001Good morning everybody. Uh almost good afternoon. Um thanks for the patience as I took care of a little bit of a technical stuff and in and getting this all situated in there. So welcome to the February edition of the cyber security coordinator forum. Um, just as a reminder, the TA cyber security team hosts a monthly meeting for Texas school systems, cyber security coordinators, technology coordinators, uh, the ESC's uh, and cyber security personnel and other members of the community that support K12 uh, cyber security efforts. Uh, it provides content designed to assist school systems and ESC's towards maturity and information security program. Just a little bit of housekeeping. Uh the webinar is being recorded. Uh recording slides will be available a few days after the webinar ends at the TEA cyber security website. Uh chat has
002been turned off. Uh please submit questions uh in Q&A and we'll address them at the end uh or in a follow-up email. Uh duplicate login are not allowed. Uh and please if you've got chat bots or notetakers and things like that, please remove them for the session. We prefer that they not be in here. uh the team if they see this they will go throughout the list and remove those but if you would kindly do us a favor so that we don't have to of of turning off um those type of additional accounts in here a little bit about me uh my name is Aaron Ramirez I am the chief information security officer here for tea uh started on August so just a little shy of six months uh I've been working in IT for
00328 years uh and um been glad to to move to to this role uh to have a a better view and and to help more of our our school systems uh with some of these initiatives that we'll talk about today. Excuse me. Uh so, a little bit on security awareness training. Um as you guys may know, Texas Government Code uh 2054.5191 requires all of us to do an annual cyber security awareness training. Uh the training must be certified by Texas DI uh and that has to be sent to um DI on August 31st to show that we are compliant. Uh currently for schools, the only folks that need to complete the security awareness training from a compliance perspective is the cyber security coordinator and any elective officials. for example, the school board and the superintendent
004uh and then anybody else who the school decides along with the cyber security coordinator who should also take uh the training. Of course, we always recommend that you provide this training to as many uh of your staff as you can uh because it goes uh a long way in in securing uh your infrastructure if the the whole team knows exactly how to be safe especially when handling emails uh and things like that. something. That's >> Daniel. Are you advancing the slides? I'm still seeing the first slide. So, >> oh, thank No, I was not. This is where we're at. So, the um Give me a quick second. I think I found out what the issue is. This is annoying. So, what something new that's coming down is is artificial intelligence training. Uh, so House Bill
00535112 added an annual AI awareness training requirement uh piece to the annual security training that we're already doing. Uh, so D in consultation with the public sector AI systems advisory board is required to certify at least five AI training programs. Uh, state and local government employees and officials are required to annually complete a certified AI awareness training program. Government entities, government entities, I'm sorry, must annually certify their compliance with the training requirements by August 31st uh using the cyber security uh sorry using the the the same portal uh uh NDI and the link to get any information is included there at the bottom if anybody wants an initial information on on these requirements. But this is something that D has been uh working on uh to complete. And I am told that the um trainings
006that are approved uh by DI should be listed at the end of the month. So in a a couple days or early March at the latest. So they're coming. Uh I know a lot of folks have have have contacted asking if if uh if I have that list yet or where it's going to be provided. Uh it'll be provided in that link that I shared there at the bottom of this slide. Uh and it should be coming pretty soon. uh according to to the so what does this mean for our school systems? So uh same as the um annual awareness training already only the cyber security coordinator is required to complete the annual AI training. Uh any other school system employee as deterred by school system and the cyber security coordinator uh would be required
007to to the training as well. Uh state agencies local governments employees who use a computer at least 25% of employees require duties. elected or appointed officials and officers uh and the state agency contractors will not be required to complete the AI training. So I provided that last piece there for the ESC's that may be in attendance uh so they can see how how this may impact uh them. Uh they're a little different from from the school systems. Um if if anybody has any questions regarding uh the AI training requirements, you you you're welcome to share to to us and we'll provide the the information. But the only update really that I have is that this is coming. uh we have communicated in the past that it was coming. Uh it is going to be an
008annual requirement. Uh and the list of certified trainings uh are being worked on by uh D and they should release them pretty soon. So some just a note on federal grant compliance requirements. So I don't know if if you're aware but the uh federal office of management and budget has uh 2 CFR 2000.303 303 uh specifically it states it requires federal award recipients and subreients to implement reasonable riskbased cyber security and other safeguards to protect PII and set sensitive information and compliance with applicable privacy and confidentiality laws. So this is auditable auditable I'm sorry under the single audit act uh core internal control requirements tied directly to grant compliance uh review by TA grant compliance and administration office is now going to include this request as part of their um review of of grants. So,
009please expect that the the department will start asking specifically questions on how a school is meeting these requirements for any of the federal grants that that any of the schools are participating in or receiving funds from. So, it's important to note this. How do we how do we become compliance? How do we demonstrate reasonable documented and operational cyber security measures as is required? So one um the school should have an officially assigned cyber security coordinator which is a state requirement not not a federal requirement. So that's one place uh it it shows that the school has a an individual who is responsible for the security program. Um adopting a cyber security framework uh for example the Texas cyber security framework uh which is also a state requirement would also help support this. Um completion of
010annual cyber security awareness training uh which is you know a part of 2054 5191 which we just spoke about uh is another way to demonstrate uh the the compliance requirement and then to show that devices are protected. uh for example the the edr software that we make available as part of the um K12 initiative uh is is a good way to show the the the work being done by the schools to secure the the end points where this data may reside. Uh and then an incident response plan was requested part of the EOP last year and it required a cyber security annex. So that also that document which you should already have would would be another uh item that could be provided uh to show that the school has an incident response plan. So these
011are the sort of the the easy things that would help uh a school who's receiving federal grant money to show uh and and demonstrate reasonable uh cyber security measures. uh they're they're they're not the only ones, but um I point these out because these should be things that the schools are already working on and have already implemented and sort of the easy lift uh to show the that is being done by by the schools for the grants. So let's talk a little bit about the Texas K12 cyber security initiative. So just a reminder, in response to the increasing threat of ransomware and other malicious cyber activity targeting school systems across Texas, uh TA launched the K12 cyber security initiative in 2023. The initiative was made possible through funding approved by the 88th Texas legislature, which
012supported TA's request for dedicated cyber security resources to help school systems strengthen their defense and response to emerging cyber risks. The goal of the initiative is to deliver immediate practical solutions to help school systems defend against major cyber incidents such as ransomware attacks. Priority is given to rural school systems and cyber security practitioners are available through regional education service centers to support the implementation of cyber security controls aligned within the scope of of this initiative. So the um current goals that were um created at at at the at the onset were of course the EDR service that we provide uh through the MSS program uh for for all school systems um to to to better secure their endpoints. Uh implementation of MFA for at least staff email systems. Uh ensuring Demar compliance uh to protect
013against fishing and spoofing emails. uh because that is a a another vector that often leads to ransomware uh issues for a school. Uh then restricting local admin admin access uh to minimize risk of unauthorized system changes. Uh completion of the Texas cyber security framework assessment uh to get a baseline of cyber security program and action plans for improving maturity. Uh we we provide that at obviously at no cost. All these services are provided uh to assist the schools and they're at no cost to the schools. Uh and then of course the network detection and response which uh the pilot is currently closed for any but we are researching still uh ways that we can uh implement this and we might uh we we've learned that we might be able to provide some of this service
014through the arox uh and we're currently uh researching and and seeing the feasibility of us doing the service for additional schools uh through an ars um the TA funded grant through the tassi um pays for cyber security staff at every education service center uh and the goal goal of that is to ensure that the schools receive that support uh across the state um so that they don't have to do this alone. Uh if if if the especially our more smaller and rural schools if they need assistance they can now request um any of these initiative items through the ESC or through the AROCS for for some of the work that's being done as well and we'll talk about that in a little bit. So um still I get questions about how do we enroll in
015and request u these free services. So it starts off with the new customer form. Uh the new customer form is available at the TEA website. Uh and once completed uh you would send that to DI. Uh the new customer form does not require any signatures. All it is is asking for is who are the contacts that are going to be part of the uh initiative. Um and this is the information that that DR will then use to send out the IOC. So the the next step then is once once DI receives the new customer form, they will send the interlocal agreement uh with the proper uh information to the specific school system including the contacts that were listed in the new customer form. Uh once the school system receives the OC, they need to review
016it. Uh they need to complete it um filling it out and then walk it through approvals. uh which might be you know school board and other things um and then have it have it signed typically by by the superintendent. Uh one of the questions that I often get is the ILC does include an area where it asks about uh you know h how what is the maximum amount of funds that would be allocated toward towards the program. Uh and of course schools are like well I thought this was free. So if if the school does not intend on taking advantage of any of the other offers uh through the DI MSS program, then the school is allowed to put a zero there, which essentially uh informs um DI as part of the ILC that the
017only uh options that the school signing up for are those that are at no cost uh to the school system. Um the school system then sends the signed OC to DI for for processing. uh once once the AR receives the OC and they review it to make sure that everybody's signed and everything's kosher uh then they would provide access to the STS portal uh and this access is given to the technical contacts were provided in the new customer form. Um, of note here is that often times, you know, folks leave a district uh and and so the initial folks that maybe started off the process if they've left may not have access to the STS portal uh once it's given uh and if that's the case, you can always reach out and I'll share the
018link them sorry the email for that here in a little bit. Uh but once once the school is is um has access to the portal inside of there in the MSS area, you can request currently the EDR uh services and the TCF assessment. Um I did want to make note here that when you request one of these services uh the portal is is configured in such that the district the school system can identify a um somebody who's responsible for the payments right so because like I said DI also includes other services that have a pay option uh so even if the school is going to take advantage only of the free stuff the way the portal is configured is once the technology director for example submits the request, uh it has to be approved by
019uh the financial person. If they're one and the same, then although it sounds kind of funny, uh the the the um technology director will be asked to submit it and then approve it as the first approval uh because that's what the portal is is is looking for in case that uh that sort of that that task is some school system may have it spec specified to a different person uh and then it would go to that person for approval. But if not, then the IT director will be asked to immediately approve what they just submitted, which has kind of had a couple of these kind of stuck in limbo. And now we've communicated with the D and we we've done a better job of kind of keeping an eye on those uh and make sure
020that the school does the first approval. Uh once it goes through the first approval, then it goes through the rest of the workflow uh to get reviewed by both uh TEA and DI uh as it makes his journey for the final approval uh to allow the services to be started up for the schools. So, just make note of that that once you submit the request that it sometimes can get stuck on you having to also approve it even though you just submitted it which seems kind of weird but that's just the way the the portal works. So, keep note of that for for you guys that are submitting uh these requests in through the portal. Um the ESC's uh can provide support specifically if you need assistance with the ILC process or getting onboarded to
021the STS portal. uh they're a great resource if you have questions or for them to reach out to to D or to TA uh and requesting um sort of that moving forward. They're they're for the most part the the process is pretty seamless, but again every now and then like I said, we we we do get those that are stuck in there for one reason or another. Uh if if you lose uh access to or or need assistance, the ESC's can also help you at that initial stage. Uh the ESCs can also support you in in EDR agent deployment. um they have the the the ability to to work with you or or guide you if if that's what you prefer on on how to deploy the EDR agents uh across your systems. Um they
022we can als they can also provide uh email domain security specifically on setting up SPF, DKIM and Demark uh and most of that is just configuration and requires has no cost associated with it other than the time to have somebody work on it. um multiffactor authentication on all employee email accounts that can be Microsoft 365 and Google Workspace and again most of that is just employee awareness uh some configuration and has no cost and the ESC's can support you in that as well and then restricting local admin privileges on on on devices to make sure that we follow least uh privilege models um and again uh employee awareness uh and some configuration is all that's needed uh and I recommend the school take small steps when when enabling that uh to make sure that it
023doesn't impact uh standard, you know, school operations. Uh the current program participation, I updated this uh from our last time. If if you've attended some of my previous recent webinars, uh some of these slides you'll you'll see are very similar, but this one was updated. So, school systems that have onboarded with DI, there's 688 school systems according to my napkin math. uh of that uh in EDR there are 392 school systems that have signed up for the EDR. Uh that equates to 273,000 endpoints across the state that now have the EDR uh installed. Uh 48,000 plus attacks have been blocked and 17,000 plus of those have been ransomware threats that were neutralized. So the program has been very successful in helping the schools, you know, stay away from security incidents that would otherwise potentially lead
024a school to to ransomware issues. these numbers continue to rise. Um, and and as we've been communicating this off to the school systems the last couple months and these numbers, there are a couple of school systems that are transitioning uh some of their services to to the AROC um in in those areas that that are served by the ARSOC uh because they're getting other other um services from them. Uh and even though we those numbers should should show a drop uh because the the the the numbers when we went through transition we lose visibility into actual EDR deployments. Uh our numbers continue to increase from the MSS program. So that's a good sign. That means that even though we're losing schools because they're being uh helped by the ARSOC, uh our our numbers still continue
025to to climb. So this is a good sign that that we are uh moving forward in securing the state. So, thank you for all you guys that are out there doing the hard work of deploying agents and and and getting more secure. Uh, for the TCF assessments, there are now 71 schools that have signed up and 47 of those have completed. The rest are in in some level of of of work. Uh, either they're about to finish or they're about to start. Uh, but so far we've had 71 schools that have actually signed up for uh the assessments. Uh, this is great. Uh, individual results from the assessments are kept confidential. I I'd like to stress that to to know that the work that is done between the school system and the um and in
026this in this case sic uh is is completely shared only between those two uh tea only receives an aggregate of all schools after the assessment is completed to just kind of shows hey of all the schools that have reported these are the individual uh grades but they're not tied to a school. So we just have an aggregate of of what what is and the importance of that is that we wanted to make sure that schools feel comfortable in doing uh this um and it's not about TA prying into uh the the current status of the security program for the school systems or whatever but it is a great tool to allow the schools to understand where they sit and where they need to you know fill some gaps in the security program. uh and the
027the end report provided by the assessment does provide that uh guidance on on some of the easy lift things that could be taken care of uh to increase their maturity or some of the things that require you know sort of a harder lift uh and and and sort of give plans on on how long that might take and things like that. So it is a great thing to then share with leadership about how to continue to mature your security program. Um and then of course the NDR pilot uh which like I've said the the nine schools currently in the pilot are the only ones that were in there. Um and any it is currently closed to any new customers uh until costs are are evaluated and we are working with uh different partners to see
028if uh we might be able to open this up in a different form uh to more schools uh and we started that conversation for now with with the with the aroxs and I will provide additional updates to this when when there's something to share. Um we did send out a survey back in September um for a sort of a guidance on on how we did uh in in the initiative for the first bienium. Uh and then also additionally to that we asked the school to to let us know what roadblocks or what what uh issues they had uh with the program so that we could learn. Uh and then we also asked uh you know what what are the services that would be beneficial to them uh that they considered a priority for them uh
029for the next bienium which is what we're in in today. Um of note is that the survey was participated by 70% uh of all of the schools across the state which I think is is a is a really good number. Um I I would have preferred obviously 100% but we'll take it uh 70% of the schools in the state did respond uh and and let us know you know feedback on on the on the program and and and their needs. We broke that down into uh size by schools to see how the participation was across the different school sizes and it was pretty much 70% across whether you were a very small school or a very large school the the the the percentages were were good. So that means we had good representation from all
030the different school sizes and to what the needs of of the state were uh for the security programs and you know any of the issues of the program so far and so we've collected all that feedback and we're trying to make uh informed decisions on how to move forward uh including what services to provide next. So since we did this uh at the end tail end of last year, we've been working on adding additional stuff. Uh the four identified needs, the top identified needs I should say that were uh provided to us by the results of the survey, one was advanced fishing simulations and user training. So essentially security awareness, uh email filtering uh and gateway protection as the next thing that was top priority for schools. uh cloud security hardening uh specifically for Microsoft
031365 and Google Workspace and then of course vulnerability uh management uh for our school. So those were the four top asks uh that that we we learned from from the survey. Uh and so what are we doing then to to provide these services? So for the this next bienium which we're started on is uh we will be providing cloud email security uh and this will be provided in a collaboration with the UTR sock uh and and tea using a a product that they're currently leveraging. I've been announcing this for a while uh and there has been some hurdles that we had to work through. Uh I think we're finally at the tail end and we should be able to announce this probably uh I'm hopeful got my fingers crossed that we should be able to
032announce the final requirements and the final process next week. Uh so we have a last conversation with Utrock on on schedule for this Friday. Uh and then that should then allow us then to make final decisions as to how we were going to move forward with this. Uh so that we can make it an announcement and then provide that information. We will share this information to with with all the schools uh and it'll be listed on the K12 website uh so that everybody has that handy once once once we learn exactly what this is going to look like. Um we will also be providing um the DI certified security training efficiency simulations. These are in a collaboration with with TASI. So TASIS is also finalizing uh this so that we can have the schools start
033participating and and and getting this service uh for that. The one ask that I have for the schools is that if you participate in the security awareness training that you only request the amount of licenses needed uh for the folks that you plan on uh actually requiring the the the training for or the fishing simulations for what I don't want team is for us to provide funds to services that are not being used by the school um and and so then we can't provide those funds in in other areas where schools are are are needed. So I I ask politely that everybody be responsible for what they request and make sure that what we provide you do use. And as long as it's being used and as as long as it's being helpful to your
034security program, then we support it 100%. Uh but if if if it is not something that you definitely need or or not going to take full advantage of, then I I politely ask that you don't uh light it up for everybody because that extra license cost could could you be the funds for that could be utilized in other areas for the initiative. Um, also the Microsoft 365 and Google Workspace hardening guides have were under development by Tassy. They've given them to me. So now it's on my court. I've not had a chance to fully review them. So it's something that I still owe to Tassy. But we are getting also closer to finalizing what these going to look like. Uh and then this work will be done by the ESC's uh um and possibly even
035the AROCs uh to sort of help the schools uh secure their their their Microsoft 36065 or Google Workspace uh and and make sure that the proper configurations are are enabled uh to to make sure that that that both of these systems uh because they handle a lot of the authentication and and access to to pretty much anything else uh are configured properly. uh and we're the documents that we'll be providing the guidance that will be provided of this is going to be both for the free tiers of of both of these services or the paid tiers. So that we want to make sure that their guidance is not just for those that are able to um have the the higher level uh of of the of these services but also those that are currently only
036on the free versions as well because there's there's room for making sure that we have the proper configuration for for either one of these. Uh and then software, we are looking for a software deployment solution uh to roll out to to help roll out EDR agents. And then of course if you've already got a solution that helps with that. Of course, the limitation won't be on just EDR agents. If the school has needs to to deploy other software in a more efficient manner, then the software obviously would be able to be used with that. Uh this is still a work in progress. Uh as we've been sort of completing the these in sort of in the order listed here. uh and and the software deployment solution is something we're almost uh able to to um
037announce but not just yet but just know that this is also coming. We continue to say that most of these services are first come first served. Unfortunately, we we have limited funds uh to support uh all all this work. Uh, I wish we had unlimited. Uh, if if anybody wins the lottery, uh, and and hits the jackpot big and you're willing to give some of that to us, that'd be awesome. We would put it right into the system. Uh, but for now, uh, we the the initiative currently has $70 million uh, for the whole state to be able to use for different things. And so, we need to be um, wise on how we use the funds and for different areas. And and and we we've been choosing things that we think will be that
038will provide the most impact. So $35 million of that currently is allocated specifically for the EDR uh which is about 65% of that budget. So using rough napkin math that comes out to about 326,000 EDR agents that we could support uh with with that with that amount of money. Uh and so that the graphic there on the side sort of represents our our maximum based on current funds. Uh the last time I showed this we were at 256,000 agents deployed which is 79%. Uh I updated the numbers uh kind of scratched out the the image there. So we are now at 273,000 agents deployed which is 84%. And like I mentioned before we we keep uh having that deployment go higher. So one of the things that we've started to do uh we started in
039February is to communicate out to the schools that we intend on on making sure that the schools deploy to what you actually need and not the maximum that you were allowed to get. because I wanted to remove the misconception that if a school requested a thousand but only needed 300 that the other 700 were sort of reserved for them. That's not the case because TAS only uh responsible for the agents that are actually deployed. But having schools uh sort of hold on to licenses that are not in use makes it difficult for us to plan actual need uh um and and ways that we can support additional schools. So, some of the larger school systems have been asking for us to support them as well uh with this product because it is a great way
040to to to help uh secure your end points. Uh and some of the larger schools just like anything else in the state have budget concerns, right? And so we are trying to give all the folks currently in the program and currently eligible for licenses to to use it up. Uh and then uh starting in April uh anything that we have left over we will open up to additional schools. So, we will always for the schools that we adjust in values to, we will always make them available uh on an add-on request, but once we reach that that high mark, we're going to have to place everybody in a queue uh as we request additional funds. So, we still have space. There's still a lot of agents to deploy before we reach that number, but know
041that we're getting very close uh to that upper limit. So, if you've if you've been sort of on the fence as to whether or not uh you should uh join the program to get this this awesome service, uh I highly recommend that that you do that now. I only make the decision. Now, part of what we're doing, like I said, is is sort of trying to better understand um actual usage uh need versus uh request. So, currently, as you can see here, this graph shows the amount of EDR licenses that have been approved for use uh against what's actually deployed. And as you can see that the amount approved for each school system versus what's actually deployed by each school system, the numbers are extremely low. And what we have not known currently is if
042this is reflective of the fact that schools still have not fully been able to deploy to all systems in scope or that the number that originally was requested was was above what actual need was and so they are already at at at maximum saturation for incope devices. Uh and so I'm hoping that the work that our team has begun to do February and in March sort of helps um paint a better picture and allow us to better understand you know actual need versus was actually requested. Uh so in that effort what the team has been working on is for any of the schools that have been in the program uh for the beginning or since before this year in January uh they've been given 60 days to complete uh deploying their their EDR agents to
043all scope devices. uh on on April 3rd uh we will get a new count of currently deployed systems uh and we will use that amount plus 10% to be the new school's approved amount and we'll communicate that back out to them so that they're aware. Um, an example that I included there was if if if a school system had a thousand agents deployed, uh, and then after receiving the notification, uh, was able to get all the way up to about 450 as of April 2nd, uh, then that would be their their new, uh, actual need number. So then their new approved count would be adjusted from the 10,00 agents down to 495, which would be their 450 deploy plus 10% to allow that that wiggle room as needed. Uh and so as of April 3rd,
044then that school would be 90% deployed, which is the numbers that we want to see. We want to see schools reach 90% deployment. Um at that point, if the schools determined that they needed additional endpoints uh past that, uh then they can always submit an add-on request. Uh and if additional agents are still available, uh then then then they would they would they would be allowed to to um deploy additional agents. uh and they would have the same type of time frame 60 days to to to deploy. Uh the maximum that a school will receive will always remain at 30% of student enrollment uh with a minimum of 30 agents and a maximum of 15,000. Uh and so if if we adjust numbers then you know you still have that maximum allowed amount but we
045just want to remove the misconception that anything you currently have approved uh but not deployed is is not really yours. Um only agents in actual use are the ones that we will continue to to fund for the schools and so any other funds will be used in other areas. Uh so for new folks cuz we have a lot of these uh folks coming in new. So anybody who started the program uh February 1st or afterwards uh they're given 90 days uh to complete deployment. Uh after the 90 days then the same thing applies. So you know we we will adjust the numbers to currently uh deployed uh plus 10% and that'll become the final value of what's approved. And similar to our current customers, any of the new ones, they can still submit an add-on
046request if they determine that above that numbers is is a need uh and and the same um maximum tolerances for uh 30% of student enrollment uh still still apply uh to anybody moving forward. So we have not adjusted these numbers uh for the program uh and and don't intend to at this time. One of the things that I have been asked um is some of the schools are are moving uh to the AROC because the ARSOC some of the AROCs anyways are providing unlimited um agents if you will to include student devices. Uh and so a few schools have asked hey so can I move I'm currently in the MSS program can I move to to an ARSOC because it covers additional devices. Uh and so my only guidance is there is no requirement that
047you get the EDR from uh the MSS program. You're welcome to to do it through an ARSOC, but we we don't we don't guide that. So that communication needs to be between the school system and the ARSOC to see the physibility of of what that's going to wind up looking like. Um and I think I have a slide a little bit later on uh to kind of speak on that. So I'll I'll wait for that. Um what realignment will do uh as as we complete this in April uh this will this I'm hoping that this will encourage school system to deploy to 100% of scope devices. Now we we've have had a few school systems that suffered ransomware incidents that were in the program which obviously raised eyebrows. Uh but then we come to determine
048that the school had suffered an incident because they were not fully deployed yet. Uh and so we want to make sure that schools use the the the um the licenses to the max capacity and and and secure all of their Inscope systems which are all their critical devices. Uh because the program does show that if it is deployed correctly to all devices, it does prevent uh uh ransomware or heavily reduce the the ability for one. I'm not going to say that it's the silver bullet and that it's going to make it 100%. you can't security can never say that something is 100% ransomware proof but it definitely reduces the risk significantly uh for any of the systems that have the EDR deployed to them. Um it will allow us to forecast actual need uh and
049and determine if if and when additional funds are needed. So what we've been told is we need to make sure that we use all the funds. And so this is to help in in that uh and then make it available to other schools uh if if we can determine what is actually needed today by the schools that are already in the program. Uh and again this will allow us to then open it up to maybe the larger schools who have also asked uh to see if if we could include them as well. uh we are trying to use up all the funds allocated to EDR which is currently 35 million uh and that again is is about 326,000 agents um and then after that then no additional agents would be approved however we would then
050be able to seek uh additional funding from the state uh and we could you know we continue to show that hey we we using the money provided we have additional schools we need to show how many schools and what that might look like and have a better understanding of what that needs so again the only way we can do that and make sure that we cover as many of of the school systems in the state is to make sure that these funds are used for what they're intended to otherwise we need to allocate them to other areas. Um and we've got uh at the end of the bienium to to show a better usage of of these funds. Um some schools have asked well what can we cover? So any of your on-prem servers should
051be 100 all 100% of those systems should be covered by your EDR and this is really where you should start. these are the crown jewels uh and have the most access to data and access and you know accounts and everything like that. So I heavily recommend that you secure these first uh and then move on to IT staff and central office staff computers because these are then the folks that have most access to those systems that we just covered in number one or to SIS and in in ERP systems uh to do the the work of of the school that has sensitive information. Uh and then as as as you move down the list then and as licenses allow cover all teacher computers uh because they'd be the next folks and sometimes two and three
052are are similar. There are teachers and there are staff that have dual duties. So some make sure to make to cover that. And then all remaining staff computers. So if you still have licenses uh coverage does include for example any custodial staff uh and and things like that that you would think well why do I need them? they have a computer, they are still a potential weak point and if there's still licenses left over, we want to make sure that the school is 100% covered. So yes, install it on even on those type of machines just to make sure that they're secured as well. And then if you still have licenses left over, any student lab computers that remain on campus can also be covered by by the service because anything that stays on the
053school systems network is what we want to make sure is is covered by EDR as much as possible. Uh so again recommend that you start at one and move down the list. Uh but that you you eat up all the licenses and and especially for one and two that you don't just do partials. Uh we need to make sure that we have complete coverage to make sure that we have the proper coverage needed uh for these important systems. Uh the new cloud email security uh service. So school systems will be required uh to be demi compliant prior to the the service. Uh and so this goes back to the service that we're we're going to leverage the UTROC uh for for email security. So one of our asks to the RSOCS is that the service
054won't be as useful if we don't have the schools uh demar compliant. Uh and so the Utrox said that they would assist the schools uh with this request. And this is an initiative item. Uh it's been there since the beginning. And so we're hoping that this sort of uh um is something that we can increase participation in to making sure that our email domains are are properly protected uh to remove uh spoofing and other issues that that happen if if we don't have this enabled. Uh and so if a school system is already in already complying for this, then you're you're golden. Uh a school system that's currently not there, the ARSOC said that as part of deployment, they will assist assist you to get there. So, it is not a requirement of you requesting
055the service, but it will be a requirement of you continuing the service because it won't be as as as valuable or as secure if you don't have this piece. And so, for all the school systems that do take advantage of the email cloud security service, then just please note that we are planning on making demar compliance a a requirement. Uh the UTROC has also told us that they will provide us aggregate reports on threat threat blocks uh and that they will share common threats with the state. So that's an additional uh area that this helps. So if because oftent times what impacts one school may impact others. Uh and so this information will be provided to TA so that we learn the the how the program is doing. Again we're not interested in individual schools
056but more in a in a sort of statewide level how the software is is securing our schools. Uh and then any specific threats uh especially those that that are hitting multiple schools, we can share them quickly and provide them. for example, the Texas ISOW and other areas so that they can inform the rest of the state and we all can be better uh secured as a whole. So, this this is a great way and and and I'm I'm glad that we're able to partner with with the ARSOC to be able to do this uh because it's definitely going to help improve not only our our schools uh but the rest of the state agencies uh that are that are that where this communication happens and there is a lot of communication on security threats that
057happens internally in the state. Uh so as of now there's been a lot of different uh options to help support school systems in their cyber security uh uh efforts. Uh and so I wanted to kind of show that a lot of schools in the past when I communicated to them with them it was kind of like well we don't have the resources and manpower or in funds to be able to do a lot of these asks from the state. And so what we have been heavily involved in and making sure is that we provide this extra level of support to our school so that they can most of the things through the initiative are are sort of things that have are are no cost to the school and they have a uh configuration requirement that
058does not require them to have to learn anything new. This allows the school systems to then continue with their priority which is you know teaching our school our our students what they need to at school and and concentrate on on providing the IT technologies for that. uh but managed EDR uh assessments uh cloud email security simulations all the all that and and support from from the ESC's makes it so that the schools can further mature the security program uh with with with no additional funds needed uh and and just some support uh to the to the groups the AROCs and the ESC's that are helping uh uh with this um the ARSOC services they provide incident response if you're signed up with an ARSOC uh 24x7 monitoring for both managed EDR and in the cloud
059email security which is coming up soon. They provide tabletop exercises and thread intelligent sharing for the rest of the state. This list of course is not all inclusive but I just wanted to highlight how so far the level of support and help for cyber for our school systems has definitely increased and we continue to do that a as we move forward. So we will have another survey uh at at some point later on uh at as we complete the current bienium but we will again ask how what did we do what did we do right what would we like to to move forward so please keep this in mind is that our goal uh aligned with your goal is to help you to uh secure your your environment uh and and increase your security maturity.
060So, wrapping it up here a little bit. Uh, as we're coming to the end of of our time, uh, want to remind schools that, um, to update ASED, uh, make sure that your technology coordinator and cyber security coordinators are listed in Azte uh, and are current. Uh, if if if, uh, for schools, some of the schools, especially the folks in this audience may be like, I don't even know how to do that. I'm I'm informed that every school system should have a TED administrator uh, that has access to ASED. So find out uh from your leadership who that individual is and have them update whoever your technology coordinator is and your cyber security coordinator. Uh oftent times both the state and the ESC's use the information on this list uh if they don't have it
061to try to find folks especially when a uh incident is reported to us uh by DI or by other folks. Uh and if we don't have that information handy, we we'll look at this place here and if it's not there, then it just makes getting the information to the proper school system delayed. And sometimes, you know, minutes uh lost minutes can can mean the the difference between having been able to stop uh an incident or jump right as it as it actually impacted a school. Um, I also ask that if you don't have current communication with your ESC that you initiate that contact and let them know who your primary and backups are for anything cyber related so that in case there is an incident uh the ESC's are reached out to first typically by
062the state. Uh, and so that if that's the case then that they have the information they need to get information out to you as quickly as possible. Uh again, as I mentioned before, the STS portal access is typically only needed when you need to request services. Uh and so depending on when you first started and and where we are today, that may be access that an previous employee had or the passwords expired or whatever the case may be. If you've lost access to the portal, don't fret. You can always email uh from DI uh and she can help you regain that access. She will ask a couple of questions to make sure that they're authorized. So it's not like she's going to give access to just anybody, but that is the place to start if
063you need to reestablish access to the portal. Uh and of course update all of the above when technology or cyber security creators change because that's important. Uh there's always movement at schools. Uh and so just part of your process should be that once you hire a new or folks move on that that you update these these systems so that we always have proper context. Um, if you can create sort of a uh, you know, [email protected], then that'd be great. This way we have at least that contact information. Uh, and then you can just add as folks come and go, you can add them to that and we always have a shared uh, email that we can use. So that'd be a great way to make sure that we always have uh um, you know, current
064information for any other school system. So look into that too if we don't have that already established. Um all of the information regarding the initiative is always located on the uh website. There's a link to the website. This includes the uh steps to onboard uh and get the services, any updates that are on the program as as they're ready to be communicated out. They are added to the website and then we of course also communicate it out through email and other other means. But it is always on this website. So if you're just kind of wondering where we're at, you can always look at the website for updates. There is a frequently asked questions section near the bottom. Uh and there is a handy link uh to sign up for this uh cyber security creative
065forum meetings. Uh in case you you are not uh or if you get somebody new, you can always point them to go sign up for for the CCFs uh through the site. Uh if you have any questions uh and you need some responses from the team, they can all be reached through the ktocyber.ex.gov email and we'll definitely respond to as as we receive and and there's been a lot of communication from the school as they asked. So thank you. we are we're here to help and assist in anything. So, if there's anything that you have questions on, please email the team and we will respond to you as as quickly as we can. Um, our next CCF uh will be March 25th. Uh, and the link, if you're not currently signed up for there, even
066though you're here, but maybe you're sharing with somebody else, uh, there's a link for you to to sign up. I did want to because I I thought I had it and and I didn't. I mentioned earlier the the move from from the MSS program to the ARSOC. So if a school is considering moving uh services from from an MSS program through DI to an ARSOC, what what I was trying to say is that that communication should be between the school and the ARSOC. TA has has no um uh ability to say yes or no, right? We all we ask is that you have EDR in place uh and take advantage of some of these services. if there is an ARSOC uh currently in your area that that you leverage them uh uh because they are
067providing some some great services. Uh but anything that you decide to do uh between the school system and the ARSOC, you need to communicate that specifically ARSOC and get their approval and their guidance uh especially if you're moving from the MSS program. From our perspective, if you decide to move and that is approved by the ARSOC uh and they provide you with the guidance, the only thing that we will require is that you submit a cancellation notice for the service through MSS so that we can offboard you uh uh from the MSS program as you transition directly into the ARSOC. All the AROCS and the DI program are already aware of this. So none of this will be new to them. Uh so so just note that we've had conversations because some schools have taken
068advantage of this as ARSOCs have become more prevalent in their area. they moved uh onto there to to get these services. Um the other the other question that we've often received has been around whether or not there is a limit uh of or not a limit I guess a an expectation of what ARSOC a school can use. And so again uh I so far the the the communication that I've received from the different AROCs is that no uh some of the services offered by one ARSOC uh may not be offered today by another ARSOC and so schools might want to leverage that. Again, that's communication between you and the AROC. They determine what they can and cannot do uh based on the amount of customers that they already have because remember that the AROC's customers
069are not just K12, but it also includes uh the local municipalities in their area. So, they've got a bigger customer base. Uh and so, they obviously are going to be busy as as as they try to reach out to the folks in their area. What I do recommend though is if you're considering services through uh uh an ARSOC uh is that you maybe choose one that's close to you. Uh because some of the services like tabletop exercises and things like that um they they're going to be provided um you know you you'll be able to attend them more easily if it's a local AROC versus one that's you know across the state. There might be some services that another ARSOC has that would not require you to be there you know in you know live
070and in color. uh and you want to take advantage of those services like for example the the email stuff that we'll be providing soon. Uh so those type of things that's communication uh specific with the AROC specifically for the email service that will be handled through tea uh in in our cordation with AROC. So you're not limited to having to be um communicating with an AROC but any services you receive from an AROC including this email service that we're going to stand up and and communicate soon will require an ILC. that ILOC is per RS sock. So far, uh there's been some some I guess some miscommunication regarding if if there's one sort of global ILC that'll uh fit all the services and unfortunately not because a um is a document that has legal uh
071requirements and so each entity is required to have signed one with them. there can't be currently uh one that's sort of global for for any of the different services whether it be the MSS program through SIC and DI or the AROCS. So just note that any any service that you're going to receive from an ARSOC requires you to have an ILC with that AROC. What does that look like? Again, each ARSOC is different. So again, communication that that that should happen between the school system and the ARSOC to determine what it is that they require for onboarding and what options that the schools have. Uh, and it's a great place to ask, hey, so I I'm furthest away from you and are these services we can take advantage of? You know, start that conversation with
072the ARSOC and see how they're able to assist. Um, any other questions or or things like that? We are here to assist. Again, the email for um any of this is the K12 cyber.ex.gov. Uh if you have questions regarding the ARSOC services or the initiative or whatever and don't know where to start, you can always ask us and we'll we'll get these to the right place uh and and reply to you as as soon as we can. Uh thank you. Uh I hope to see you at the uh at the next uh CCF in in March. Uh and again as as we solidify the the new initiatives which again for the email service where we're closed, I think we'll be able to announce that next week. We will let everybody know both on the K12
073website and we'll be sending out email communication to everybody. So, have a great rest of your day and and thank you for attending.