001Okay, our webinar is live and our YouTube feed is also live. Mr. Rodnick, the meeting is yours. Excellent. Thank you, Mr. Gilmore. Hello West Hello North Penn community. Hope you're doing well today. Today is our regular regularly scheduled safe committee meeting March 24th. I'm calling the meeting to order and we will start with our pledge of allegiance. I pledge allegiance to the flag of the United States of America and to the Republic for which it stands, one nation under God, indivisible with liberty and justice for all. Excellent. So now I would like to call for approval of the February 24th meeting of the Safe School Committee. Can I get So moved. Second. Do I need a second? Mr. Gilmore. Second. Okay. That was Mr. Bell and Mr. Kaiser. Excellent. Thank you. And with that I
002think I'm handing over to either Just a quick technicality, we need to vote on the minutes. Oh, do we? I'm sorry about that. >> All in favor? I. >> I. Any opposed? No. Okay. Excellent. Motion passes. I'm handing over to Dr. Landis. I will I'll take it from here and then Mr. Rodnick, if you want to add anything. So it has become somewhat an annual presentation to the board, kind of a cybersecurity update. Under Dr. Landis's leadership a few years ago we did a full-scale cybersecurity audit. We presented within reason the results of that audit. Just like when you're talking about you know, fortification and physical student safety matters in these formats. We are very tempered with the information that we share because of course if there are vulnerabilities or or concerns you don't want
003to go too deep into that in a public conversation. But at the same time it's important for us to just share a bit about our procedures that are in place for cybersecurity. So with that we have had a presentation on an annual basis of kind of an update. So it gives me great pleasure to introduce for the final time here Dr. Kristen Landis who we said at the action meeting will be retiring shortly after spring break. But presenting or at least here with Dr. Landis is our new director of technology who will take over after Dr. Landis retires. Her name is Mrs. Lindsey Smith. So Mr. Rodnick, if you want to add to the introduction otherwise we'll have Dr. Landis take it away. I just want to say on the record thank you to Dr.
004Landis for the collaborative work she has done in in my short time here. I came in and asked for >> [laughter] >> a lot of things and a lot of collaborative work between technology and in the office of Safe Schools. And I can't think of one time she said no. Um we made it work. She dedicated the resources and we got things done. So on the record publicly it won't be the last time I say this but but thank you, Dr. Landis for your work and welcome to Mrs. Smith and looking forward to that same collaborative work and also welcome to Dr. Williams who is joining us for his first Safe Schools meeting. So with that Dr. Landis, take it away. All right. Well, thank you very much, Mr. Rodnick and thanks to the school
005board and the committee for giving us some time this evening. As Dr. Bowers said, I do plan to be brief. Mrs. Smith is still getting up to speed on our cybersecurity practices. She's very familiar with the cybersecurity realm coming from Central Bucks School District. We did a lot of similar things. So she will be working right alongside me over the next couple weeks to get up to speed to where we are. So if you could move to the next slide, please. One of the things you'll notice about this presentation if you go back and look at prior presentations is that it's going to look very similar. We have a cycle of cybersecurity maturity as we call it that target a number of different pieces of cybersecurity every year. As Dr. Bowers said, we started this
006work back actually in 2021-22 on a formal basis. That's not to say we weren't following cybersecurity practices and protocols prior to that. However, we felt it was really important to look for a company that could work alongside us to help really guide us. The NIST standards that we follow are very complex. They have a lot of pieces to them and since we don't have one person in our team that is fully dedicated to cybersecurity we work together myself with the network team to lead this work together. But it also includes things like staff training. So really critical for us is to train our staff every year. That's actually a requirement as part of our cybersecurity insurance that we are training our staff. So they get two hours of training every year on cybersecurity. Two years
007ago we were able to move to more of a Netflix type training for that two-hour period and people are waiting for year three or season three to see what happens next. So they've been really engaged in that work. Additionally, there are things we do every year with the FR Secure team. That is the company that we have partnered with. We're in five year five of that partnership and actually renewed for another five years. We have been very impressed with what they provide for us. And I think one of the things that's really unique about FR Secure is that they are company agnostic meaning they aren't sponsored by anyone company like Cisco or Fortinet or Palo Alto or anything like that. They're independent and they look at our infrastructure internally, externally, processes and procedures and help
008us make decisions about what things need to be focused on in what years. So we do meet monthly with a virtual Chief Information Security Officer and it is the same person every month. We do bring in higher-level executives at times if there are things going on in the world or maybe even in the world of cybersecurity that they want to dig a little deeper with us. But we do have the same person every month. And they work very closely with us on our risk assessment that's done every year and then our road map for remediation efforts throughout the year. So that's basically our cycle, things that we're doing every single year. If you could go to the next slide, please. So one of the very important pieces as I'm sure some of you know about
009cybersecurity is making sure we have the proper infrastructure in place. So it's not just about training staff although the human element is one of the biggest elements that we really want to focus on because that one is very different. It's easy to control a server. It's easy to upgrade it and make sure that we can do penetration tests on that, make sure that people can't get into it. It's not as easy fishing attacks going on. So so really we have six key components to that infrastructure piece. So securing the data transmissions that go along and securing our internet, making sure that our internet connections have DDoS remediation on them so that they aren't being attacked. We currently have two internet connections. We have a 10 gig pipe to Comcast directly down at 401 North Broad
010in Philadelphia and we have a 10 gig pipe to Montgomery County Intermediate Unit who also eventually ends up at 401 North Broad in Philadelphia. However, they do have a different path. So we are backup internet does have a divergent path for internet. In the last couple years we've upgraded all of our core infrastructure with the support of the board so that it is not only new infrastructure but has the AI learning components to it. Our core we just upgraded this spring. You may remember we had to go offline one Saturday to to get all those connections switched over. We recently upgraded our firewall to a next generation firewall which just means that it's smarter. There are a lot of pieces of information about cybersecurity that we get every day. For example, new IP addresses or
011new bad actors that are um we need to categorize and enter into our firewall. So up until our new next generation firewall that all the that work was done manually and now a lot of it is done automatically with the help of AI and being able to ingest those pieces for us. We are in an ongoing of upgrading our routers and edge switches as well. We were um, primarily Cisco. However, our wireless infrastructure is Aruba and Aruba has really come to the forefront of um, manufacturing switches as well. And when we have everything under a single pane of glass, we have a lot more power there. So, we are now migrating all of our switches to be edge switches. And I'm sure as you know from other um, safety and security pieces that we need,
012for example, the cameras and the vape detectors, all of those pieces need to go onto the network. So, we're actually installing specific switches um, for uh, Brandon and his department's work. So, it's easier to troubleshoot and find um, and also protect. So, as you can see there, we have four elementary schools and three middle schools in progress um, and are working through a nine other elementary schools. They will most likely be that project mostly go on uh, into the summer. We also need to make sure that we're protecting our servers and our storage. And so, our our infrastructure um, is also being upgraded actually this year prior to the summer. We'll have a storage increase as well as um, some more capabilities to en- ensure less data loss um, through data loss um, protection technology.
013And then finally, backup um, last year we were able to move our offsite backup actually in the cloud to two different places. Um, I'm not going to tell you where they are, but they're both secure. And um, they are immutable backups as well. So, um, we feel really strongly that we have a lot of good infrastructure pieces in place there. So, moving on to the audit, um, our audit is similar to a PSSA score, but really um, is a score we that FR Secure has kind of uniquely created based on those NIST standards that I mentioned earlier. Um, and each year we move up. And so, I am very excited to say that we are strongly in the fair category. Um, we did start in the poor category and that's not abnormal for K-12 school
014districts. The benchmarking um, for the scores that that we compare ourselves to are typically colleges and universities. There are not every school district is doing the work quite the same way we are. Um, so [snorts] we're very proud of the fact that we are continuing to improve. I will say this year, last year we were 600, so we just got into that fair uh, category. Now we're at 614. However, we also moved up to a um, level three audit. And so, if you can go to the next screen, um, one of the things that a level three audit gives us is more insight into process and procedure and not just across the technology department, but across all departments. As Brandon spoke, you know, we we interface very closely with his department, a lot of the
015technology there, but we also interface with a lot of technology in facilities. We interface face with our finance system, with HR. So, our audit actually talks about what they call controls. And so, a level three audit has 291 controls that were added to it. That's a lot. That was a lot of time for us talking about a lot of things. And so, you can see here um, in this chart, in two areas, we are actually above the acceptable range. Uh, and that's in physical controls. So, you think about security to our data centers, security to data closets in our schools, um, security with computers. So, we teachers and administrators walk away from the computer, they lock the screen. Um, when we do an every other year, biannually we bi- bi-yearly, we do an in- an
016>> [clears throat] >> excuse me, um, an onsite audit. So, every other year it's onsite, every other year we do the same type of audit, the auditors just don't come onsite. So, they do things like walk around our buildings, um, see how many doors are open, things that you may typically think of as a security audit, but also really are part of the whole cyber security program. Um, so, one of the areas that we did we do have some work to do in are administrative controls. And those are really um, documenting our processes and procedures, so everyone knows what they are. We have a lot of processes and procedures in place. Um, many of the of my network team have uh, been here a long time. So, we know what to do, but we also
017know that, you know, we're all replaceable. We don't like to think that, but we are. And so, you know, from my lens, bringing someone like Lindsey in, we need to make sure that she is supported and knows those processes and procedures. Um, and I'm not just telling her and having her try to remember all of that information. Um, so that's an area of growth for us that we are continuing to work on um, with our virtual chief information security officer. And then also some of our internal technical controls. And those things also speak to um, did did people walk away from their computers and not lock them? Did people leave out potentially confidential documents that someone from the public could walk by and see? Was there a filing cabinet open that somebody could pull open?
018So, there are a lot of pieces in that 291 controls um, that speak to internal. So, um, just to get that's very high level detail of the audit. Um, we spent two days onsite with them and then they spent additional time actually, you know, looking through our pen tests, our internal scans, our external scans. Um, and if you could move to the next slide, I'll talk a little bit more about that. Um, we talked about the immutable backups, excuse me, already. Um, one of our focus areas in the last year, oh, Thank you, Brandon back up. Um, was our EDR vendor. And so, uh, we recently had the opportunity this year with our EDR vendor. They are working on a statewide contract to add more services. So, one of the services we were able to
019add was some additional security on identity management, which means making sure our accounts are secure, making sure when people retire their accounts are closed after a certain time, making sure that our service accounts are logged into regularly. If we have service accounts that maybe were created five years ago and are no longer needed for a specific server, we deactivate those accounts. Um, so that's been a big area of focus for us. Some of the other things you can see on there um, are things that we that we have done in the past and we keep doing. I'm not aware that all districts have their students reset their passwords every year, but we do have all of our students from second uh, second starting this year. It was third um, last year, but this year we're
020having second graders um, change their passwords, 12-character complex password. They change that once a year. They do have the option of changing anytime they want, um, but we do require them on a change it once a year. And then MFA, we have it for all of our staff as well as our high school students. So, any student in 10 through 12 um, has that MFA requirement as well. And our server updates, patch management, that actually happens monthly. So, um, we have a server update weekend every month um, that we update all of our servers and we will do it sooner if needed. If something comes out and says there's something that's been compromised and we need to make sure we're addressing it. Um, the vulnerability scans that we do are part of our audit. They're
021done twice a year um, internally. Externally, we actually have weekly vulnerability scans. It's an it's um, a service that CISA, which is a computer and information service agency through the government um, offers for free. So, we try to take advantage of every free service we can as well. Um, and then as I spoke to before, the ongoing training um, and fishing simulations. So, I know that's really quick um, high level what we're doing, but we wanted to give you an update as to where we are. Let you know we're continuing to make progress. Um, and see if there's any questions from the team. Thank you very much, Dr. Landis. Um, I hope you can all still hear me. Um, so with me today is Mr. Kaiser and Mr. Bell, any questions? Yeah, I just wanted
022to say I don't have a question, but I think that um, that was an excellent presentation and I really appreciate everything you said. And uh, I'm in that industry, so it really resonated with me. And I know a lot people who aren't in the industry think that fair is not good, but in this case, it's very good. And I I've seen so many different industries where mostly it's poor. I'm not going to say which ones, but um, so in in your case, the benchmark as you said is against higher education, which even makes it look look is better actually, right? So, uh, I really appreciate all that and I appreciate the fact that you brought up people cuz it's we always used to say people, processes and technology. So, you can't leave out the people
023part of part of that. And so, that's that's it. I just wanted to say thank you. Thank you, Mr. Kaiser. Um, one other thing I would share to the team, I'm sorry I forgot to mention this during the presentation. We are actually currently in the process of working with our vendor on what's called a purple team activity where the red team actually tries to infiltrate our network. They look at all of the systems we have in place and see if they can do it. And then the blue team comes in and shows us if they were able to do something, what we need to take a look at and move forward. So, we have four different sessions where we're working through that and we'll be working again with this team additionally in addition to the
024audit to make sure if there are any things that we missed during the audit that we continue to focus on that. Excellent. Thank you very much, Mr. Bell. Any questions? Uh first a commendation. I am not an expert like Mr. Kaiser, but I have led and lived lived through a cyber incident on the K-12 sphere and it is a nightmare. And so, to your point, there are not many school systems in K-12 that have intentionally invested this amount of in just an intention to this problem. And so, I really am grateful for your leadership to make this a real thing that is part of the conversation day in and day out. I also think that it's really rare to do that without having a real incident. A lot of people put attention to it after
025the fact, after you've already suffered through lost weeks of time, lost tons of data. So, it's really commendable the effort that the entire district has put in on this front. To go with it, two different questions. I do think the backup is the key to the all this. So, seeing a real investment in immutable backups is crucial. So, thank you for doubling down and having two offsite spaces is great. What does the disaster recovery side of this look like? Cuz I know that that is not necessarily cybersecurity in an attack sense, but it does have a real impact on a similar level of structure. Sure. So, we do have disaster recovery plan that we work on and we revisit I would say at least yearly if not more because as people change, for example, some
026of our cabinet have changed, we need to make sure we're continuing to update that plan to reflect that piece as well. And so, we are currently going to schedule a tabletop. We have not done one yet specifically on disaster recovery. We've talked about it and we have like kind of follow through scenarios, but not necessarily a tabletop with our team. So, that's actually next on our road map as well. Awesome. Awesome. The next two questions may be for you, Dr. Landers, or maybe for you, Ms. Hauser. The first one is how does this annual audit going through on the cybersecurity side overlap with the financial cyber questionnaire that might happen during the traditional financial audit? Does it Does it cross over? Is it a little bit different? Cuz you mentioned the intersectionality between the financial
027data and the student data. Do you want me to answer, Kristen, or do you? Uh you can answer. I'm not quite I don't know what the auditors do. >> So, the internal controls component of the financial audit is is mainly about the internal controls within our within the business office itself. So, there's a a little overlap in that they're testing and auditing at our internal controls with eFinancePlus and whatnot, but I would say they're they're kind of separate cuz they have separate purposes. Like the internal controls one is to make sure that we're doing financial processes appropriately and that we're using the correct internal controls. And then Kristen's Kristen's audit is more about testing those controls and testing the accesses and who can get in and less about authority in the business office and more
028about system protection. Perfect. I And I appreciate having both of those structures in place. I think they're both really important. Mr. Bell, one thing I would add, we I know I mentioned MFA. However, for the specifically for our financial systems, we have VPN and required MFA for VPN before you can even get into the system. Um So, we kind of have double MFA. We also require that of all of our vendors. So, we do not allow our vendors to use whatever kind of remote software they want to get into our network. They have to use our VPN and they have to use our Duo setup in order to get be able to get in and work on any of our servers. Love that. Thank you so much. Last little question cuz you mentioned them and
029I think that there are sneaky critical cog to have in place just in case. Who is the district's cyber carrier? Sorry, I muted. Right now it's Chubb. And then we just filled out We just start doing applications for next year. I have just gone out in the last couple weeks. Awesome. [snorts] Thank you so much. Yep. Excellent. Thank you, Mr. Kaiser and Mr. Bell. This is why I love having fresh eyes. If there were any additional questions, All right. Again, thank you, Dr. Landers. I can't believe it's going to be one of the last times I see that. But it has been getting to know you. It's been even more of a pleasure getting to work with you. Again, welcome, Mrs. Smith. And I'm sure that even though they are big shoes to fill figuratively,
030I am sure that you are more than up for the task. All right. I think that ends our informational information for today. Any other business, Mr. Rome? Sure. We just want to check in with our student rep, Grace. Any information to share? Yes. About the student-led initiatives I talked about a while back and have been talking about. I recently met with them I think 2 weeks ago and they came back with just like a small proposal so far of what they want to do to move forward with this initiative. And the proposal is kind of using this as like a seminar for current students who would like some guidance especially through, you know, mental health and right now especially that I have experienced this now, college applications and the process of that and various things
031like that. So, they wanted They proposed a format of a 1-hour virtual seminar from mid to late April somewhere around there featuring like a moderated panel of four to five freshman or sophomore college students. And these four to five would be, you know, diverse groups of students from different backgrounds, different schools, different majors, pursuing different careers, and like just very like a variety of students. And it's intended for high school students and even sometimes middle school, particularly juniors and seniors for post-secondary planning. And they kind of just want to see some collaboration with Northwind School Board especially through like an alumni network or something like that to help identify and recruit four to five recent graduates who may be interested in serving as panelists. Perfect. Thank you for that, Grace. Um And committee, I will
032work with Grace to try to help facilitate and provide as much support as we can for that initiative for her work. I appreciate that, Mr. Rome. We appreciate that. Thank you, Grace, for bringing that to our attention. I have to say you do a great job as a student rep in bringing truly the voice of the community into this room. So, we appreciate you. Thank you. Any other items? All right, Mr. Gilman, do we have any hands up for public comment? There are no attendees from the community tonight. No, say it isn't so. >> [laughter] >> Zero. All right. Um We had a riveting topic, but it was very clear. So, thank you, Dr. Landers. So, with that, I think I can call a motion to close the meeting. There are no other topics. Can
033I have a motion? So moved. Excellent. Thank you very much. Have a good one, everyone. Thank you. Are we starting F&O now or we There'll be a new link. Okay. We're rolling right in, right? Yep. All right. Thank you. Thank you, everyone. Good night, everyone. Good night.