Ransomware Attack on Buffalo Public Schools in Buffalo, New York
The 2020 COVID-19 pandemic around the world has accelerated an already aggressively expanding technological age that we live in. Almost everything we do from research, official work, financial transactions, to shopping and entertainment, is all dependent on the internet. The sheer indispensability of online software in our daily life today is reason enough for us to refine and enhance our cybersecurity resources. But even with vigilant efforts, unfortunate situations where our systems are breached and our privacy is violated do crop up. Such an attack has happened in the wake of March 2021, where the Buffalo Public Schools in Western New York faced a vicious cyber-attack and had to shut down all school systems to protect their online resources.
The Buffalo Schools serve approximately 34,000 students in New York. On March 12, 2021, they faced a ransomware attack on their cyber systems. The attack was such a serious threat that the school’s management immediately decided to shut down all systems as soon as the breach of cybersecurity was discovered. Their IT staff took action by bringing all systems offline as an urgent and precautionary measure to avoid further damage. Buffalo Schools all over made the executive decision to cancel all classes, both remote and on-site, on March 15th, the Monday after the attack. They pacified anxious Buffalo parents everywhere by issuing a notice of the district’s efforts to “pressure test system restoration and access as well as communicate any new or required information for students to access virtual learning tools once instruction resumes.” The district and school management assured the parents that they are “actively working with cybersecurity experts” to resolve and minimize the effects of this cyber attack. The school has partnered with “Grey Castle Security” to assist with the investigation and recovery. Such cyber services offer risk and vulnerability assessment, compliance awareness, penetration testing, and incident response services, all of which are indispensable for cybersecurity. Experts and people working with the district management reported that they are “making headway in restoring critical systems that support the primary function of teaching and learning. We have also prioritized the recovery of any affected business operation systems. The district will implement a longer-term comprehensive initiative to enhance IT security and infrastructure going forward.” They are also still investigating whether Personal Identifiable Information (PII) in the system was compromised during the cyberattack. Buffalo Public Schools are trying to figure out how the attacker got into the network and also whether there are any other back-door mechanisms waiting to be opened if the main hole in the system gets plugged.
Ransomware attacks on cyber systems and software usually come in different forms. A common one is phishing spam emails, which are attachments that come to a victim in an innocuous email that once downloaded and opened can take over the victim’s computer. There are also more aggressive forms of ransomware attacks such as NotPetya, which exploit security holes to infect computers. Cybersecurity experts, like Arun Vishwanath, opine that cybercriminals often target government agencies and schools as they are less likely to devote their financial resources for protection against such attacks. According to K-12 Cybersecurity Resource Centre, approximately 350 cyberattacks on educational institutions were reported in 2019, with the number rising every year. Arun Vishwanath, who is a cyber expert as well as a Buffalo parent himself, says, “This is a process that takes time because you have to pressure test each of these systems and hopes that they have cleared it all out and have good backups.” He adds, “If you’re a parent out there and you have a child who’s using the school system-I think we’re protected from that, and if you have any doubt-the first thing to do-go off the internet-it stops the attack right at its tracks.” It is being reported in Buffalo News Channels that the estimated ransom for the attack might be between 100,000 and 300,000 dollars. When asked if the district should consider paying the attackers as a solution, Vishwanath says, “Is there value in paying? I would say no-I think we should all be backing up our data-we should all be trained to have good cyber hygiene and I don’t think we should pay the ransom.” Most cyber experts echo Arun Vishwanath’s sentiments and do not advocate paying the attackers as it gives them more power over the system for future breaching and attacks.
Thus, what we can learn from such cyber threats and attacks is that if we are to abandon ourselves to the growing proficiency of technology, we must make sure that we have specialized features in place that ensure our cyber protection. Citizens around the world must be taught how to back-up their data and ensure personal cyber hygiene. Only then will we be fully equipped to face such attacks head-on.
For further detailed information on the Ransomeware Attack on Buffalo Public School, please click on
Comments
Post a Comment