With the surge in , district leaders have to allocate more resources to cybersecurity programs, leading them to seek concrete proof of their efficacy from CISOs and Technology Directors.
Additionally, education has undergone a historic digital transformation, which, unfortunately, comes with an increased vulnerability to cyber incidents. Together, these two factors are making cybersecurity a huge concern for schools.
With the influx of funding grants, as well as scrutiny of cybersecurity investments, the traditional approach of evaluating cybersecurity success through technical controls or risk management is no longer sufficient. The return on investment (ROI) in school cybersecurity should also be gauged by its effectiveness in enabling the institution's future continuity of service and protection of data.
To achieve this, the technology leader and their team must collaborate with other educational executives, including the Chief Financial Officer (CFO), to establish and agree upon cybersecurity ROI metrics. The focus should transition from isolated technical checklists to a comprehensive understanding of the financial and educational impact that the current cybersecurity posture creates and mitigates.
Let’s dive into the comprehensive strategy that schools need to take to measure cybersecurity ROI.
Understand Your School's Cyber Risk Appetite
Schools must identify and quantify their risk appetite by defining acceptable thresholds at both the overall and departmental levels. Technology leadership, be it a CISO, CIO, Technology Director, etc., plays a crucial role here in order to align cybersecurity risks with the school's educational strategy and enable teams to weigh up the benefits of certain strategies against cyber risks. As Deloitte highlights in their , articulating a clear risk appetite allows for informed decision-making regarding new educational initiatives, technology adoption, or changes in policies.
For instance, the sudden shift to remote learning during the COVID-19 pandemic underscores the importance of evaluating cyber risks associated with strategic decisions. Questions about acceptable losses in the face of cybersecurity incidents become central to decision-making.
Clear Metrics To Follow
Schools can be forgiven for falling into the trap of just wanting to measure traditional metrics such as the count of blocked malware incidents or data loss prevention events. However, they often lack context.
Additionally, even though the percentage of intrusions thwarted by firewalls or the percentage of filtered phishing emails, offer some context through percentages, they present challenges. These difficulties include potential blind spots due to the limited scope of existing monitoring technology and biases introduced by queries reflecting the analytical skills of the architect or user.
Instead of just following straightforward metrics, schools need to integrate cybersecurity with the specific needs and budget available. A school could allocate funds to invest in security training, implementing multi-factor authentication, and incorporating systems monitoring and remediation to improve its overall cybersecurity posture. These investments would help to protect their students and staff, ensure continuity of education, and provide a safe and secure learning space, even amidst today’s extended technical environment.
Use Benchmarking for Perspective
Comparing a school's cybersecurity performance to educational benchmarks provides valuable context. Understanding sector-specific risks, such as budget and IT resources issues, as highlighted in , helps schools determine acceptable levels of risk. Benchmarking also aids in prioritizing resources against likely threats, ensuring efficient allocation of vital security budgets.
If schools similar to yours are prone to specific threats, your assessment should center on whether your controls and strategies effectively counteract those attack vectors. Regulatory changes can impact the cybersecurity landscape, as seen with the increasing reliance on digital platforms in education. Monitoring benchmarks helps schools stay ahead of emerging threats and potential regulatory requirements.
Continuous Improvement
Recognizing the symbiotic relationship between cybersecurity and educational strategies is crucial for ongoing success. Changes in one aspect affect the other, necessitating continuous alignment between cybersecurity and educational priorities. The shift to online learning exemplifies the need for adaptable cybersecurity strategies as educational landscapes evolve.
Taking the move to online learning that we previously mentioned, in a pre-pandemic world, a school’s primary cyber risks would revolve around malware infecting local workstations and spreading through the network. So, the IT team would prioritize measures such as web content filtering and network segmentation.
However, with the shift to remote and hybrid learning, the distributed nature necessitates the technology team to implement zero-trust cybersecurity solutions and devise new methods to prevent infections originating from internet connections outside school networks that bypass district web proxies, firewalls, and content filtering.
You should bear in mind that cybersecurity is not about eliminating risk entirely. Instead, it revolves around striking a healthy balance between risk and reward. This allows the school to operate efficiently while effectively managing the probability of risk at an acceptable level.
Final Thoughts
Cybersecurity ROI in schools extends beyond technical measures and risk elimination. It involves aligning cybersecurity initiatives with educational goals, understanding and quantifying risks, benchmarking against educational standards, and maintaining continuous communication between cybersecurity and academic teams for ongoing improvement.
It’s also crucial for schools to understand the probability of likely attack methods so they can tailor defenses, considering the unique risks associated with their location and size. As schools continue to embrace digital transformation, continuous improvement in the symbiotic relationship between education and cybersecurity is absolutely essential.
