11:09.751 --> 00:11:13.755 The moderator muted himself, right? Go figure. 00:11:13.755 --> 00:11:16.550 But I think nothing has, I agree with everyone. 00:11:16.550 --> 00:11:23.390 I think CIO/CTOs haven't been moved as fast to the table 00:11:23.390 --> 00:11:26.768 as cybersecurity has moved us to the table. Right? 00:11:26.768 --> 00:11:29.980 And it's very important that we focus on everything you said 00:11:29.980 --> 00:11:35.736 because one of the things that is key and prevalent is data. 00:11:35.736 --> 00:11:41.199 Right? And that data drives a lot of things down the road. 00:11:41.199 --> 00:11:45.912 And so, K through 12, higher ed, state organizations, 00:11:45.912 --> 00:11:50.917 one thing that we have is data and it's very valuable. 00:11:50.917 --> 00:11:56.548 And it's not just the private sector, cybersecurity issue. 00:11:56.548 --> 00:11:58.800 K through 12, state actors, 00:11:58.800 --> 00:12:01.887 we have things that are probably even more important 00:12:01.887 --> 00:12:04.473 sometimes than what private companies have. 00:12:04.473 --> 00:12:09.686 And so, with that I will turn to the panel and say, 00:12:09.686 --> 00:12:13.648 focusing just on cybersecurity as an IT issue, 00:12:13.648 --> 00:12:15.067 that's one section of it. 00:12:15.067 --> 00:12:20.030 But another important part is the protection of our children. 00:12:20.030 --> 00:12:22.407 So why do you feel, or how should I say, 00:12:22.407 --> 00:12:27.120 how can schools, educators, parents, make sure 00:12:27.120 --> 00:12:30.332 that students are protected from the cyber environment? 00:12:33.085 --> 00:12:36.004 >>I guess I can jump in here. 00:12:36.004 --> 00:12:40.467 Being at a service center that services 00:12:40.467 --> 00:12:42.886 a hundred and thirty school districts, 00:12:42.886 --> 00:12:47.682 close to 800,000-plus students in our area, 00:12:47.682 --> 00:12:51.812 I could tell you that it starts with creating awareness. 00:12:51.812 --> 00:12:55.690 Letting, teaching parents, teaching the community, 00:12:55.690 --> 00:12:57.317 how important this is. 00:12:57.317 --> 00:13:04.908 How this impacts a child's education in multiple ways, 00:13:04.908 --> 00:13:06.701 from economically. 00:13:06.701 --> 00:13:08.912 If they're not learning, 00:13:08.912 --> 00:13:11.790 I mean it's costing a school district money 00:13:11.790 --> 00:13:16.002 when they're down EDOS attacks and things of that nature. 00:13:16.002 --> 00:13:19.756 So creating this awareness and this nexus or web. 00:13:19.756 --> 00:13:24.594 You know, I like to compare it to almost like a nervous system. 00:13:24.594 --> 00:13:28.598 A synapse of - that just fires off 00:13:28.598 --> 00:13:30.725 and the entire community from the board member 00:13:30.725 --> 00:13:33.019 all the way down to the student understand 00:13:33.019 --> 00:13:34.563 the impact of security. 00:13:34.563 --> 00:13:37.816 Security in and of itself is a trait 00:13:37.816 --> 00:13:40.861 that's very characteristic of a child's upbringing. 00:13:40.861 --> 00:13:42.487 We want to feel safe. 00:13:42.487 --> 00:13:47.117 And so when we make that point across the board, you know. 00:13:47.117 --> 00:13:50.370 Of course you attach dollar signs and facts and figures, 00:13:50.370 --> 00:13:51.496 policies and procedures. 00:13:51.496 --> 00:13:52.831 But at the end of the day 00:13:52.831 --> 00:13:57.085 it's that sense of things are getting taken care of 00:13:57.085 --> 00:14:01.089 and you do that by creating awareness. 00:14:01.089 --> 00:14:04.384 I like to tell the story that about seven or eight years ago 00:14:04.384 --> 00:14:08.179 there was an amazing presentation 00:14:08.179 --> 00:14:11.725 by this endpoint protection group, 00:14:11.725 --> 00:14:13.810 company, that they were talking about 00:14:13.810 --> 00:14:18.356 how they were able to do all this protection, 00:14:18.356 --> 00:14:22.861 and in a war over there in Syria, 00:14:22.861 --> 00:14:24.362 and they were able to protect the generals. 00:14:24.362 --> 00:14:27.866 It was a fascinating presentation. 00:14:27.866 --> 00:14:31.411 And I remember asking them after the presentation is, 00:14:31.411 --> 00:14:33.580 hey, have you guys thought about schools? 00:14:33.580 --> 00:14:36.082 And I distinctly, and this is what drives 00:14:36.082 --> 00:14:39.002 my passion kind of like Doug's, is that he said, 00:14:39.002 --> 00:14:42.881 well, schools, they're not on the map right now. 00:14:42.881 --> 00:14:45.175 And it just blew my mind 00:14:45.175 --> 00:14:50.430 because talk about psychological warfare in the field. 00:14:50.430 --> 00:14:53.975 The very example that he gave eight years ago, 00:14:53.975 --> 00:14:57.187 I saw in not too long ago with one of our school districts. 00:14:57.187 --> 00:15:01.441 Where the threat actors were now messaging the parents. 00:15:01.441 --> 00:15:04.069 And they now sense that, oh my goodness, 00:15:04.069 --> 00:15:07.697 what I see on TV or I've heard, you know, 00:15:07.697 --> 00:15:10.825 the IT folks talk about, now it's happening to me. 00:15:10.825 --> 00:15:14.037 They're contacting me about some sort of ransomware payment. 00:15:14.037 --> 00:15:18.833 So it's important that we just create 00:15:18.833 --> 00:15:21.878 this sense of awareness across the community 00:15:21.878 --> 00:15:23.755 so that we can learn to empower. 00:15:23.755 --> 00:15:26.216 When you create that sense of awareness, 00:15:26.216 --> 00:15:28.134 you learn to empower folks 00:15:28.134 --> 00:15:31.471 to be what I call digital first responders. 00:15:34.140 --> 00:15:35.850 >>I'd like to build off of that a little bit. 00:15:35.850 --> 00:15:38.395 And thinking about the draft priorities 00:15:38.395 --> 00:15:40.730 that we have here for the Office of Ed Tech. 00:15:40.730 --> 00:15:43.358 I have to preface they are in draft. 00:15:43.358 --> 00:15:45.735 But we are certainly moving them forward 00:15:45.735 --> 00:15:47.737 to make them more publicly known. 00:15:47.737 --> 00:15:52.158 But due to the passing of the bipartisan infrastructure law, 00:15:52.158 --> 00:15:55.245 we now have codified in actual language 00:15:55.245 --> 00:15:57.288 the definition of digital equity. 00:15:57.288 --> 00:15:59.332 And as part of that we also have a definition 00:15:59.332 --> 00:16:00.875 for digital inclusion. 00:16:00.875 --> 00:16:05.004 And so because we have that actually like defined, 00:16:05.004 --> 00:16:06.965 it's not only connectivity and devices, 00:16:06.965 --> 00:16:08.425 instructional models and content, 00:16:08.425 --> 00:16:10.343 but it includes digital literacy. 00:16:10.343 --> 00:16:12.262 And so what David is talking about is, 00:16:12.262 --> 00:16:14.597 you know, of course the digital literacy aspect of this for, 00:16:14.597 --> 00:16:18.560 I think not only for our district leaders 00:16:18.560 --> 00:16:21.062 and IT staff but also with our students 00:16:21.062 --> 00:16:23.815 and their families and communities. 00:16:23.815 --> 00:16:25.191 And so that is certainly something 00:16:25.191 --> 00:16:29.571 that we are working on right now through a variety of projects, 00:16:29.571 --> 00:16:31.573 not only that are currently in the works here 00:16:31.573 --> 00:16:32.907 at the US Department of Education 00:16:32.907 --> 00:16:36.995 but also forthcoming in the next year to two, 00:16:36.995 --> 00:16:40.290 to help build up our capacities around digital literacy. 00:16:40.290 --> 00:16:43.251 Whether it's just threshold kind of basic skills 00:16:43.251 --> 00:16:46.212 to be able to get on devices and use them, 00:16:46.212 --> 00:16:47.463 but also to then safely 00:16:47.463 --> 00:16:51.509 and securely navigate digital ecosystem or digital spaces 00:16:51.509 --> 00:16:53.678 so that we can keep ourselves 00:16:53.678 --> 00:16:56.097 and our learners safe and secure. 00:16:56.097 --> 00:16:58.433 So, I think that's also a huge part 00:16:58.433 --> 00:17:01.477 that we have to make sure we're talking about here. 00:17:03.605 --> 00:17:05.231 >>Right. And can someone, before we take, 00:17:05.231 --> 00:17:08.693 and just jump off this question, just kind of go in, 00:17:08.693 --> 00:17:12.405 just briefly on the importance for parents and students, 00:17:12.405 --> 00:17:15.408 or parents, to understand the digital footprint 00:17:15.408 --> 00:17:17.911 for their students and what that means to their futures? 00:17:22.248 --> 00:17:24.959 Maybe Kristina or Doug or Sean? 00:17:24.959 --> 00:17:26.544 >>Sean, it looks like you're trying to talk 00:17:26.544 --> 00:17:28.046 but we don't have your audio. 00:17:29.255 --> 00:17:36.554 Of course, there you are. 00:17:36.554 --> 00:17:39.682 >>Leave it to a cyber person to not have the mike. 00:17:39.682 --> 00:17:41.267 So there's always something. 00:17:41.267 --> 00:17:44.145 I had points across the board here with Doug, 00:17:44.145 --> 00:17:47.398 Kristina, and David, and Marlon as well. 00:17:47.398 --> 00:17:50.902 I think we've hit on some really valid points. 00:17:50.902 --> 00:17:55.573 I'll piggyback on some of them. Marlon had chatted about data. 00:17:55.573 --> 00:17:58.117 And as simple as that word is, 00:17:58.117 --> 00:18:01.120 sometimes it gets a little bit lost in translation. 00:18:01.120 --> 00:18:03.414 But for parents, as well as students, 00:18:03.414 --> 00:18:06.167 as well as educators, as well as our state leaders, 00:18:06.167 --> 00:18:10.129 if you have a data footprint, which we all do, it is vital. 00:18:10.129 --> 00:18:15.259 And Doug had made an assertion about a staging ground 00:18:15.259 --> 00:18:18.721 using a platform say, and then it's leveraged toward 00:18:18.721 --> 00:18:21.265 maybe attack in a different part of the government. 00:18:21.265 --> 00:18:23.893 Well, those scenarios can all play out in different ways. 00:18:23.893 --> 00:18:25.436 And they are. 00:18:25.436 --> 00:18:29.065 At the student level though, if you have a mobile phone, 00:18:29.065 --> 00:18:32.443 if you have a laptop and a device, you are creating data. 00:18:32.443 --> 00:18:34.946 And whether that's data on a school network, 00:18:34.946 --> 00:18:41.035 or data in the cloud, yeah, infrastructure of your ISP, 00:18:41.035 --> 00:18:43.871 we all are leaving our footprints there. 00:18:43.871 --> 00:18:48.918 So I think when I hear Kristina talking about digital literacy 00:18:48.918 --> 00:18:52.797 and digital equity as well as digital inclusion, 00:18:52.797 --> 00:18:54.799 I think that that plays in there. 00:18:54.799 --> 00:18:57.468 Because I think we have to be mindful of 00:18:57.468 --> 00:18:59.929 where we are as a person, as a consumer, 00:18:59.929 --> 00:19:03.474 what our consumer habits lead to on our digital footprint 00:19:03.474 --> 00:19:05.935 and what the ramifications are. 00:19:05.935 --> 00:19:10.231 The assertion that, I'm a child, or I am a student, 00:19:10.231 --> 00:19:11.607 and my data doesn't matter, 00:19:11.607 --> 00:19:15.945 is no longer I think an acceptable conclusion 00:19:15.945 --> 00:19:20.950 because it is being leveraged in a way now that is unfortunate. 00:19:20.950 --> 00:19:25.079 But, you know, I think that what we are starting to see 00:19:25.079 --> 00:19:26.747 is a trend and an upward trend 00:19:26.747 --> 00:19:28.791 with all the reporting that's coming in 00:19:28.791 --> 00:19:31.169 and the attack patterns that have been happening, 00:19:31.169 --> 00:19:34.422 is that it is a data-rich environment. 00:19:34.422 --> 00:19:37.258 And as long as you can get a first name/last name, 00:19:37.258 --> 00:19:38.426 if you get a first name/last name, 00:19:38.426 --> 00:19:43.764 your PII, date of birth, social security, address, phone, 00:19:43.764 --> 00:19:46.726 email, those are all things that can be resting 00:19:46.726 --> 00:19:49.604 as datapoints for an individual. 00:19:49.604 --> 00:19:52.190 And if the adversary gets that, you know, 00:19:52.190 --> 00:19:54.150 they can make a lot of claims with that. 00:19:54.150 --> 00:19:57.195 They can do fraud. They can do identity theft. 00:19:57.195 --> 00:20:00.156 And those are the, that's what's the routine, 00:20:00.156 --> 00:20:01.782 unfortunately the routine analysis 00:20:01.782 --> 00:20:04.076 that's coming in with those attacks. 00:20:04.076 --> 00:20:06.287 Children's data is being utilized 00:20:06.287 --> 00:20:10.917 in a way where they can, after the attack, 00:20:10.917 --> 00:20:12.919 that data cluster can go to the dark web. 00:20:12.919 --> 00:20:14.378 It can be auctioned off 00:20:14.378 --> 00:20:17.215 and then it can be leveraged for things like identity theft. 00:20:17.215 --> 00:20:18.507 Without, you know. 00:20:18.507 --> 00:20:20.259 And if you really think about that, 00:20:20.259 --> 00:20:22.762 as a parent and as an educator 00:20:22.762 --> 00:20:25.556 or even a state government official, 00:20:25.556 --> 00:20:27.266 that data goes to the dark web. 00:20:27.266 --> 00:20:29.977 Anyone can claim it for a certain amount of money, 00:20:29.977 --> 00:20:31.729 however it transacts. 00:20:31.729 --> 00:20:33.731 And then they could have 50,000 records 00:20:33.731 --> 00:20:36.275 or they could have hundreds of thousands of records. 00:20:36.275 --> 00:20:38.194 And all they're going to go through is a series 00:20:38.194 --> 00:20:41.864 of how do we turn this into something for us, 00:20:41.864 --> 00:20:44.992 which ends up being identity theft. 00:20:44.992 --> 00:20:46.410 The aspect that I think has been talked 00:20:46.410 --> 00:20:49.163 about a lot in open source and a lot of the media articles 00:20:49.163 --> 00:20:52.249 that are out there too, is that think about it. 00:20:52.249 --> 00:20:56.003 As a student or child depending on where you're at in age range, 00:20:56.003 --> 00:20:58.255 you don't have kind of the adult version 00:20:58.255 --> 00:20:59.799 of identity theft protection. 00:20:59.799 --> 00:21:02.134 You know, you don't have a credit history. 00:21:02.134 --> 00:21:04.011 A lot of that stuff is going unseen 00:21:04.011 --> 00:21:06.472 and unknown for potentially for years. 00:21:06.472 --> 00:21:10.434 So, one of the biggest risks that we're seeing out there, 00:21:10.434 --> 00:21:12.687 it does come back to the student experience. 00:21:12.687 --> 00:21:14.939 You know, Doug really illuminated 00:21:14.939 --> 00:21:16.816 what a disruption can be 00:21:16.816 --> 00:21:18.484 for that student experience right now, 00:21:18.484 --> 00:21:22.571 just from a day of stoppage to a week of stoppage by attack. 00:21:22.571 --> 00:21:25.533 But the long term effects for parents to be and consider is, 00:21:25.533 --> 00:21:31.956 how do we untangle ourselves and/or our child, 00:21:31.956 --> 00:21:35.543 dealing with long term abuse of their information 00:21:35.543 --> 00:21:37.545 in the form of identity theft and fraud? 00:21:37.545 --> 00:21:41.048 So, a bit of a rant there, but the data, 00:21:41.048 --> 00:21:44.635 it all comes back to the data and why it is so important 00:21:44.635 --> 00:21:49.640 for us to think beyond kind of where we sit with our devices 00:21:49.640 --> 00:21:52.727 and really know what the long term effects are. 00:21:52.727 --> 00:21:54.019 It can be days, months, 00:21:54.019 --> 00:21:56.939 or years to fix identity theft as we all know, 00:21:56.939 --> 00:21:58.190 and as we're seeing that stage. 00:21:58.190 --> 00:22:00.109 So I'll pause there, Marlon, 00:22:00.109 --> 00:22:03.654 and just leave it there for the group. 00:22:03.654 --> 00:22:04.905 >>Thank you Sean. 00:22:04.905 --> 00:22:08.451 And for any parent that's like, dark web? 00:22:08.451 --> 00:22:11.537 In short, that's the grocery store 00:22:11.537 --> 00:22:14.039 for all of the negative people in the world 00:22:14.039 --> 00:22:15.708 that want to go shopping. Right? 00:22:15.708 --> 00:22:19.253 It's the online marketplace to get your stuff. 00:22:19.253 --> 00:22:22.381 And so, thank you Sean for mentioning that 00:22:22.381 --> 00:22:24.884 because it's very important. 00:22:24.884 --> 00:22:28.012 >>Hey, Marlon, before we leave this question 00:22:28.012 --> 00:22:29.388 can I chime in with a few things? 00:22:29.388 --> 00:22:31.015 ->>Oh, of course. ->>Thank you. 00:22:31.015 --> 00:22:35.311 Yeah, I'm just thinking for maybe some actionable stuff 00:22:35.311 --> 00:22:37.062 for some school districts 00:22:37.062 --> 00:22:41.275 that might be out there in the audience. 00:22:41.275 --> 00:22:46.447 Like Doug said, it's not a matter of 00:22:46.447 --> 00:22:50.159 if we're going to experience a security incident 00:22:50.159 --> 00:22:52.786 or a data breach, we are, we will. 00:22:52.786 --> 00:22:55.372 So it's a matter of being prepared for that. 00:22:55.372 --> 00:22:56.665 I'm somewhat of a relic. 00:22:56.665 --> 00:22:58.292 I've been in the technology field 00:22:58.292 --> 00:23:02.755 since 1977 back in the mainframe days 00:23:02.755 --> 00:23:05.716 when there was no internet, there was no email, 00:23:05.716 --> 00:23:09.220 all the threats that we have in our world today. 00:23:09.220 --> 00:23:13.307 We had threats but they were more physical in nature. 00:23:13.307 --> 00:23:17.061 And I've really only been fairly heavily involved 00:23:17.061 --> 00:23:18.979 in the cybersecurity realm of things 00:23:18.979 --> 00:23:21.440 for a little over four years. 00:23:21.440 --> 00:23:23.609 So I went the majority of my career 00:23:23.609 --> 00:23:26.195 and then got instantly and deeply immersed 00:23:26.195 --> 00:23:27.404 in this part of it. 00:23:27.404 --> 00:23:31.158 And the pace of change is just wild. 00:23:31.158 --> 00:23:33.077 But one of the things that I've been talking 00:23:33.077 --> 00:23:37.665 with a lot of folks about and trying to start modeling 00:23:37.665 --> 00:23:39.583 that behavior here in our district 00:23:39.583 --> 00:23:45.297 is the idea of responsibility and accountability. 00:23:45.297 --> 00:23:49.426 Who's responsible for security? One might say we all are. 00:23:49.426 --> 00:23:52.554 A lot of people assume IT is. 00:23:52.554 --> 00:23:54.515 But the accountability I think 00:23:54.515 --> 00:23:56.308 is a piece that's missed sometimes. 00:23:56.308 --> 00:24:00.604 Senior leadership in a school district is truly accountable 00:24:00.604 --> 00:24:03.315 for everything that happens in a school district, 00:24:03.315 --> 00:24:05.651 especially for security. 00:24:05.651 --> 00:24:09.405 It's up to them to set that risk tolerance 00:24:09.405 --> 00:24:11.907 so we can provide controls and solutions 00:24:11.907 --> 00:24:18.289 that meet those needs, and to model good behavior. 00:24:18.289 --> 00:24:21.041 We've developed an information security 00:24:21.041 --> 00:24:23.085 and data privacy committee 00:24:23.085 --> 00:24:26.338 here in our district that involves senior leadership 00:24:26.338 --> 00:24:30.426 and kind of sets that direction and that scope, 00:24:30.426 --> 00:24:32.511 just as a way to keep them 00:24:32.511 --> 00:24:35.431 really, really, closely involved. 00:24:35.431 --> 00:24:40.144 And I mentioned cybersecurity insurance earlier, 00:24:40.144 --> 00:24:42.563 and really it parallels with the idea 00:24:42.563 --> 00:24:46.066 of just putting some of those basics in place. 00:24:46.066 --> 00:24:48.193 You know, the multifactor authentication, 00:24:48.193 --> 00:24:51.739 the backups, the different plans, 00:24:51.739 --> 00:24:56.535 the incident response plans, the disaster recovery plans. 00:24:56.535 --> 00:25:00.247 I think one thing that's missed sometimes is assets, 00:25:00.247 --> 00:25:01.540 knowing what you have. 00:25:01.540 --> 00:25:03.667 You know, the idea of you can't protect 00:25:03.667 --> 00:25:07.421 what you don't know you have. 00:25:07.421 --> 00:25:11.592 And it's really all about risk, and assessing risk, 00:25:11.592 --> 00:25:14.595 whether you start with the free tools, 00:25:14.595 --> 00:25:18.474 like I know CoSN partnered with Security Studio 00:25:18.474 --> 00:25:22.436 to form a very, very simple risk assessment 00:25:22.436 --> 00:25:25.773 and there's many other products out there, 00:25:25.773 --> 00:25:28.859 only when a district really understands what it has 00:25:28.859 --> 00:25:30.486 and what the risk is 00:25:30.486 --> 00:25:36.492 and what their tolerance is for that risk. 00:25:36.492 --> 00:25:38.744 I know this isn't really about staffing 00:25:38.744 --> 00:25:44.333 but I wanted to mention that in school districts 00:25:44.333 --> 00:25:46.418 unless you're a super, super large district 00:25:46.418 --> 00:25:51.590 you probably don't have a CISO, a security team of any kind. 00:25:51.590 --> 00:25:56.220 It's at best shared between a few members of the staff. 00:25:56.220 --> 00:25:58.388 Something that we've done a number of years ago 00:25:58.388 --> 00:26:02.476 and I think is becoming more the norm now 00:26:02.476 --> 00:26:06.104 is to go with a virtual chief information security officer 00:26:06.104 --> 00:26:07.397 or a VC. 00:26:07.397 --> 00:26:10.192 So this is a security professional 00:26:10.192 --> 00:26:13.237 that a school district can make an arrangement with 00:26:13.237 --> 00:26:14.613 and it kind of becomes 00:26:14.613 --> 00:26:17.616 an adjunct virtual part of your team. 00:26:17.616 --> 00:26:21.787 And I can tell you in our case it's just really helped open 00:26:21.787 --> 00:26:26.416 our eyes to developing a lot of these strategies 00:26:26.416 --> 00:26:29.920 that I'm discussing now. 00:26:29.920 --> 00:26:33.090 And finally, just in the non-IT part of it, 00:26:33.090 --> 00:26:37.094 as was mentioned by many others, 00:26:37.094 --> 00:26:42.099 is the idea of just making sure that that awareness is built. 00:26:42.099 --> 00:26:44.726 That we're educating our students, our staff, 00:26:44.726 --> 00:26:48.188 and our parents about really what does it mean 00:26:48.188 --> 00:26:52.442 to be a human being in today's digital world? 00:26:52.442 --> 00:26:56.238 And how do you need to protect yourself 00:26:56.238 --> 00:26:57.823 from a privacy standpoint? 00:26:57.823 --> 00:26:59.283 That your, like was mentioned, 00:26:59.283 --> 00:27:01.451 the data especially of students 00:27:01.451 --> 00:27:05.580 could be many, many years before the terrible impact 00:27:05.580 --> 00:27:09.710 of a data breach could really be felt. 00:27:09.710 --> 00:27:14.047 So, thank you for indulging me in my rant. 00:27:14.047 --> 00:27:16.425 >>Hey, Rod, something that you said around the staffing part, 00:27:16.425 --> 00:27:18.093 and I know that's not really part of our question, 00:27:18.093 --> 00:27:19.469 but I do think it's really important 00:27:19.469 --> 00:27:22.389 when we're talking about equity in education. 00:27:22.389 --> 00:27:24.308 Of course that is a huge priority of ours 00:27:24.308 --> 00:27:25.809 here at the Department of Education. 00:27:25.809 --> 00:27:29.521 But something just coming from my previous state of Nebraska 00:27:29.521 --> 00:27:32.232 where I served as the State Ed Tech Director, 00:27:32.232 --> 00:27:35.444 when we think of equity so often we think of large urban systems 00:27:35.444 --> 00:27:36.945 or even suburban system for that matter, 00:27:36.945 --> 00:27:39.614 but we also have to consider rural in all of this. 00:27:39.614 --> 00:27:42.451 So I'm really excited that you mentioned 00:27:42.451 --> 00:27:45.746 the virtual coach or CISO role. 00:27:45.746 --> 00:27:47.581 Because that is something that, 00:27:47.581 --> 00:27:51.084 I worked with so many folks that were teachers by day, 00:27:51.084 --> 00:27:52.586 coaches in the afternoon, 00:27:52.586 --> 00:27:54.755 and then were the ed tech specialists on the side. 00:27:54.755 --> 00:27:58.759 Who then had to like worry about approving the ed tech platform 00:27:58.759 --> 00:28:01.094 and tools as well as making sure that they were interoperable 00:28:01.094 --> 00:28:03.764 and had, you know, all the aspects of it 00:28:03.764 --> 00:28:05.015 and complied with HIRPA 00:28:05.015 --> 00:28:07.976 as well as the cybersecurity kind of protections. 00:28:07.976 --> 00:28:10.395 So, what a great idea 00:28:10.395 --> 00:28:12.606 and I hope that we can lift up some more stories of that. 00:28:12.606 --> 00:28:13.815 >>Thank you. 00:28:13.815 --> 00:28:16.401 Yeah, my tagline, oh, back in the '70s 00:28:16.401 --> 00:28:17.694 I was a computer expert. 00:28:17.694 --> 00:28:19.154 I mean, there was mainframes, 00:28:19.154 --> 00:28:21.281 if you knew how to work a mainframe you, 00:28:21.281 --> 00:28:23.033 that's all there was. 00:28:23.033 --> 00:28:25.202 My tagline for many years now has been, 00:28:25.202 --> 00:28:27.537 I know a little bit about a lot of things 00:28:27.537 --> 00:28:29.581 but not a lot about anything. 00:28:29.581 --> 00:28:32.084 And the degree of specialization, 00:28:32.084 --> 00:28:35.003 especially in cybersecurity that's required, 00:28:35.003 --> 00:28:37.339 you really have to rely 00:28:37.339 --> 00:28:41.176 if you're not a district and institution of size 00:28:41.176 --> 00:28:44.596 where you can have many, many experts on staff, 00:28:44.596 --> 00:28:47.265 you really need to be creative and augment your staff 00:28:47.265 --> 00:28:50.227 to get that expertise on hand. 00:28:50.227 --> 00:28:52.103 >>And maybe not at the risk, sorry Marlon. 00:28:52.103 --> 00:28:53.313 >>Not a problem. 00:28:53.313 --> 00:28:55.148 >>Of continuing this conversation, 00:28:55.148 --> 00:28:58.318 because I think this is a terrific direction we're going. 00:28:58.318 --> 00:29:00.737 I love the idea of sort of virtual CISOs 00:29:00.737 --> 00:29:03.365 and I think broadly the notion of thinking 00:29:03.365 --> 00:29:07.285 about collective work here. Right? 00:29:07.285 --> 00:29:11.164 You know, if we need to establish it 00:29:11.164 --> 00:29:15.293 that every school district needs a highly qualified CISO, 00:29:15.293 --> 00:29:19.506 and to put in place best in breed cybersecurity solutions, 00:29:19.506 --> 00:29:21.716 across this wide whole country. 00:29:21.716 --> 00:29:25.095 I think that's going to be a challenge for a lot of folks. 00:29:25.095 --> 00:29:26.721 It's going to be a resource challenge, 00:29:26.721 --> 00:29:28.640 it's going to be a personnel challenge, 00:29:28.640 --> 00:29:29.975 it's going to, you know. 00:29:29.975 --> 00:29:31.977 It's really hard to envision this. 00:29:31.977 --> 00:29:33.937 But the thing is we're not competing on 00:29:33.937 --> 00:29:36.565 who can be the best at providing cybersecurity. 00:29:36.565 --> 00:29:40.944 And frankly, we're also sharing the same types of threats 00:29:40.944 --> 00:29:42.654 and we're running the same types of 00:29:42.654 --> 00:29:44.948 IT systems, software and technology. 00:29:44.948 --> 00:29:47.742 And we're using different vendors. 00:29:47.742 --> 00:29:49.744 But everyone has a student information system. 00:29:49.744 --> 00:29:51.121 Everybody's working with students 00:29:51.121 --> 00:29:53.081 who probably have devices. 00:29:53.081 --> 00:29:55.417 There's a set of instructional apps we're all using. 00:29:55.417 --> 00:29:58.211 We all have to go out to bid for stuff 00:29:58.211 --> 00:29:59.546 and pay our contractors 00:29:59.546 --> 00:30:01.590 and we have employees and food service 00:30:01.590 --> 00:30:03.550 and transportation. Right? 00:30:03.550 --> 00:30:05.760 And so we're running the same similar sorts of things. 00:30:05.760 --> 00:30:08.888 So if we can work together collectively, right, 00:30:08.888 --> 00:30:10.807 I think there's a power in doing that. 00:30:10.807 --> 00:30:12.892 You know, we shouldn't have to be reinventing the wheel, 00:30:12.892 --> 00:30:14.728 each of us together. 00:30:14.728 --> 00:30:17.897 And those of us who are leaning into this, and I will say 00:30:17.897 --> 00:30:20.650 that it is a subset of folks who work in K-12 IT 00:30:20.650 --> 00:30:23.528 who are leaning into the security side. 00:30:23.528 --> 00:30:27.324 Certainly Marlon, Rod, David are all terrific examples of this. 00:30:29.451 --> 00:30:30.618 I think if you just reach out 00:30:30.618 --> 00:30:33.288 they are more than willing to share their expertise, 00:30:33.288 --> 00:30:35.915 and let you know what worked for them, 00:30:35.915 --> 00:30:38.001 and to give you tips and pointers 00:30:38.001 --> 00:30:41.379 and just to point you to resources 00:30:41.379 --> 00:30:45.342 that may be available nationally or in your state or regionally, 00:30:45.342 --> 00:30:46.676 whether it's through a formal group 00:30:46.676 --> 00:30:50.638 or just an informal effort that you've got going on. 00:30:50.638 --> 00:30:53.308 But don't take this on by yourself 00:30:53.308 --> 00:30:57.812 because you're not alone in facing this challenge. 00:30:57.812 --> 00:31:00.106 >>I think that's a great segue, Doug. 00:31:00.106 --> 00:31:04.986 Because I was going to say, when I came from LA USD, 00:31:04.986 --> 00:31:07.489 and just being in such a large city 00:31:07.489 --> 00:31:09.908 at the second largest school district, 00:31:09.908 --> 00:31:11.409 your perspective is one thing. 00:31:11.409 --> 00:31:15.747 And then I come even to Dallas and Fort Worth, Texas, 00:31:15.747 --> 00:31:17.415 and I see a bison. Right? 00:31:17.415 --> 00:31:19.793 And I'm like, wow. Right? 00:31:19.793 --> 00:31:24.089 I barely see a dog in L.A. let alone a bison. 00:31:24.089 --> 00:31:27.175 Right? And so, your respect for rural, 00:31:27.175 --> 00:31:30.512 your respect for the various communities, 00:31:30.512 --> 00:31:34.682 and the various disparities, right, becomes real. 00:31:34.682 --> 00:31:39.771 And so, to your point, Doug, I think as we progress, 00:31:39.771 --> 00:31:43.525 I think organizations need to move out of the siloes 00:31:43.525 --> 00:31:46.945 and move into more collaborative natures, right? 00:31:46.945 --> 00:31:50.448 Maybe we share data centers. 00:31:50.448 --> 00:31:53.284 As things move to the edge and move to the cloud, 00:31:53.284 --> 00:31:55.495 and less things are on PRIM, 00:31:55.495 --> 00:31:58.289 the need for having your own data centers, 00:31:58.289 --> 00:32:01.793 and I know CTOs, I know you're angry if you're on this call, 00:32:01.793 --> 00:32:04.129 because we love our own data centers, 00:32:04.129 --> 00:32:07.173 we love rack'em stack'em, right? 00:32:07.173 --> 00:32:13.721 But partnerships and consortiums are important. 00:32:13.721 --> 00:32:16.641 And I think we can all follow through that and build on that. 00:32:16.641 --> 00:32:18.476 So that was a good segue, I appreciate it, Doug. 00:32:18.476 --> 00:32:20.770 And it's a good way to segue to the next question. 00:32:20.770 --> 00:32:25.441 What techniques, what actions can organizations use, 00:32:25.441 --> 00:32:28.528 whether it's in education or a state and local government, 00:32:28.528 --> 00:32:32.156 to promote resiliency and positive online habits? 00:32:32.156 --> 00:32:34.200 And I really want to focus this question 00:32:34.200 --> 00:32:37.120 on the online habits portion of their users, 00:32:37.120 --> 00:32:38.872 whether it be students or employees. 00:32:45.420 --> 00:32:47.463 I'm going to start with you, Kristina. 00:32:49.924 --> 00:32:53.428 >>Oh, sure, start with me. 00:32:53.428 --> 00:32:56.598 Okay, can you repeat the question for me again? 00:32:56.598 --> 00:32:58.099 I'm just, I'm thinking about it. 00:32:58.099 --> 00:33:01.477 >>So, what techniques or actions can organizations, 00:33:01.477 --> 00:33:04.939 education or a state use to promote resiliency 00:33:04.939 --> 00:33:07.984 and positive online habits? 00:33:07.984 --> 00:33:09.611 >>I think it's lifting up, one, 00:33:09.611 --> 00:33:13.239 promising practices that we see in schools. 00:33:13.239 --> 00:33:15.617 And I think it even starts with kind of the teaching 00:33:15.617 --> 00:33:17.118 and learning side of things. 00:33:17.118 --> 00:33:19.787 So as I have gotten a better understanding 00:33:19.787 --> 00:33:21.456 of what we do here at the agency 00:33:21.456 --> 00:33:24.125 as far as supporting K-12 cybersecurity, 00:33:24.125 --> 00:33:25.627 and even higher ed for that matter, 00:33:25.627 --> 00:33:28.171 I've been able to parse out that we fall into two categories. 00:33:28.171 --> 00:33:30.173 One is the actual infrastructure side of things 00:33:30.173 --> 00:33:33.259 where we're providing proactive and reactive services 00:33:33.259 --> 00:33:36.054 through a whole host of offices. 00:33:36.054 --> 00:33:37.722 And then there's the teaching and learning side, 00:33:37.722 --> 00:33:39.390 where we have folks in our career 00:33:39.390 --> 00:33:41.601 and technical and adult education, 00:33:41.601 --> 00:33:43.519 as well as some of our STEM offices 00:33:43.519 --> 00:33:45.438 or our folks that are working on STEM, 00:33:45.438 --> 00:33:46.856 that are working on the curriculum 00:33:46.856 --> 00:33:49.317 or the teaching and learning side of all of this. 00:33:49.317 --> 00:33:51.778 And so I think this kind of falls into that category 00:33:51.778 --> 00:33:53.946 of the teaching and learning because we have to start having 00:33:53.946 --> 00:33:56.491 these conversations with learners now. 00:33:56.491 --> 00:33:59.285 And I'm a former early childhood and elementary teacher. 00:33:59.285 --> 00:34:01.162 I had these conversations with kindergartners. 00:34:01.162 --> 00:34:03.623 Like this is not something that needs to start later on 00:34:03.623 --> 00:34:06.292 in secondary or even post-secondary for that matter. 00:34:06.292 --> 00:34:08.086 Because as you mentioned, the digital footprint, 00:34:08.086 --> 00:34:10.421 whatever we want to call it, the digital tattoo. 00:34:10.421 --> 00:34:12.590 I said it was permanent, so it's sticking around. 00:34:12.590 --> 00:34:14.884 Kindergartners love that of course. 00:34:14.884 --> 00:34:18.304 But it's just, it's having those conversations that start now, 00:34:18.304 --> 00:34:21.933 that afford us kind of those positive online habits. 00:34:21.933 --> 00:34:24.102 It's also moving away from the idea 00:34:24.102 --> 00:34:27.814 of like digital citizenship being the, don't do this, 00:34:27.814 --> 00:34:30.775 but it's reframing that to be asset-based language 00:34:30.775 --> 00:34:32.652 and saying, here are the things that you can do 00:34:32.652 --> 00:34:36.280 to be a healthy productive contributive member 00:34:36.280 --> 00:34:39.951 of our digital environments and digital ecosystems. 00:34:39.951 --> 00:34:42.412 And so it's again starting with the learners, 00:34:42.412 --> 00:34:45.581 again going out to our families and communities as well, 00:34:45.581 --> 00:34:47.458 and then pulling in our educational leaders. 00:34:47.458 --> 00:34:48.751 Like, superintendents need to know 00:34:48.751 --> 00:34:51.254 about this information as well. 00:34:51.254 --> 00:34:55.091 I know that when Assistant Secretary Roberto Rodriguez 00:34:55.091 --> 00:34:58.636 provided the opening comments this morning 00:34:58.636 --> 00:35:01.597 he highlighted some of the work that Doug has done. 00:35:01.597 --> 00:35:04.100 And it said, 22 percent of administrators, 00:35:04.100 --> 00:35:06.018 their current level is high. 00:35:06.018 --> 00:35:08.938 Saying that cybersecurity is like high interest, 00:35:08.938 --> 00:35:09.897 twenty two percent. 00:35:09.897 --> 00:35:11.816 Like, why is that not higher yet? 00:35:11.816 --> 00:35:14.318 And so, I know Doug has also helped me understand 00:35:14.318 --> 00:35:16.487 that cybersecurity is, 00:35:16.487 --> 00:35:19.699 should be considered the same level as physical threats. 00:35:19.699 --> 00:35:22.577 And so we have to take all of that into consideration. 00:35:22.577 --> 00:35:25.121 So our leaders have to come into these conversations as well. 00:35:25.121 --> 00:35:29.083 So, we've got the whole breadth of learners in the classrooms, 00:35:29.083 --> 00:35:31.460 starting those conversations with the teachers, 00:35:31.460 --> 00:35:35.047 going up to our leaders, making sure that they understand 00:35:35.047 --> 00:35:37.216 the infrastructure and the importance of this, 00:35:37.216 --> 00:35:38.634 but then we have to go to our state leaders 00:35:38.634 --> 00:35:40.136 who are helping us with the funding 00:35:40.136 --> 00:35:42.096 and the additional technical assistance. 00:35:42.096 --> 00:35:43.931 And then you've got folks like Sean and myself 00:35:43.931 --> 00:35:46.767 at the federal level that are like, hi, hello, hello. 00:35:46.767 --> 00:35:49.645 We will keep amplifying stories 00:35:49.645 --> 00:35:52.231 and telling as many things as we can, 00:35:52.231 --> 00:35:54.442 but we need everyone's support in this. 00:35:55.985 --> 00:35:57.695 >>I would almost add as well, 00:35:57.695 --> 00:35:59.780 just as a little bookmark to what you said, 00:35:59.780 --> 00:36:02.617 excellent points by the way, 00:36:02.617 --> 00:36:08.039 that embedding this in character development 00:36:08.039 --> 00:36:10.291 is so important. Right? 00:36:10.291 --> 00:36:12.501 Letting them realize that character development 00:36:12.501 --> 00:36:14.462 doesn't happen in a vacuum. 00:36:14.462 --> 00:36:16.297 It doesn't happen in just a classroom 00:36:16.297 --> 00:36:18.633 or as you're walking down the street. 00:36:18.633 --> 00:36:23.387 You're in an online world now and it applies there as well. 00:36:23.387 --> 00:36:25.097 So I really like your points, 00:36:25.097 --> 00:36:28.017 especially that hence why the emphasis now 00:36:28.017 --> 00:36:32.772 is not an acceptable use, versus non-acceptable, 00:36:32.772 --> 00:36:34.106 the don'ts, the do's. 00:36:34.106 --> 00:36:35.733 It's more responsible use, 00:36:35.733 --> 00:36:38.235 where you now focus on the student and hey, 00:36:38.235 --> 00:36:42.448 let me empower you to be able to be a good digital citizen. 00:36:42.448 --> 00:36:46.369 And so that you'd be able to be aware of not only security, 00:36:46.369 --> 00:36:50.790 but also just a good online, developing a good, 00:36:50.790 --> 00:36:53.417 or being a part of a good online community, 00:36:53.417 --> 00:36:54.627 and what does that mean. 00:36:55.378 --> 00:36:57.296 >>If I can I would jump in 00:36:57.296 --> 00:37:01.133 and just agreeing both with Kristina and David here 00:37:01.133 --> 00:37:06.138 and maybe even offering an additional twist to that. 00:37:06.138 --> 00:37:10.685 And that is, this is a really challenging actually space 00:37:10.685 --> 00:37:14.313 to be educating people in because it continues to evolve. 00:37:14.313 --> 00:37:17.274 Sort of like Rod spoke about his early days in IT 00:37:17.274 --> 00:37:21.278 where everything was in his control. 00:37:21.278 --> 00:37:23.406 And now like as Marlon is suggesting, 00:37:23.406 --> 00:37:25.491 everything is kind of moving to the cloud 00:37:25.491 --> 00:37:27.159 and we have lots of partners and vendors. 00:37:27.159 --> 00:37:28.411 I mean it wouldn't be unusual 00:37:28.411 --> 00:37:30.121 for a regular typical school district 00:37:30.121 --> 00:37:33.666 to have hundreds of partners that they're working with that 00:37:33.666 --> 00:37:35.126 are involved in technology. 00:37:35.126 --> 00:37:36.961 And you may not, you may be thinking, 00:37:36.961 --> 00:37:38.379 well, I don't know about that. 00:37:38.379 --> 00:37:41.632 Because they're not all, like, 00:37:41.632 --> 00:37:43.217 all of your vendors and suppliers 00:37:43.217 --> 00:37:46.178 whether or not they are coming in through the IT department, 00:37:46.178 --> 00:37:48.889 are now technology vendors and running their systems, 00:37:48.889 --> 00:37:51.058 you know, relying on IT. 00:37:51.058 --> 00:37:52.935 So, that's complicated. 00:37:52.935 --> 00:37:56.272 But it's also the case that the blurring 00:37:56.272 --> 00:38:01.777 between what kids in particular but sometimes adults, 00:38:01.777 --> 00:38:04.613 particularly if you're talking about like school board meetings 00:38:04.613 --> 00:38:10.911 and other public discussions about how schools handle things. 00:38:10.911 --> 00:38:13.122 The blurring of what's happening outside of school, 00:38:13.122 --> 00:38:15.624 off school networks, on social media, 00:38:15.624 --> 00:38:17.960 and what's happening in school and that impact. Right? 00:38:17.960 --> 00:38:20.880 So we can just look to I guess it was a few weeks ago, 00:38:20.880 --> 00:38:27.219 there was a TikTok challenge that was profoundly, 00:38:27.219 --> 00:38:29.471 had a profound impact on schools. 00:38:29.471 --> 00:38:33.017 It didn't touch school networks whatsoever. 00:38:33.017 --> 00:38:35.436 But it shut down, it literally shut down schools 00:38:35.436 --> 00:38:38.272 over the threat of physical violence. 00:38:38.272 --> 00:38:42.109 So it is a complicated, I wish there were easy answers. 00:38:42.109 --> 00:38:44.445 But the fact of the matter is that kids, 00:38:44.445 --> 00:38:48.115 the youngest kids now are growing up with access 00:38:48.115 --> 00:38:51.952 to these devices, you know, CAPA, whatever. 00:38:51.952 --> 00:38:54.872 They're using it. Just a fact. 00:38:54.872 --> 00:38:57.166 And what they're doing offline in spaces 00:38:57.166 --> 00:38:58.542 that are not controlled by the school, 00:38:58.542 --> 00:39:00.002 are affecting what's happening in school. 00:39:00.002 --> 00:39:03.214 It's a really complicated situation. 00:39:03.214 --> 00:39:05.090 But it does underscore this notion 00:39:05.090 --> 00:39:06.342 that Kristina is talking about, 00:39:06.342 --> 00:39:10.512 we can't start too young and we need to think broadly. 00:39:10.512 --> 00:39:12.890 I mean, parents need to know. 00:39:12.890 --> 00:39:15.309 Even frankly leadership in K-12 needs to know. 00:39:15.309 --> 00:39:18.228 Because this is not an issue, they're not IT experts. 00:39:18.228 --> 00:39:21.607 They don't, they shouldn't have to be IT experts. 00:39:21.607 --> 00:39:24.193 But we shouldn't presume that the adults understand 00:39:24.193 --> 00:39:26.278 this really any better than the kids do too 00:39:26.278 --> 00:39:29.073 because honestly I'm struggling to keep up 00:39:29.073 --> 00:39:30.950 with every new app and tool and service 00:39:30.950 --> 00:39:32.284 and the way they're using it, 00:39:32.284 --> 00:39:35.162 much less everything that's happening on the dark web. 00:39:35.162 --> 00:39:40.876 Which is a place that I only go with kid gloves on 00:39:40.876 --> 00:39:42.294 and very occasionally. Right? 00:39:42.294 --> 00:39:46.590 So, and that puts me in a super small percent of folks. 00:39:49.802 --> 00:39:53.222 >>Great. That's great, right? Because there's no assumptions. 00:39:53.222 --> 00:39:54.974 And I'll use this analogy. 00:39:54.974 --> 00:39:56.433 If someone told you, 00:39:56.433 --> 00:39:59.395 oh, I'm going to make a baloney sandwich. 00:39:59.395 --> 00:40:01.271 You would think it had two pieces of bread 00:40:01.271 --> 00:40:03.273 and a piece of baloney. 00:40:03.273 --> 00:40:07.695 Well and now it may be a baloney and two pieces of lettuce. 00:40:07.695 --> 00:40:10.823 Or two pieces of lettuce and a plant-based baloney. 00:40:10.823 --> 00:40:15.953 Right? There's no simple way to even make a baloney sandwich. 00:40:15.953 --> 00:40:20.332 And now cybersecurity is even more complex than that. Right? 00:40:20.332 --> 00:40:22.960 So, moving on to the next question, 00:40:22.960 --> 00:40:26.296 I would say, how are everything that we're talking about, 00:40:26.296 --> 00:40:29.675 these pointers, and Doug you talked about violence 00:40:29.675 --> 00:40:32.302 and the TikTok challenge. 00:40:32.302 --> 00:40:35.889 How can organizations, parents protect 00:40:35.889 --> 00:40:38.308 or put the practices in place 00:40:38.308 --> 00:40:43.814 to protect their students against cyberbullying? 00:40:43.814 --> 00:40:45.899 >> You know, Marlon, I don't know 00:40:45.899 --> 00:40:48.610 if I have much to add based on what was already said. 00:40:48.610 --> 00:40:53.282 But those people that know me would probably call me 00:40:53.282 --> 00:40:55.742 a broken record about this particular issue, 00:40:55.742 --> 00:41:02.332 is that, you know, protecting the cyber component 00:41:02.332 --> 00:41:05.210 of what we're doing is so much more in my estimation 00:41:05.210 --> 00:41:10.507 about human awareness, human behavior. 00:41:10.507 --> 00:41:16.221 Assuming we have the baseline technical protections in place. 00:41:16.221 --> 00:41:20.809 The idea that as humans interacting with technology 00:41:20.809 --> 00:41:25.314 and data we're all security tools 00:41:25.314 --> 00:41:30.611 really that are there to protect ourselves and our data. 00:41:30.611 --> 00:41:33.822 So I think it's important that our users, 00:41:33.822 --> 00:41:36.116 that our staff and student and parents, 00:41:36.116 --> 00:41:41.538 that they understand their role in that. 00:41:41.538 --> 00:41:44.791 One of the things that I try to do as much as I can 00:41:44.791 --> 00:41:49.379 is to tie what we're doing here to real life. 00:41:49.379 --> 00:41:53.342 So that when we rolled out multifactor authentication, 00:41:53.342 --> 00:41:56.220 and staff, oh, you know. 00:41:56.220 --> 00:41:59.139 But then by pointing out to them, 00:41:59.139 --> 00:42:03.060 you know, your bank account, your Target account, your - 00:42:03.060 --> 00:42:05.145 all those breaches that happened 00:42:05.145 --> 00:42:07.731 to probably many of them in real life, 00:42:07.731 --> 00:42:09.566 to tie the importance of that 00:42:09.566 --> 00:42:12.945 to something that's personal to them. 00:42:12.945 --> 00:42:17.115 I think that kind of helps smooth the transition 00:42:17.115 --> 00:42:18.992 a little bit to some of those 00:42:18.992 --> 00:42:24.414 maybe less popular protections that we need to put in place. 00:42:24.414 --> 00:42:29.253 To just give them that feeling that they do have some control, 00:42:29.253 --> 00:42:30.963 and that their behavior 00:42:30.963 --> 00:42:35.884 and what they do with that is really important. 00:42:35.884 --> 00:42:39.096 And in the classroom with students, 00:42:39.096 --> 00:42:44.101 where more and more teachers are looking to, 00:42:44.101 --> 00:42:47.562 not that they're teaching a lesson about data privacy 00:42:47.562 --> 00:42:49.231 or about security, 00:42:49.231 --> 00:42:53.110 but through a lot of the state requirements 00:42:53.110 --> 00:42:55.737 that are in place now for vetting applications 00:42:55.737 --> 00:42:57.823 and data privacy agreements. 00:42:57.823 --> 00:43:01.326 There's just a tremendously elevated awareness 00:43:01.326 --> 00:43:04.746 and legal necessity to do certain things. 00:43:04.746 --> 00:43:07.749 So that's starting to permeate some of those conversations 00:43:07.749 --> 00:43:11.044 even in the classroom so that as things are being done 00:43:11.044 --> 00:43:14.548 with students that they're aware of it as well. 00:43:14.548 --> 00:43:16.508 I don't know if that answered your particular question, 00:43:16.508 --> 00:43:17.801 Marlon, 00:43:17.801 --> 00:43:19.803 but there were some points that I wanted to get out 00:43:19.803 --> 00:43:23.557 that were maybe a mishmash of some other ones. 00:43:23.557 --> 00:43:26.643 >>I think there's no wrong answers, Rod. 00:43:26.643 --> 00:43:30.564 No wrong answers. This is all good information. 00:43:30.564 --> 00:43:33.984 Are there any ways or best practices 00:43:33.984 --> 00:43:36.278 that you feel parents or caregivers 00:43:36.278 --> 00:43:40.115 should look for in helping protect their students 00:43:40.115 --> 00:43:41.199 from cyberbullying? 00:43:47.581 --> 00:43:48.582 Maybe Sean? 00:43:49.750 --> 00:43:50.625 >>Sorry about that. 00:43:50.625 --> 00:43:53.503 So, everyone has brought in 00:43:53.503 --> 00:43:56.590 a very great perspective here on this. 00:43:56.590 --> 00:43:59.926 I think there's this team sport mentality that has been echoed, 00:43:59.926 --> 00:44:01.261 without calling it the team sport. 00:44:01.261 --> 00:44:03.096 And that sounds a little cliché, 00:44:03.096 --> 00:44:06.141 but it takes a community in cyber as we know. 00:44:06.141 --> 00:44:08.143 And that's state leaders, superintendents, 00:44:08.143 --> 00:44:09.394 principals, teachers, 00:44:09.394 --> 00:44:12.314 all the way to student and parent. 00:44:12.314 --> 00:44:13.690 I think we've touched on it, 00:44:13.690 --> 00:44:16.109 and not to kind of go too far into it, 00:44:16.109 --> 00:44:18.236 but if you have a phone you have apps, 00:44:18.236 --> 00:44:19.738 if you have apps you have access, 00:44:19.738 --> 00:44:23.074 and there's data galore on, your, you know. 00:44:23.074 --> 00:44:25.785 However old the individual is, 00:44:25.785 --> 00:44:28.872 there's just a lot going on in one device now. 00:44:28.872 --> 00:44:31.791 Social media is something that is prevalent, 00:44:31.791 --> 00:44:36.338 as Doug alluded to and the others, Rod as well. 00:44:36.338 --> 00:44:39.090 There is this interesting development 00:44:39.090 --> 00:44:43.595 too that Kristina brought up, and I think going to the ethics. 00:44:43.595 --> 00:44:46.723 There's an ethics component of this as a consumer, 00:44:46.723 --> 00:44:51.144 as a student, and having care, but also presenting it 00:44:51.144 --> 00:44:56.149 in a way that is relatable through K through 12, 00:44:56.149 --> 00:44:59.319 through a student lens, is a real challenge. 00:44:59.319 --> 00:45:01.863 Still, you get a group of us together 00:45:01.863 --> 00:45:04.324 that have been doing cyber and IT for a decade 00:45:04.324 --> 00:45:06.034 and eyes can glaze over pretty quick. 00:45:06.034 --> 00:45:09.120 So, how do you make it relevant to the student population, 00:45:09.120 --> 00:45:11.414 toknow the do's and don'ts? 00:45:11.414 --> 00:45:13.875 There's a ton of scary things out there, 00:45:13.875 --> 00:45:16.795 and it's not to create fear 00:45:16.795 --> 00:45:19.547 that you can't consume and use apps safely, 00:45:19.547 --> 00:45:21.549 but knowing where those parameters stretch 00:45:21.549 --> 00:45:24.469 in your day to day use I think is really important. 00:45:24.469 --> 00:45:26.304 And I agree with everyone's sentiments here. 00:45:26.304 --> 00:45:27.931 Like, we start at kindergarten 00:45:27.931 --> 00:45:31.434 and find a way to keep those building blocks going forward. 00:45:31.434 --> 00:45:34.562 K through 12 is a better starting point. 00:45:34.562 --> 00:45:36.314 And there might be some light touch issues 00:45:36.314 --> 00:45:39.317 that we can get starting there, 00:45:39.317 --> 00:45:41.319 and then keep it as, you know, again, 00:45:41.319 --> 00:45:44.572 a daily kind of consciousness around what it is 00:45:44.572 --> 00:45:50.453 to be using these devices and these tools long term. 00:45:50.453 --> 00:45:52.914 As far as the cyberbullying goes, 00:45:52.914 --> 00:45:56.042 I know that there are a lot of resources out there. 00:45:56.042 --> 00:45:57.877 I know that there's been a lot 00:45:57.877 --> 00:46:00.213 even from the mental health community as well, 00:46:00.213 --> 00:46:03.967 who have put in research hours out there 00:46:03.967 --> 00:46:08.471 for students as well as parents and educators. 00:46:08.471 --> 00:46:11.599 And I think for me, 00:46:11.599 --> 00:46:15.145 whether students are involved in gaming 00:46:15.145 --> 00:46:18.523 or using apps for gaming, as well as, 00:46:18.523 --> 00:46:21.484 and not the educational gaming, just to be clear, 00:46:21.484 --> 00:46:24.237 just for recreational, the gaming thing. 00:46:24.237 --> 00:46:26.156 I think there is a data consumption 00:46:26.156 --> 00:46:30.285 or even a screen time discussion that's been going on. 00:46:30.285 --> 00:46:32.787 If you're constantly staring at your laptop 00:46:32.787 --> 00:46:34.164 for a couple hours in a day, 00:46:34.164 --> 00:46:37.083 as we all are, especially in remote times, 00:46:37.083 --> 00:46:38.585 and then you're going into a space 00:46:38.585 --> 00:46:40.170 where you always have a phone nearby 00:46:40.170 --> 00:46:41.713 and your children have a phone nearby, 00:46:41.713 --> 00:46:43.923 and we're checking our email, 00:46:43.923 --> 00:46:46.009 we're checking our social media accounts. 00:46:46.009 --> 00:46:48.595 I think there's almost this health and wellness 00:46:48.595 --> 00:46:49.929 kind of mindset and mentality 00:46:49.929 --> 00:46:52.640 that some of those in the mental health 00:46:52.640 --> 00:46:56.478 and behavioral science aspect of things bring to light. 00:46:56.478 --> 00:46:59.939 There's new digital apps even that have well-being apps 00:46:59.939 --> 00:47:03.485 that can help kind of monitor how much usage is being done 00:47:03.485 --> 00:47:09.240 by you as a parent and/or you as your student or your children. 00:47:09.240 --> 00:47:13.286 And I think that's a good check on again, 00:47:13.286 --> 00:47:17.040 talking about ethics might be a stretch, 00:47:17.040 --> 00:47:22.420 but how you are approaching your day in life with technology. 00:47:22.420 --> 00:47:25.632 And it lends itself too to having, 00:47:25.632 --> 00:47:27.509 getting into those uncomfortable spots 00:47:27.509 --> 00:47:30.804 where you have to talk about what are you posting? 00:47:30.804 --> 00:47:33.890 What does that mean to have a post out there? 00:47:33.890 --> 00:47:35.642 What kind of pictures you're putting out there 00:47:35.642 --> 00:47:38.978 for the world to see, what privacy settings are. 00:47:38.978 --> 00:47:40.814 I mean you can never be too young 00:47:40.814 --> 00:47:46.986 to have a privacy discussion and what that means long term. 00:47:46.986 --> 00:47:48.571 And all of those kind of dovetail 00:47:48.571 --> 00:47:51.824 into future iterations of curriculum, 00:47:51.824 --> 00:47:54.661 future iterations of educational approach. 00:47:54.661 --> 00:47:57.997 And let's not be absent of the community impact 00:47:57.997 --> 00:47:59.666 and the community aspect of that. 00:47:59.666 --> 00:48:03.253 Again, state leaders down to the superintendents, 00:48:03.253 --> 00:48:05.505 down to the teachers, down to the parents, 00:48:05.505 --> 00:48:06.798 can all be community minded 00:48:06.798 --> 00:48:09.342 and are for a lot of different issues. 00:48:09.342 --> 00:48:12.679 The IT and the cyber community and the infosec community 00:48:12.679 --> 00:48:14.347 are in every state. 00:48:14.347 --> 00:48:15.515 There's associations, 00:48:15.515 --> 00:48:17.976 there's organizations that are volunteering. 00:48:17.976 --> 00:48:20.270 There's B sides. There's other things like that. 00:48:20.270 --> 00:48:21.980 Reach out to your community leaders. 00:48:21.980 --> 00:48:23.481 I mean, you can go to Google and say, 00:48:23.481 --> 00:48:26.401 who are the community leaders in cyber and IT, 00:48:26.401 --> 00:48:28.903 find volunteer ways to bring those individuals 00:48:28.903 --> 00:48:30.738 and those experts into your community. 00:48:30.738 --> 00:48:32.323 And have those discussions. 00:48:32.323 --> 00:48:33.866 Get uncomfortable with some of the topics too, 00:48:33.866 --> 00:48:35.285 because there are some uncomfortable ones 00:48:35.285 --> 00:48:37.954 that students need to hear about just as much as parents do. 00:48:37.954 --> 00:48:40.039 So that sounds more like a rant, 00:48:40.039 --> 00:48:41.374 and I know I don't want to take up 00:48:41.374 --> 00:48:43.751 all the mic time here towards the end. 00:48:43.751 --> 00:48:47.213 But I'm throwing that out there for the group as well. 00:48:47.213 --> 00:48:50.508 >>Sean, and just one point, 00:48:50.508 --> 00:48:51.968 and Doug probably remembers this, 00:48:51.968 --> 00:48:56.014 Jared Fokens had a group not too long ago, right? 00:48:56.014 --> 00:48:59.475 It was a Bring Your Hacker to School program that he had. 00:48:59.475 --> 00:49:04.647 And he, I got the privilege to be co-presenting with him 00:49:04.647 --> 00:49:07.817 to an ESL group of students in Virginia. 00:49:07.817 --> 00:49:11.738 And it was fascinating. They were fascinated about his, 00:49:11.738 --> 00:49:16.451 because he was the hacker, I was just the interpreter, 00:49:16.451 --> 00:49:18.619 but it was just fascinated for them. 00:49:18.619 --> 00:49:21.789 And it made a huge impact for community's sake, 00:49:21.789 --> 00:49:24.334 for what hacking really meant, 00:49:24.334 --> 00:49:27.295 and you know, the stereotypes and so forth. 00:49:27.295 --> 00:49:30.757 So, programs like that, just to back up Sean's point, 00:49:30.757 --> 00:49:32.592 are really, really important. 00:49:32.592 --> 00:49:35.470 >>Yeah, if I can jump in there next, David. 00:49:35.470 --> 00:49:40.641 I think I agree with everything that folks have been saying. 00:49:40.641 --> 00:49:43.311 I think as a parent, back to that parent perspective. 00:49:43.311 --> 00:49:46.397 I mean having that open communication with your child 00:49:46.397 --> 00:49:50.151 is going to be critical to be able to help them through this. 00:49:50.151 --> 00:49:54.030 And hopefully whether a parent is able, 00:49:54.030 --> 00:49:57.158 those relationships exist for a kid at home, 00:49:57.158 --> 00:49:58.826 hopefully there's opportunities at school 00:49:58.826 --> 00:50:00.787 as well for students to be able to come forward 00:50:00.787 --> 00:50:04.999 and to have cyber incidents of concern, 00:50:04.999 --> 00:50:06.584 bullying or other things they see, 00:50:06.584 --> 00:50:08.169 have an adult there that they can talk to 00:50:08.169 --> 00:50:10.588 who will support them. Right? 00:50:10.588 --> 00:50:11.798 Listen to them and support them, 00:50:11.798 --> 00:50:14.592 whether that's their teacher or a counselor. 00:50:14.592 --> 00:50:18.221 I know that counselors are really scarce right now, 00:50:18.221 --> 00:50:20.640 but students need that kind of support 00:50:20.640 --> 00:50:22.391 and they may or may not be able to get 00:50:22.391 --> 00:50:24.477 that at home unfortunately. 00:50:24.477 --> 00:50:26.646 Ideally they can. 00:50:26.646 --> 00:50:29.190 I will say just a couple of things. 00:50:29.190 --> 00:50:32.109 General advice that we give to parents, frankly, 00:50:32.109 --> 00:50:36.489 is that unless you have some compelling reason not to do it, 00:50:36.489 --> 00:50:38.324 to proactively take the step 00:50:38.324 --> 00:50:41.994 to lock your child's credit records down 00:50:41.994 --> 00:50:43.663 until they are an age of majority. 00:50:45.790 --> 00:50:48.626 Some of the dangers that students do face online 00:50:48.626 --> 00:50:52.922 involve identity theft from criminal organizations 00:50:52.922 --> 00:50:55.633 who actually find children's identity information 00:50:55.633 --> 00:50:57.927 more valuable than adults' information. 00:50:57.927 --> 00:51:00.471 That may seem counterintuitive because of course as adults 00:51:00.471 --> 00:51:04.809 we have checking accounts and credit cards and incomes, 00:51:04.809 --> 00:51:07.812 but kids' credit records are unmonitored. 00:51:07.812 --> 00:51:09.146 They're a blank slate. 00:51:09.146 --> 00:51:10.815 And so criminals can abuse them 00:51:10.815 --> 00:51:13.484 for a longer period of time and as a result, 00:51:13.484 --> 00:51:15.069 they're actually considered more valuable 00:51:15.069 --> 00:51:17.154 than adult identity information. 00:51:17.154 --> 00:51:18.447 The other thing that I would note is 00:51:18.447 --> 00:51:19.699 that if you have a student, 00:51:19.699 --> 00:51:24.287 a child who is very tech-savvy, really into technology. 00:51:24.287 --> 00:51:26.289 I think it's important to help them channel 00:51:26.289 --> 00:51:28.291 those energies in a productive way. 00:51:28.291 --> 00:51:31.961 I think both Sean and David have mentioned programs 00:51:31.961 --> 00:51:34.630 to get kids involved, right? 00:51:34.630 --> 00:51:38.384 Because I've seen many cases where kids, 00:51:38.384 --> 00:51:40.636 middle school kids, upper elementary, 00:51:40.636 --> 00:51:42.972 high school kids who are tech-savvy, 00:51:42.972 --> 00:51:46.225 who get bored, who lack that mentorship and direction 00:51:46.225 --> 00:51:50.187 who end up sort of falling on the wrong side of the equation 00:51:50.187 --> 00:51:53.232 and ended up getting themselves into trouble. 00:51:53.232 --> 00:51:55.901 In many cases if they had the opportunity 00:51:55.901 --> 00:51:59.864 to engage in a program like what David was talking about it 00:51:59.864 --> 00:52:02.825 would make all the difference and open their eyes. 00:52:02.825 --> 00:52:04.785 There are a number of programs 00:52:04.785 --> 00:52:07.455 that are available to schools right now, 00:52:07.455 --> 00:52:10.791 and groups that I know would love to partner with schools 00:52:10.791 --> 00:52:14.628 to provide this kind of guidance and mentorship and support. 00:52:14.628 --> 00:52:17.506 I know Cyber Patriots is one such program. 00:52:17.506 --> 00:52:19.216 There are many online competitions 00:52:19.216 --> 00:52:21.469 that are open to students 00:52:21.469 --> 00:52:23.220 and they can be made available to students 00:52:23.220 --> 00:52:26.974 even if your school does not offer 00:52:26.974 --> 00:52:28.976 like even a computer science course. 00:52:28.976 --> 00:52:30.353 And I think a lot of these groups 00:52:30.353 --> 00:52:34.648 would be more than delighted to come in and work with schools 00:52:34.648 --> 00:52:35.983 and work with those students 00:52:35.983 --> 00:52:40.696 who have that intense interest in technology, as many do. 00:52:42.239 --> 00:52:44.492 >>Yeah, that's great, Doug. 00:52:44.492 --> 00:52:49.288 And I would just say to close this out, social awareness. 00:52:49.288 --> 00:52:52.792 When I grew up, I had to actually meet someone, 00:52:52.792 --> 00:52:56.962 meet a young lady at a, or a movie, 00:52:56.962 --> 00:53:00.049 and she would tell me, you're ugly, I don't like you. 00:53:00.049 --> 00:53:03.052 Right? Now you just get online, 00:53:03.052 --> 00:53:08.516 and kids are accepted by just being on Instagram or TikTok 00:53:08.516 --> 00:53:12.812 and they're getting immediate negative feedback instantly. 00:53:12.812 --> 00:53:19.318 You're not pretty, you're not wanted, you're not smart. Right? 00:53:19.318 --> 00:53:22.947 Have that talk with your child, 00:53:22.947 --> 00:53:27.326 and give them, always promote positive energy into them 00:53:27.326 --> 00:53:29.703 because they live in a world right now 00:53:29.703 --> 00:53:32.748 that is full of social negativity. 00:53:32.748 --> 00:53:34.500 So I'll just stop right with that. 00:53:34.500 --> 00:53:38.504 And we only have five minutes so, the last question is, 00:53:38.504 --> 00:53:40.589 we talked about gamification 00:53:40.589 --> 00:53:44.718 and that came up in a couple of responses. 00:53:44.718 --> 00:53:50.307 Is anyone using gamification to help promote cyber training? 00:53:50.307 --> 00:53:51.517 And shout out to Ginny, 00:53:51.517 --> 00:53:54.603 I won't say your last name, shout out to Gin L. 00:53:54.603 --> 00:53:58.440 She said, onboarding, make sure you do cyber security training. 00:53:58.440 --> 00:54:01.652 I read that in the chat, Gin L., we do read the chat. 00:54:01.652 --> 00:54:03.279 I know most people think they type in that 00:54:03.279 --> 00:54:04.488 and we don't look at it. 00:54:04.488 --> 00:54:07.157 I'm looking at it, so shout out to you. 00:54:07.157 --> 00:54:08.367 Anyone? 00:54:08.367 --> 00:54:11.370 >>I'll toss two quick things out, Marlon. 00:54:11.370 --> 00:54:17.835 One thing is that email is one of our biggest attack vectors 00:54:17.835 --> 00:54:23.173 whether it be ransomware or just any of the bad stuff 00:54:23.173 --> 00:54:24.633 you can get through email. 00:54:24.633 --> 00:54:26.719 And like many institutions, 00:54:26.719 --> 00:54:31.473 we have used phishing awareness and training software 00:54:31.473 --> 00:54:35.603 where we actually go through campaigns every other week. 00:54:35.603 --> 00:54:38.939 And it kind of becomes a competition of sorts. 00:54:38.939 --> 00:54:41.025 You know, someone will walk down the hall and say, 00:54:41.025 --> 00:54:43.402 ah, Rod, you tried to get me today. 00:54:43.402 --> 00:54:45.821 Other districts I've heard have, went to the point 00:54:45.821 --> 00:54:49.325 where even departments have contests against each other. 00:54:49.325 --> 00:54:52.494 And so maybe not totally gamification, 00:54:52.494 --> 00:54:56.373 but there's ways to use tools like that 00:54:56.373 --> 00:54:59.501 and kind of keep the seriousness, 00:54:59.501 --> 00:55:03.797 but bring some levity to it and kind of build that competitive. 00:55:03.797 --> 00:55:06.967 The other thing I'll put in a plug for, CoSN, 00:55:06.967 --> 00:55:09.845 the group that I'm involved with, 00:55:09.845 --> 00:55:12.973 and part of the cyber security initiative there. 00:55:12.973 --> 00:55:14.475 We're, through a partnership, 00:55:14.475 --> 00:55:18.937 we're developing an instant response tabletop game. 00:55:18.937 --> 00:55:21.231 It's going to be an online game. 00:55:21.231 --> 00:55:24.318 But the idea is that as institutions, 00:55:24.318 --> 00:55:26.236 it's so critical that they develop 00:55:26.236 --> 00:55:28.238 an incident response plan. 00:55:28.238 --> 00:55:30.949 And one of the things is testing that plan 00:55:30.949 --> 00:55:33.827 and walking through scenarios. 00:55:33.827 --> 00:55:37.122 So we're trying to build this database of here 00:55:37.122 --> 00:55:40.834 are various incidents and what could happen next. 00:55:40.834 --> 00:55:44.254 And if anyone on the meeting 00:55:44.254 --> 00:55:48.133 is going to the CoSN conference in Nashville in April, 00:55:48.133 --> 00:55:50.928 we're hoping to debut that game there. 00:55:50.928 --> 00:55:52.304 And we'll see how it goes. 00:55:52.304 --> 00:55:54.431 It may just end up being a conversation 00:55:54.431 --> 00:55:57.935 about incident response, or we may play the game. 00:55:57.935 --> 00:56:00.562 But if nothing else it'll be a win-win 00:56:00.562 --> 00:56:03.315 because the more conversation you can have 00:56:03.315 --> 00:56:08.904 about potential scenarios and what actions to take, 00:56:08.904 --> 00:56:10.697 is a win-win. So, thank you. 00:56:14.034 --> 00:56:16.537 >>I'll throw it out as well. 00:56:16.537 --> 00:56:20.207 Not exactly where all my expertise is along the way, 00:56:20.207 --> 00:56:22.251 but gamification is a really interesting concept. 00:56:22.251 --> 00:56:25.003 You're looking for ways to motivate, 00:56:25.003 --> 00:56:28.465 ways to increase engagement, and become more relevant 00:56:28.465 --> 00:56:32.386 with what's out there from a consumer aspect 00:56:32.386 --> 00:56:34.346 of apps, technology, games. 00:56:34.346 --> 00:56:37.683 And we know that there's e-sports is one, 00:56:37.683 --> 00:56:38.934 is becoming a thing. 00:56:38.934 --> 00:56:41.520 There's coaches now at universities, 00:56:41.520 --> 00:56:43.730 at high schools and your local areas 00:56:43.730 --> 00:56:46.775 and you get a paid-for team. 00:56:46.775 --> 00:56:48.569 So there's things that we can point 00:56:48.569 --> 00:56:50.612 at that say people are interested 00:56:50.612 --> 00:56:52.531 and they're going in that direction. 00:56:52.531 --> 00:56:54.324 And I hate to say something so obvious, 00:56:54.324 --> 00:56:56.160 but I know there's a lot of research, 00:56:56.160 --> 00:56:59.246 and I think there is actual, you know, at the universities 00:56:59.246 --> 00:57:02.749 and again maybe more through the behavioral sciences 00:57:02.749 --> 00:57:04.668 of some of our university channels, 00:57:04.668 --> 00:57:08.547 they're looking at the modalities of gamification 00:57:08.547 --> 00:57:10.382 and what's working and what's not. 00:57:10.382 --> 00:57:13.343 I think a big component of that is some of these companies 00:57:13.343 --> 00:57:15.429 that are going out with the gamification is, 00:57:15.429 --> 00:57:18.098 can they put content in that the individual recipient 00:57:18.098 --> 00:57:20.976 can learn something from, and it's digitized 00:57:20.976 --> 00:57:24.521 and it's different than just the textbook approach. 00:57:24.521 --> 00:57:27.024 I'm not laden with all the best practices 00:57:27.024 --> 00:57:28.650 by any stretch of the imagination, 00:57:28.650 --> 00:57:30.861 but I know that there's some services out there. 00:57:30.861 --> 00:57:33.155 I've come across some gamification concepts 00:57:33.155 --> 00:57:34.948 around education. 00:57:34.948 --> 00:57:36.491 And I think it's still pretty novel. 00:57:36.491 --> 00:57:39.328 I think we've got years ahead of us with research 00:57:39.328 --> 00:57:42.664 that's going to point us in the direction around that 00:57:42.664 --> 00:57:44.499 and it's an interesting space. 00:57:44.499 --> 00:57:45.167 I think it's going to be 00:57:45.167 --> 00:57:48.337 and is obviously a very new way of doing things. 00:57:48.337 --> 00:57:51.632 And I think as long as it's driving 00:57:51.632 --> 00:57:53.216 the right behavior, again. 00:57:53.216 --> 00:57:56.094 And as check marks I'd be looking for 00:57:56.094 --> 00:57:57.721 does it increase engagement, 00:57:57.721 --> 00:58:00.933 and is attention and focus going in there, 00:58:00.933 --> 00:58:05.312 and are students and/or parents or whoever is consuming 00:58:05.312 --> 00:58:07.814 it actually getting something from the content? 00:58:07.814 --> 00:58:09.483 I'll leave it at that and maybe the group 00:58:09.483 --> 00:58:11.068 has something else to chime in on, 00:58:11.068 --> 00:58:14.988 but my thoughts are on the gamification right now. 00:58:14.988 --> 00:58:18.283 >>I want to just, I know there's probably, 00:58:18.283 --> 00:58:21.453 I want to take, you've got one minute, 00:58:21.453 --> 00:58:24.331 whoever wants to take it between Kristina and Doug, 00:58:24.331 --> 00:58:26.833 which one do you want? Which one wants it? 00:58:26.833 --> 00:58:28.835 Doug, you got thirty five seconds, brother. 00:58:28.835 --> 00:58:30.003 >>Got it. 00:58:30.003 --> 00:58:32.923 So look, all I want to emphasize here is, 00:58:32.923 --> 00:58:35.842 we know there is no shortage of guidance and advice 00:58:35.842 --> 00:58:38.637 that are available from cybersecurity experts. 00:58:38.637 --> 00:58:41.515 And I think the challenge that we have in K-12 00:58:41.515 --> 00:58:45.435 is translating that information in a way that is actionable 00:58:45.435 --> 00:58:49.022 and speaks to the K-12 audience, whether that's students, 00:58:49.022 --> 00:58:51.525 teachers, administrators, what have you. 00:58:51.525 --> 00:58:53.485 I mean that is why K-12 Six launched, 00:58:53.485 --> 00:58:58.031 to be that translation player between that great information, 00:58:58.031 --> 00:59:01.576 delivered in a way and a context that works for K-12. 00:59:01.576 --> 00:59:04.496 So I think gamification is an example of that. 00:59:04.496 --> 00:59:06.623 I think we have, I think it's a great example, 00:59:06.623 --> 00:59:07.833 it's very promising. 00:59:07.833 --> 00:59:10.127 I think we have a lot of work to do though, 00:59:10.127 --> 00:59:12.504 to help the K-12 sector take advantage 00:59:12.504 --> 00:59:15.173 of all of the expertise that is available out there 00:59:15.173 --> 00:59:19.928 and it's not through really long technical jargon laden reports. 00:59:19.928 --> 00:59:22.472 Right? We just don't have the time. 00:59:22.472 --> 00:59:23.890 It needs to be delivered to us 00:59:23.890 --> 00:59:27.686 in a way that we can receive it and act on it. 00:59:27.686 --> 00:59:28.979 >>Thank you. 00:59:28.979 --> 00:59:31.356 Kristina, I saw you, escape room. 00:59:31.356 --> 00:59:33.817 Kristina has an escape room from ED. 00:59:33.817 --> 00:59:35.569 So, as gamification. 00:59:35.569 --> 00:59:37.654 >>I mean, I should talk to our own CIO 00:59:37.654 --> 00:59:38.947 to see if we can get it out. 00:59:38.947 --> 00:59:40.824 Because it's actually really good. 00:59:40.824 --> 00:59:42.826 So, I'll follow up. 00:59:43.869 --> 00:59:47.831 >>Lindsay, it's back to you. We start right at 12:30. 00:59:47.831 --> 00:59:49.458 >>I know, you guys have been great. 00:59:49.458 --> 00:59:51.626 And Marlon, thank you so much 00:59:51.626 --> 00:59:53.545 and thanks to all of our panelists 00:59:53.545 --> 00:59:57.007 for a really fantastic and informative conversation today. 00:59:57.007 --> 00:59:58.592 We heard really great insights 00:59:58.592 --> 01:00:00.677 on everything from protecting student data 01:00:00.677 --> 01:00:03.263 and understanding tools available to combat risks, 01:00:03.263 --> 01:00:06.308 to taking a whole community approach to cybersecurity. 01:00:06.308 --> 01:00:08.143 So again, I want to thank all of our panelists 01:00:08.143 --> 01:00:10.645 for sharing their expertise and guidance. 01:00:10.645 --> 01:00:12.606 And really a huge thank you to all of our attendees 01:00:12.606 --> 01:00:15.150 for being with us today and for all of your comments, 01:00:15.150 --> 01:00:17.819 the questions, really appreciated. 01:00:17.819 --> 01:00:20.488 So with that I'm now going to turn the floor over to Kristy 01:00:20.488 --> 01:00:23.783 who will introduce the final workshop of the forum. 01:00:23.783 --> 01:00:25.202 Kristy, over to you.