001Good morning everyone. Um, we're gonna let a couple more people join. Numbers are increasing quite a bit here. So, thank you all for joining us today. Uh, I hope everyone's been able to stay warm in this chilly weather. Uh, before we get started today, I would like to go over a few housekeeping items. We will be recording the presentation today and we'll not only send it out to those who registered but also to um we'll also post a link on to it on our K12 website. We ask that you do not use AI noteakers during this presentation. Our team is going to be working to remove those that we see. And if you have any questions throughout the presentation today, we welcome you to place them in the Q&A. We have the chat disabled. Uh,
002so make sure you put them in the Q&A and should time allow after the presentation, we will work to answer any questions that you have. And if we're not able to get to those questions, please don't worry. We will be compiling them and uh send out the responses um in about a week or so. We'll also post those to our website as well. And with that, I'd like to introduce our host today, Daniel Ramirez. Daniel is TEA's Chief Information Security Officer. We are beyond thrilled to have Daniel on the team. He's been with us since August and he's hit the ground running. Many of you may know Daniel. Um he joins us from region one and he brings with him a wealth of experience in cyber security. And with his combined knowledge of K12 in
003Texas, we are excited to have him on board and hel have him help uh advance this wonderful and beneficial initiative. So with that, I'm going to turn it over to you, Daniel. Uh good morning everybody. Uh happy to be here in this cold morning. Um I was telling the team that we would probably have uh a lot of attendees today because a lot of schools are closed and I figured what else are you going to do? Let's attend a cyber security um webinar and and learn some stuff at the very least from our from the comforts of our warm home maybe. Um so a little bit about me. I am Daniel Ramirez uh the chief information security officer here for TEA. I started with TEA on August 1st of just last year. Uh I've been
004working in IT for 28 years. Um I worked uh in the IT department at Texas&M and Kingsville, then the University of Texas Rio Valley. Uh I did the information security officer as region one education service center for those from the ESC1. Hello. Um and 13 of the 28 years have been in information security. Uh I also wanted to take a minute uh to introduce the rest of the team that works on the K12 initiative uh and helps move this forward for all the schools. Uh so we have Julia who introduced me. Uh she is the executive director in IT administration and compliance. We also have uh Laura Coffer who is the DCS contract manager and K12 cyber security project lead. Uh we have Susan Bane uh in cyber security governance risk and compliance analyst. uh
005and Desiree Ado was not able to be with us today but she is a security governance risk complian analyst as well. So this team of great folks is uh how we run the entire K12 initiative uh everything from planning to moving things forwards to communications to planning and meetings and having these fun webinars all of that uh is not something that one person can do alone. So I am very grateful for the team. So let's get going. Uh, as you guys know, so K12 in continues to be a a large vector for threat actors um looking for easy payouts uh because you know our schools for the most part are responsible for education uh and so sometimes security initiatives uh are a little harder to to to secure especially for our smaller schools. Uh and
006the threat actors know this. K12 remains a top target. Uh 82% reporting that K12 schools experienced cyber threat impacts. Uh nearly 14,000 security events have been observed across the US. Um more than 9,300 confirmed cyber incidents occurred. Uh studies found that criminals are shifting their focus, increasing attacks on the human element. Fishing and social engineering uh continue to rise at least 45% rather than exploiting technical weaknesses. we're getting better at uh securing our infrastructure and so they're looking for uh easier targets uh that allow them through fancy firewalls and and other software. Um targeting critical academic periods such as exam weeks to maximize disruption. Uh we've seen that in the past as well. Uh and exploiting staff and student reliance on on digital tools. All this information, excuse me, came from the Center for Internet
007Security. Ransomware attacks in the education sector are up 23% year after year according to a report from compar a cyber security and online privacy product review website. Uh 82% of K12 schools in the US experienced a cyber incident between July 2023 and December 2024. Uh according to the March 2025 report from the nonprofit center for information for internet security, I'm sorry, 141 Texas school systems have reported cyber incidents to DI uh between July 2023 and December 2024. Um we didn't capture the stats for this past year. Uh but there uh were also obviously some in there as well. So the trend has not stopped. For school systems, threat actors determine if a school has cyber insurance and then demand a ransom based on the coverage amount. A lot of the information that we are often
008asked is what's the average cost of a cyber security incident? Uh and that is a big it depends uh often it starts with the you know depending on on the what happens right if it's a ransomware event and one that the school wasn't prepared for it usually it's going to start at the maximum coverage because that is what the threat actor is going to go after. So that doesn't come out of necessarily the pocket of the school. Uh but it starts at about half a mill uh and then the school needs to then cover other um recovery efforts. uh staff working, you know, long hours uh and things like that trying to recover systems, getting back databases, sometimes purchasing new hardware, uh and you know, all the bad press that that comes along with it.
009So, it's hard to put a price tag on it. Uh but it's not cheap once once a school suffers a uh ransomware incident. The recovery can be anywhere between half a million and 2 million depending on the size of the organization, the damage done and the recovery organization that is hired which a note from Gartner. Uh and the average cost is approximately 1.5 million per incident. Uh soup to nuts including the ransom way the the ransom uh payoff if there is one. Uh so that's the average as you can see it's pretty high. Uh downtime costs on average the education sector lost 12.6 six school days in 2023 due to ransomware attacks. And based on the overall ransomware recovery cost reported across 26 educational institutions between 2018 2024, Compare estimates the average cost of downtime
010to $5485 5,400 5,00048 and185 per day which is quite a chunk of change um depending on how long of school. And again these are averages and they could be completely on on on right field and expensive. It just depends. Sometimes the only incidents that we are aware of are the high impact ones. For really large cool systems, it had a devastating attack and so obviously those are going to be more expensive. Sometimes the smaller uh ones don't make it to the news um with as much detail and so it's harder to to create an average uh when we don't know the amounts. Um so just keep that in cost. But almost always, you can bet that when all is said and done, a ransomware incident at a school will probably have an average of about
011a million dollars, including the ransomware payoff if there is one. So as we listened to this, you know, u about three years ago, the TA was tasked with how do we support the schools uh to make sure that they can be better prepared and better protected against these types of increased uh cyber attacks especially from ransomware which back then was a huge issue and continues to be so today. So today there is unprecedented support uh I think that has grown at least in Texas to help our schools uh with different uh cyber security support. Uh I've always told the schools you don't have to do it alone. Um sometimes our schools are a oneman army when it comes to it uh and even smaller when it comes to cyber related uh tasks. Uh but there's
012a lot of support now uh that has stood up in in the last couple years. So, TEA has the K12 cyber security initiative which is a big topic that we're going to discuss today. Uh we have uh communicated and continue to communicate with the 20 education service centers to make sure that uh they are also able to assist the schools with cyber security initiatives and cyber security resources uh depending on on the school's needs. Uh um the state has stood up uh three regional security operations centers otherwise known as ARSOCS and we'll talk a little bit about them. Uh and of course now there's the Texas Cyber Command uh and the Texas Department of Information Resources which will be moving under Texas Cyber Command and so that is the states um trying to get more
013organized and and coordinate responses for not just K12 but for the whole state. Uh and so I think this will be very beneficial moving forward uh as as we we we grow in strength uh on the resources available for for for the entire state to be able to you know uh combat ransomware and respond to it when when it hits uh uh one of the state uh customers whether it be K12 or municipalities or things like that. uh we the state is positioned itself to be better able to support uh that that entire critical infrastructure and then of course we always try to build the community of cyber uh professionals that are employed within our school systems. A lot of the school systems do have very talented folks. A lot of them are willing to
014communicate. Um uh you just have to ask, hey, you know, if you're working on something and you need a little assistance, maybe your neighbor uh uh c uh your neighbor school system is doing some of the similar work, right? And so good to reach out to them and and you know see see what they're working on. And then we always of course have these type of learning uh events where we try to have communications with the school. The ESC's are always putting together uh webinars and and different uh conferences to help support the schools well in their in their region. So there is a lot of uh information that is local. You don't have to travel very far for it. Uh and we continue to grow the community of cyber professionals across the entire state.
015So, a little bit about the ARS. There are currently three funded Texas ARSOCs. Uh, the pilot ARS in Angelo State University uh started the the program and showed the state, you know, the value of an ARSOC. Uh, and then shortly after that, the University of Texas Valley uh started up theirs and the University of Texas Austin uh is now fully established as an ARSOC and currently these are the only three ARS. Um the state hopes that additionals additional AROCs come online. Uh right now the state's concentration is on completing the standup of the Texas Cyber Command. Uh but hopefully after that uh opportunities will made available for additional AROCs to open up across the state cuz right now I know that communications with these three AROCs they have been very busy which is a good
016thing. They have a lot of customers that they've been helping. The AROC customers are not uh only K12. They also help a lot of state governmental resources like your municipality, sheriff's office, the counties, uh things like that. And so it's not just K12. Some of the nocost ARSOC services available to all of their customers, including K12, of course, our managed endpoint detection and response or EDR, uh real-time network security monitoring, alerts and guidance, uh for defeating security threats, uh remote and on-site cyber incident responders. So they will help if your school or your or one of their their customers I should say uh suffers a security incident they they can help uh in in the incident response. Um they they will help guide uh implementing cyber policies and plans. They provide education educational and awareness
017services that they currently train university students in a live security operation center. So, one of the main reasons of an ARSOC is to allow students at a university uh to get some hands-on training before they actually graduate. Uh and so their their students uh are vetted, put through some training and then added to a through the through the ars uh to get on the on the job training um helping the schools uh helping their c the aroc customers uh so that when they finally graduate they graduate with some actual real world experience um and can hit the ground running uh when they're employed um you know after after graduation. The ARSOC also provides a lot of community outreach and cyber security training. So they go even above and beyond just their customers. They do offer
018also different community outreach programs to the area that they're in to help. I know that uh Angelo State University said that they do uh community for for the elderly where they kind of have a thing where they go over just some basic, you know, how to stay safe online uh when web browsing and and email and things like that which is very beneficial. Um, so, uh, this some of the great work that they do there. Uh, customers, of course, like I said, include local government entities such as cities, counties, and of course, Texas school systems. So, let's talk a little bit about the K12 cyber security initiative. Uh, a lot of the folks that we invited to uh to this uh webinar said that this is the first uh they're hearing about it uh and
019they were interested in more information. uh others that were already aware of it are interested in what we're also going to cover which is the new uh initiatives that we've added uh for this next bianium which we'll talk about here in a little bit. So in response to increasing threat of ransomware and other malicious cyber activity targeting school systems across Texas, the Texas Education Agency launched the K12 cyber security initiative in 2023. The initiative was made possible through funding approved by the 88th Texas legislature uh which supported TA's request for dedicated cyber security resources to help school systems strengthen their defenses and response to emerging cyber risks. The goal of the initiative is to deliver immediate practical solutions to help school systems defend against major cyber incidents such as ransomware attacks. Priority is given to
020rural school systems and cyber security practitioners are available through regional education service centers to support the implementation of cyber security controls aligned within the scope of this initiative. So in a nutshell uh this is what the cyber security uh initiative tries to cover for all of the 1200 plus schools uh here in in the state of Texas. So as of this new bienium, the 89th Texas legislature approved an additional 42 million in funding uh for the f for the fiscal year 2627 benium which runs from September 2025 through August 2027 ensuring the continual and expansion of this critical initiative. The remaining funds that were not used uh in the first bianium have also been transferred forward to support ongoing efforts uh and that total to approximately 28 million. So, in total, uh, the program currently
021has $70 million, uh, for fiscal years 26 and 27, which is what we're working on today. Where do these funds go? Um, so the the purpose of the program was to provide fully funded services at no cost to the school systems. That was sort of the mantra that we travel on. what can we provide to the schools to get them better prepared, to get them better protected and have it be uh as zero cost to them and requiring as little resources as possible to to ensure that they can put them in place. Uh so we the program provides managed endpoint detection and response. Uh the requirement uh for a school system currently is if you have a student enrollment of 50,000 or less, it allows licenses up to 30% of your student enrollment or a
022minimum 30 30 license count. Uh the school systems may choose uh between managed EDR vendors, CrowdStrike or Sentinel 1. And there is a 24 by7 security operations team that monitors all of the agents that are deployed under the program for the schools. So even when the schools goes on breaks or things like that, they are constantly being monitored. Uh and the security operations center can also take action on any threats that a school has. These are all part of the program and all communication that happens when a when a when a school is onboarded uh to make decisions on to how uh the sock the sock team should react to any threats that a school is facing whether it's call somebody at 3 in the morning or you know shut down the device on their
023behalf at that time all of that is configurable uh as part of the program. Uh the other uh thing that is available currently is the Texas cyber security framework assessment. It is on a first come first- serve for any school system. So there's no limit on enrollment size. School systems may choose between a small, medium or large assessments. Uh and the difference uh in the assessments is not for the school size but the amount of controls that are reviewed. Um the one of the things I like to tell the schools is that the assessment is a tool. It's meant to be something that the school system and uh the um assessor uh which in this case is SIC uh goes and and performs on behalf of the school. None of the information that comes out
024of the assessment is shared with the state or with TEA. The only thing that TA receives is an aggregate score for all schools. So we don't necessarily know the score of any one school but just how all the schools that are that have had an assessment done how all of them are doing in the program. Um, so I highly recommend schools if if you're going to go through uh the work of the assessment uh because it does take some dedication uh and a few weeks of work, but you are you are guided by the assessor uh from beginning to end. Um that if you're going to take the time to do it, might as well do the large uh which covers all the framework controls. Uh if one framework control does not apply to you,
025then the assessor will tell you uh and you just simply sort of opt out of that one. uh as opposed to doing the small. Um and you know there's only there's only about a maybe 12 or 14 control difference between small and large. Uh and I I think in my opinion it's best to just have it all uh and work on that. The tool the the report that comes afterward is invaluable to a school system to be able to then have that communication with leadership uh and sort of show you know the areas of strength in the school's uh maturity of the of their security program and the areas of weakness that that should be worked on. uh and then the IT uh and the security office for schools can then work with the school
026leadership to sort of decide you know what are the areas that they should be focused on next. So it's a great tool. Uh and I just want to iterate that the the details of the scoring or whatever is not something that that comes back to the state. We're currently not interested in the specifics. We want to have a school understand where their posture is and what areas they need to to work on to to get to a better place. uh know that the assessment can be scheduled uh currently now uh between now and August of 2027th. So if you're not ready today uh but you you you can choose you know maybe you want to work on this on you know July of of this year or maybe July of next year you can schedule
027so that you're placed in the queue in an available slot and you know when it's coming. Uh so it doesn't have to be that you request it you know when you're ready. you can sort of plan for it and and request it ahead of time and get ahead because as schools are on boarded on whatever there is a a queue that that starts being created uh to make sure that all the schools can be taken care of that that have already requested the service and we did have also uh network retention and response or NDR uh there are nine pilot schools currently in that the pilot program continues to remain closed as we communicate to see uh with different partners how uh we might uh do the NDR program a little different. Uh at the
028moment we are trying to leverage the AROCS uh to see because a lot of the ARS do have an NDR program and we're trying to see if that would be beneficial to move uh the pilot schools into uh and then potentially open it for for additional schools as well. The current NDR vendor for the pilot schools uh is Verra. So um the initial initiatives uh when the program first got set up will continue. Uh so these goals what were were carried forward for this next bienium and these are implementing fully managed endpoint detection and response on school system servers and applicable staff devices. The implementation of multiffactor authentication for all staff email systems uh and ensure demar compliance to enhance uh protection against fishing and spoofing. uh the restriction of local administrator access to minimize
029the risk of un unauthorized system changes uh and of course to do a Texas cyber security framework assessment to get a baseline of cyber security program and action plans uh for improving maturity and then of course we are still like I said trying to see how we can expand the NDR program currently the the nine pilot schools are the only ones that are in the program uh at this time and of course TA uh TA's funded grant through I'm sorry DA funded a grant uh with uh TASI which is the technology alliance for statewide initiatives and this helps pay for cyber security staff at every education service center to assist with these goals. So we wanted to make sure that all of the ESC's had uh you know cyber security staff that could help with
030these initiatives and any new ones uh that we move for forward with. So if you are a school system and you've not communicated with your ESC, I highly encourage you to get to know your ESC uh and see what services are available for them. And those services specifically for this K12 cyber security initiative uh are at no cost to you. So assistance with deploying endpoints, configuration for MFA and for demark and things like that. These are services that the ESC can provide to any of the school systems uh through their region through their service center at no cost. How do you start in the program? Uh so just in a high level, I kind of wanted to review uh how easy it is to get into the program. So it starts by a school system
031completing the new customer form. Uh and the new customer form is sent to DIR uh for review. There are no signatures required on the new customer form. This is important because the only thing that the new customer form captures is the interest of the school uh to to start their journey uh to be enrolled into the service. Uh the new customer form is going to ask who the primary contact for the services will be, who the financial person at the school system is uh and who is the um person that will sign uh the interlocal agreement uh once it's sent by DI for the school. That's all the new customer form uh puts in place. Uh so no signatures because I had a few folks say, "Hey, where do we sign?" Uh and there aren't
032there aren't any signatures. The new customer form is just, "Hey, this is I want to start the program. Send me the documentation and these are the folks that that will have signatures on it." Uh and then the receives the new customer form and sends the school system the interlocal contract. Uh the school system needs to review, complete, and approve and sign the ILC. often the IOC does require superintendent signature. Uh it can also require uh review by an approval from the the school board. So the interlocal uh uh contract um is the thing that sort of places the school uh with permission to be able to request the services. One of the items on the ILC is an area that says, "How much uh is the school a able to spend for this program?" Which
033raises a lot of questions, especially from the school board uh when they're like, "I thought this was free. Why why are we being asked what's the maximum spend?" That's because the has other services in the uh MSS program, not just the EDR and the assessments. If a school wants to take advantage of some of the other services there, uh it would be out of out of their pocket. Uh and so that form would allow you to request some of these other services there. There's no uh requirement to take advantage of them. And and if the school board feels more comfortable, a school system can place a zero on that field, meaning that they're are not authorized under this to uh have any charges against it and that um they're only interested in the the free
034services through the K12 initiative, and that's perfectly fine. The school system then sends the signed IOC to D for processing. Once DR reviews it to make sure that all signatures and everything's in place, uh the DIR will then uh give access to one of the contacts on the new customer form for access to the share technology services portal. Um and this is at what point that the school is ready to then request services. Up to this step, there are no requirements uh for a school system to actually ask for any services. It just means the school is ready for to request them when they're when they feel they're ready. So, I have been recommending to all school systems that they complete this because there is some paperwork involved. There is some review with school boards
035and other stuff. uh all this red tape uh can delay uh if it comes to the point where the school requires a service and up to step five even if you get all the way down to here there is no commitment to actually request anything but a school is ready for when they need it. Why is that important? Because we have had school systems who had done this process uh and had not requested any services yet. Uh they were the unfortunate victims of ransomware. Uh but because they were already in the program and had access to the portal, they were able to quickly request EDR agents uh and they were fasttracked into the program and that helped in their incident response. Had they not been in the program yet and had not completed the ILC,
036the state would not have been able to do much until that paperwork was out of the way, which would have caused maybe emergency meetings of the school board or things like that to get this fasttrack through. Um, and so I kind of been recommending to all school systems that you get the ILC process done and completed all the way to your portal access. Uh, and if you're not ready for any of the services today, that's fine. At least you're ready for whenever you're ready to to request them, and there's no commitment. Uh, currently the school system requests uh, managed security services via the SCS portal, and these include EDR or the TCF assessment at this time. So, I wanted to go over a little bit of what the ESC can help each of the school
037systems in the region. So, the education service center has had uh guidance and training on the IOC and STS onboarding assistance. So if you're stuck with the process uh and need some help, you know, the ESC is able to guide you uh to complete the process, including communicating uh with with DI if you lose access to the portal uh or are asking on the status of the ILC. TEA also has eyes on that as well. Uh and so together, you know, they're they're able to provide your your onboarding uh and access to the the STS portal assistance so that it moves smoothly. uh they can help with EDR agent deployment. So if you need help deploying agents to all of the devices in scope, uh the ESC is able to provide that assistance. You just
038need to request it for them and and get into uh their their uh their queue, whatever that might be. Uh they can assist with email domain security, which is setting up your SPF, DKIM, and demark. Um that is just mostly configuration. There's no cost associated uh with doing that for the school. Uh it's just some DNS settings for the most part and a couple of settings on your uh email service. Um multiffactor authentication on all employee email accounts whether that's Microsoft 365 or Google Workspace. Uh most of that is just employee awareness making employees understand what exactly is MFA that what the differences are going to be its benefit. Then there's some configuration that has to be done. And again, these are things that a school can request uh at no cost for the configuration
039itself. Uh and of course for the support from from from the ESC. Um both Microsoft 365 and Google Workspace on their free tiers include MFA. So you don't even have to have the higher tiered options in those two if you've got just the the basic. Uh it does include MFA for for all your uh email accounts. And then of course restricting local admin privileges. Uh this is an important thing to do because the more uh staff have access as admins on systems then the higher likelihood of somebody accidentally clicking on something or installing something uh and and compromising a host which is what we try to avoid. Uh so most of this again from the ESP's perspective is just some employee awareness that they can provide to all your staff. There is some configuration and
040again there is no cost to the school to be able to do this. just a little bit of working configuration on their part and the ESC is is more than willing and ready to assist uh when a school is ready to to take advantage of these. So little bit of review of how we've how the program has been doing uh in the last 3 years. So school systems that have on boarded with DI there are 500 plus school systems that have signed the DI in interlocal agreement form. There are a little bit over,200 schools in Texas. So, we're not at the halfway mark yet, and I want to see uh like I've recommended, the more schools sign the ILC and be ready to request services uh in the future, even if they're not ready to
041ask for them today. There's no commitment uh and no reason why we can't get the schools at least ready uh for in case something happens or there is an immediate need. Also, most of our services uh wind up being first come, first serve. We don't unfortunately have an unlimited amount of funds. Uh and so when we finally release a service that is of interest to the school, those schools that are already in the IOC and have completed that step will be the first that'll be able to request them. Uh and we're going to sort of it's always going to be, you know, as as the requests come in, we'll process them uh until funds run out. Endpoint detection and response or EDR, there are currently 362 school systems that have signed up for EDR. Uh
042this includes the installation of 258,000 endpoints statewide. There have been 46,000 attacks that are blocked uh and 16,000 plus ransomware threats neutralized. So the EDR program has been extremely successful for all the schools in the program. Uh we continue to get reports of schools have thwarted uh you know some some issues thanks to the EDR. Uh and so it continues to be very valuable to the schools. uh and we want to continue the schools to request these services and deploy the endpoints and we'll talk about that a little later. Uh for the Texas cyber security framework assessments uh as of the creation of this slide there were 55 schools that have been signed up 45 had completed the assessments uh and the individual results from the assessments are kept confidential. applicants. It's just between the
043school system and SIC. Uh all that that the state gets are aggregated results for the entire set of the uh well currently 45 schools and soon to be 55 once once they complete their assessments. And of course the network retention and response we have nine schools that implemented the NDR um and it's currently close to any any other schools. Uh but these nine schools uh have been enjoying the benefits of NDR while they've been in the pilot program. And if you speak to any one of them, if you're aware of any of them, they will they'll tell you how highly they like the NDR program. Uh unfortunately, it's cost prohibitive uh in its current form for us to be able to open it to additional schools. So, this is why we're looking for alternative ways
044to do so. Uh the TCF assessments, so the third party assessment involving the 45 school systems reveal low scores in the cyber security program maturity. So on the Texas cyber security frameworks five-point scale uh the participating school system averaged about 1.08 which is far below the recommended minimum of three or three and a half. Uh and these of course are alarmingly highlight the urgent need uh for more assistance uh and resources to strengthen cyber security across the Texas school systems which is why this program continues to be valuable to all the schools as we begin to help the schools across the state mature the security program uh and and be at a better place and more resilient uh in case of an incident because nowadays we don't say we put enough security and and tools
045in place to be able to prevent uh an incident. Although that is the the main thing that we obviously try to do, but we also need to be ready for the unlikely or actually highly likely uh on today's times where an incident might happen to a school and we need to be able to recover from it uh as quickly as possible. So um these are the kind of information that we get from the schools that participate uh on the assessments. It's just an aggregate. So you can see here that across the schools uh that did this uh we have uh these scores um based on the size of the school uh that blue bar there is a recommended minimum and and we are quite a ways below that. Uh and so as the program begins
046to mature uh and the schools are told what they need to work on. Uh I am interested in the schools that will do reassessments uh maybe in this bienium uh to see how their scores improve. And that's the whole point of the program is to get better, understand where the weaknesses are and what needs to be done so that we can get to a more mature stance. We uh send out a u cyber security survey uh to see how the program was doing. Uh back in September 29th uh the program I mean the survey sorry I'm sorry closed on October 10th. Uh the survey was intended to assess the impact of the K12 initiative from September 2023 through August 2025. Uh identify roadblocks to participation and gather input on what cyber security services and supports
047would be most helpful uh in the next bianium which is what we're in today. Right? So it was invaluable for us to get responses from the schools to determine how the program did in its first iteration. you know, how we could improve it and what additional services or initiatives the schools wanted us to concentrate on and provide to help them. We had a 70% survey participation uh which is awesome numbers. I wish it would have been 100 uh but probably a huge ask. Uh but 70% of all the school systems in Texas did respond to the survey uh leaving only uh 30% out. Uh, one of the things I was asked was, you know, how how did this compare our small schools to our big schools and participation? And so, we did break it up
048by school size as well. And even across the different school sizes, uh, participation was pretty much at 70%. As you can see here, um, so this told us that the responses that we received is a good, uh, feedback on the status of the program and a good, uh, interpretation of what schools need or want next for us to concentrate. uh because it was feedback that we received from 70% of the schools in the state. So in the parts of the survey that we asked what cyber security issues or services should be prioritized in the next phase of the initiative uh there were quite a few uh the top four uh that were selected by the 70% of schools was advanced fisher simulation and user training by 333 schools uh email filtering gateway protection by 311
049schools and then cloud security hardening for Microsoft 365 and or Google workspace uh 200 194 schools requested that as their main priority and of course vulnerability management uh 288 schools. So these were the top needs identified by the schools uh on what we needed to add uh to the initiative uh to further increase their their security maturity. So time for updates. So how will the initiative change uh in this new bienium? So at the request of the schools, we are partnering with uh the UTROCK uh to get cloud email security uh established for all of our schools uh that that that choose to do it through the initiative. So this is a great opportunity and collaboration uh with the ARSOC on a service that they're already rolling out to their customers. Uh and so we've
050had communications with the AROC on how we could leverage this uh as part of the K12 initiative. Uh and we're pretty much done with all the red tape and paperwork. Uh and we will be announcing this pretty soon. Uh and allow schools to start requesting uh this service. Just like any of our other services, this will be on a first come first-s serve basis. Uh the AROC says they are ready and continue to prepare uh for the increased uh requests that this will probably uh be. Uh but if you're interested in uh cloud email security um at no cost uh then again if you don't have an IOC in place another reason to get that out of the way uh because this service will be coming uh soon uh and will be open for requests
051you know probably in the next month is what we're shooting for but we'll see um DR certified security awareness training and fishing simulations uh are are being going to be provided in collaboration with Tassy uh so they currently have a product already uh in that they leverage with the schools uh and so we are in communication with Tassy and how again we could provide that same service to all of the schools uh they requested through the initiative uh Microsoft 365 and Google Workspace hardening guides are under development by Tassy uh they've been tasked with creating uh guides that will help the schools and they'll be sort of multiple flavors of of the hardening guides. one for the schools that have only the uh free tiers of service uh so that we can make sure that
052those are specific to just the standard services that are provided either by Microsoft 365 or Google Workspace. Uh and then for some of the schools that have some of the higher tiers uh that there's some additional guidance and some additional capabilities that we also reflect those in the Harden guides. So the guides will not be a one-sizefits-all but there will be a guide for whatever size you are right. uh and then of course these guides will be provided to to the schools and to the ESC's and the schools can request assistance uh on hardening your your Microsoft 365 group workspace through through the ESC moving forward. Uh and then we are also uh looking for a software development solution to be rolled out specifically to help with the deployment of EDR agents. Uh but it's
053not going to be limited to just that. uh other software. The the solution can be used to to to deploy other software to allow the schools an easier time of being able to deploy software across uh their infrastructure into all their computers. Uh so that especially for for some of the larger schools that have multiple campuses, it's kind of hard to have staff go back and forth. And so we're hoping that this solution helps to make it easier for the roll out of EDR agents, but then of course, you know, then any other software that the school needs to deploy, um they can do that as well. And so this is also u being provided in collaboration with TSI uh and they are currently working on on setting this up. So these four things are
054what we are going to add to the initiative next. That's not the end. Uh but these are currently already in the pipeline with the cloud email security being the first one that'll come out here soon. Uh followed almost right behind uh with the security awareness training and the fishing simulations uh as well. So those are are next. Excuse me. EDR uh has always been continues to be first come first serve and I wanted to kind of highlight a little bit of what that means. So of the monies that are earmarked yeartoear uh for the initiative um or sorry banium to bianium not year to year 35 million of that is set aside specifically for EDR. So 65% of the K12 cyber security initiative budget is set aside specifically for EDR. One of the things when
055the program first got started, we had schools ask, hey, you know, how long are we going to have the software? If if we roll it out today, is it still going to be here next year? We're going to have to take it off. Uh and so our answer to to that now is that as long as EDR continues to be valuable to the schools, we are positioned to continue to provide the funding for this year after year for those schools that are in the initiative. So we are going to make sure that EDR doesn't go anywhere. We're not going to yank it from from under you or whatever. However, we we don't have a limited funds. So, we've done some basic napkin math uh and we sort of uh have determined that 326,000 EDR agents
056is the most that we would be able to provide uh the school with current funding. Once we reach that mark, then any other schools that requested uh agents uh would be placed in a queue as we scramble to find additional funding from the state. And until that funding is approved, we would not uh unfortunately be able to allow any more schools to request agents. That would be a good problem to have, not a bad one, because the state wants to know that these services are helping the schools um and that the money is being used to support our schools. And we can't show that if we have money left on the table year after year. We are currently at 256,000 agents deployed, which is 79% of the 326 that we've determined that we can use.
057So, we're close to that top mark. We still have some some room or whatever. And operator standing by to take your request if you want to. Uh one of the issues and one of the miscommunications that I want to avoid uh misunderstandings if you will not miscommunications are that currently for the school systems in the program they have requested a total of 433,000 agents which is actually 133% of the 326. And so we wanted to remove the misconception that if a school requested 1,000 agents today but had only deployed 300 that the 700 that are still currently approved for them are being reserved for them. That's not the case because EDR is a first come first- serve basis and we want to remove that misconception uh that just because you have not deployed all your
058ranges that they're still waiting for you. So, we're going to change the program a little bit uh to sort of help in that uh and make sure that we can make uh additional uh things uh available for our schools. And let me explain what that means. So, currently EDR approved versus deployed. As you can see here, there are more EDR agents approved per school than the schools have deployed. We want to be in the green and blue areas where you're at pretty much a 90 or 100% deployment or at the worst 80 to 90%. But as you can see there, that's not where most of our schools are. Our schools are pretty much splattered across being only 60 80% deployed or 40 to 60% deployed or 20 to 40% deployed. Some of the ones in
059the red are could be new schools. Uh but together uh we we have a lot in the not fully deployed area. Of to me of special concern are those that are in the uh 20 to 40% which is 17 70% of our schools or the 46% which are 18% of our schools because some of them have been there for a long time. And that asks are they there because they have not had a chance to deploy their agents or are they there because that's all they need and we've just not communicated to determine if if you know which is it. is that you're fully covered and are and and are good and don't need the extra or you've just not had an opportunity to deploy because you need further assistance. And so part of part
060of our next uh slide I'm going to show here is sort of that we can better understand uh what what these numbers actually mean. So um I' I've worked with a team uh and and I want us to do a little bit of realignment uh for those that are already approved. So, if your EDR request was approved prior to January of this year, uh then you will have 60 days starting February the 1st of 2026 to complete deployment, uh on April 3rd, the approved count will be adjusted to the current deployment number plus 10% to give you a little bit of room. So, as an example, let's say that uh Acme ISD is approved for a thousand agents. Um, and they work after this announcement. Uh, I'm sorry, and they have 350 deployed as of
061as of right now. So, that means they're only at about 35% deployment. Currently, we don't know if that's all they actually need or that's all they've been able to deploy. So, after this anomaly started on on on February 1st, uh, the school is able to deploy an additional 100 agents. uh and they reach 450. So on April 2nd um then uh that's that's all that they that they needed. Uh so then their approved count will be adjusted to 495 which is their 450 plus 10%. So now at that point acme ID is 90% deployed as of April 3rd. Uh and as part of the process we will communicate with the school to understand if that is actual need or if they just still have endpoints that they do not have not yet covered. And our
062adjustment of this number does not mean that they're locked at that percent. If they need more above the 495 that they've been allotted or you know once the adjustment is made, they can submit an add-on request like you can today uh and and request uh more agents. However, you're placed in the queue and we can only give them if they're still available. And like I said, we are getting close to that limit. So, it's time for schools that have been in the program since the beginning and have not made the time to deploy to start deploying. We have assistance from if you're in the ARSOC program from the ARSOC, you have assistance from the ESC's. There's a lot of assistance to help you with deployment and it's not something that we can afford to have
063you wait on because sadly we've also had some few school systems that have been victims of ransomware who are already in the program but they had not fully deployed to all their systems. And so the ransomware winded up affecting systems that did not have the deployment. They would have been in a lot better place and could have avoided that had they fully deployed. So, it's time for us to deploy 100% to all of the inscope system. The maximum that you're allowed to get to school will remain at 30% of your student enrollment uh with a minimum of 30 agents and a maximum of uh 15,000 agents. So, just because we we reduce your approved amount does not mean we're changing the maximum that you're allowed. We just want to remove the misconception that anything that
064you're approved for are agents that are are guaranteed for you. That's never been the case. for new requests starting February the 1st. So, starting February the 1st, as you go through the program, you'll be given 90 days to complete deployment. After 90 days, the approved count will be adjusted to the current deployment plus 10%. So, very similar to the other one. Uh you have a slightly larger window because you're just getting started. Uh so, example, uh Acme ISD is approved for a,000 agents on February the 1st. uh and they get to deploy 350 as of May 2nd. So that'll be adjusted then to approval to 385 which is their 350 plus 10% and then Acme ISD is 90% deployed as of May 3rd. Same thing. If you determine later on that you did need additional
065uh agents, then you can always submit an add-on for the extra agents that are needed. Uh and and as long as they're available, uh they will be uh provided. They will be allotted to you. Uh and you can continue deployments. And again, the maximum allowed will still remain at 30% of student enrollment with a minimum of 30 agents and a maximum of 15,000. This realignment will encourage school systems to deploy to 100% of inscope devices now rather than waiting for later. Uh it'll allow us to forecast actual need and determine if when additional funds will be needed because we do have the ability to if we see that we're you know reaching that upper limit uh to then start requesting uh you know additional funds for the service uh if we can show that that
066more schools are on boarding that we need more. But at the number that we are at today, we could not uh request uh additional agents if we don't show that that is the case. So this will allow TA to determine if EDR may be open to all school systems, including those above the 50,000 student enrollment max. So as you know, budgets have become a little tighter for schools, even some of our larger schools are being impacted and we have had multiple requests uh by the larger schools to say, "Hey, can can we now join the EDR program?" uh there's been a lot of press around the fact that TA left money behind on the table uh and things like that. So, this is another way for us to determine if we are able to then
067open uh the request to larger school systems uh and continue to move forward with making sure that all of our schools have the protections that they need. Uh but we're going to still again encourage schools to deploy uh and then clean up those numbers a little better and then once we get those better figures then we'll make determinations as to whether or not we can open it up to all of our schools and not just to the 50,000 student enrollment and below. Uh we want to use up all the funds allocated to EDR which is currently 35 million. I want all that money to be gone by the end of this bienium. Once all 326,000 ages are approved and deployed, no more school system will be approved for EDR service until additional funding is secured.
068Once you're in the program, you will not be removed from the program unless you request to. So, know that we will continue to fund you once you're in the program, but once we reach the maximum that we can afford, we cannot accept anymore. We'll we'll take names uh and keep you in the queue as as we try to secure additional funding. Uh but of course, that's never guaranteed. What are the inscope computers? I do have some schools that kind of ask uh still this today. So the one thing that we want to make sure that we cover are all your on-remise servers 100%. It is no longer the the program like I said has been in existence for two and a half years going on three. uh at the beginning a lot of IT departments
069sort of traded lightly on deploying it on servers sort of as test systems and things like that uh but the program has proved uh beneficial has protected many schools when they've deployed it on on on their systems and so we're no longer in a test mode we we need to transfer now to an action mode so please if if you're already in the program deploy to 100% of your on-prem servers make sure that the keys and and those devices that have all of your important data and do your important functions are 100% covered and and protected against uh ransomware. Uh then with the licenses that are left over, deploy them to your IT staff and central office staff computers. These are the teams of of folks in your school that have the most access uh
070uh usually to the servers and so we want to make sure that the computers that they work off of are protected from ransomware as well. Also, if if an incident were to happen at a school, we want to make sure that these folks can continue to work and that their computers are not impacted uh by something that may be uh taking down other systems uh in in the school. So, start with your on-prem servers, then move to your IT staff and central office staff computers. Any remaining licenses, then start deploying to your teacher computers. These are going to be the next uh important folks because some of these also have access to student records and things like that. That's why we want to make sure they're protected. If you still have licenses left over, then
071continue to roll out to all remaining staff computers. Doesn't matter if it is folks that typically don't have a lot of access, remember that when uh ransomware gets into your network, it looks for the weakest link and spreads from there. So, this is going to be any computer at this point that might still not have they may not be able to get to your server and stuff like that, but they're still going to wreak havoc on your network and cause other uh um um operational, you know, issues uh which are going to take attention and possibly take away time from from from education. So, deploy them to all remaining staff computers. And then after that, if you still have licenses left over, you are also allowed to roll these out to any student lab computers
072that are on campus. Now, these are computers that remain on campus, not checked out or not taken or whatever. So, these are the priority systems that EDR will cover. We want you to move uh in order uh from one and continue to deploy on down. Don't leave holes especially in one, two, and three. Uh especially and most especially on on number one, we want to make sure that those are protected uh as as they are one of the most important key systems there in in the district. uh new cloud email security service. So the school system will be required to be demar compliant prior to or within 30 days of deployment. So once you work with the r to deploy the new email security service, uh one of the important key things is that you
073must be demar compliant or the product will not be as effective as it could be. So the schools will be required to be demarr compliant either prior to starting uh down this path or at least within 30 days of deployment. And of course, the Utrck will be assisting with that configuration. They will also be doing monitoring and regular tuning as needed. So, this can be a completely hands-off product if you wanted to or your staff can be uh in anywhere in the pipeline as much as as you'd like them to be. But it will not require your staff to deploy anything new, learn anything new or things like that. The RSOC is preparing and is prepared to help you with this soup to nuts uh without your staff having to lift a finger if they
074don't want to or they can if they want to. It's it's really up to your staff and to the school. Uh the UTR sock will provide TEA with aggregate reports on threats blocked and then share common threats with state threat feeds. So, the one nice thing about this is that we'll begin to understand the usefulness of the product so that we can report that to the legislator, make sure that they're happy with with with, you know, how we're using the funds and how it's protecting the schools. It's important for us to collect that information. And as one school threat is identified, it'll be shared with all the other schools in the program so that they can all be protected because sometimes what impacts one school almost immediately starts impacting if it isn't already all the
075other schools. Uh and of course these threat feeds go to state reports and so any of the other customers within the state will also benefit from all the information that is learned. So this is why this is a great program that we're setting up next uh school system cyber support options. So again just as a recap the state provides funds in support of TA funded cyber security services such as managed EDR TCS assessments now cloud email security security awareness training simulations NDR uh even though the pilot is currently closed but we're looking at ways to continue that and of course uh providing uh training uh and I'm sorry providing support uh school system support and training provided by the ESC's uh that's specifically from the K12 initiative ours uh which has positioned is another key
076uh player uh in in helping support the security programs of K12. They do provide incident response assistance 24 by7 monitoring. They also have managed EDR. They will be the ones that are taking care of our cloud email security. They also provide tabletop exercises and they will be doing thread intelligent sharing. The this list is not all-incclusive. Uh it is just an overview of a lot of the cyber security options that are now available to all the schools in the state. This is not something that we had just a few years ago and we continue to help our schools to be mature in their security program and to be better protected even if an incident were to happen because if an incident does happen or whatever the AROCs are there to be able to provide uh
077incident response assistance as needed and of course we have DI that continues to provide those services uh and soon that will be taken over by the tech cyber command. So only great things will be available uh to help our school systems to remain cyber resilient uh and then to be able to keep their goal of teaching our kids right that is the main goal and we understand that uh of our schools is to teach the kids that are there or whatever but unfortunately as technology is a requirement now for most of our school systems uh security pieces are not something that we can ignore. So wrapping up just a little bit, the Texas Cyber Command, in case for those that are have not heard about it, was passed by the 89th Texas legislator as House
078Bill 150. Governor Abbott appointed retired US Navy Vice Admiral Timothy James TJ White to lead the command. They do have a website if you want more information listed there. Uh, and of course, if you're looking for a job, they are currently looking uh for for for for folks to help uh the lead the charge as they continue to um establish the the new state agency. Uh reminder to please update your school system contacts. Often times when we learn of an incident at a school, we try to communicate with the school and sometimes we don't have current contacts. Uh it is important uh that you update your technology coordinator and cyber security coordinator in ASTED uh because this is where most folks typically look when we're looking for information on how to contact a school from
079a technology or cyber security perspective. Uh if you don't know how to do that, I'm told that every school should have a TED administrator who has the access to update this information in in N as TED. Um, also update your contact information with your ESC because oftent times they're the next level of of assistance that everybody looks for when they're trying to get a hold of a school. They'll contact the ESC and say, "Hey, do you have the information for such school district and their technology or cyber security person uh if the ESC does not have that information?" Then again, delays in in in getting you the assistance that you may need uh when something comes out. If you lose access to your STS portal, because typically you only need access to the portal when
080you need to request a service, then pretty much you don't need it after that. If that happens, you can always email that SSH. She is awesome at at being able to help you recover access. Or if an employee leaves and you need somebody else added to there, she will guide you through the process of of getting a new employee onboarded on. So all hope is not lost. Of course, make sure that for those of you that are in the uh EDR program as well that you keep your information uh um recent with your SIC security operations team so that in case they see something uh they know who to contact because you should have at the beginning during your onboarding communicated with them who your contacts are. But if folks come and go in the
081school system, it is important that you communicate that with the security operations team. And anytime that your technology or cyber security creators change, please remember to update these list so that we always have a good and clean and current way of communicating with the school should the need arise. The K12 does have an official website. Uh the link is there uh and it includes all the information you could ever want to know about uh the K12 program including how to get on to the SDS portal, updates about the program, frequently asked questions, handy link to sign up for the cyber security framework um I'm sorry, sorry, cyber security coordinator framework meetings that we do monthly. Uh any previous K12 initiative webinars, including this one, is also going to be posted on this page. And if
082you ever need assistance from our wonderful team, the email to to reach us all is k12 [email protected]. Speaking of the CCF, the TA cyber security team hosts a monthly meeting for Texas school systems, cyber security coordinators, and technology coordinators, education service centers, and any cyber security personnel and other members of the community that support K12 cyber security efforts. It provides content designed to assist school systems and ESC's towards maturity in an information security program. Our next CCF will be February 25th. If you're not currently registered, there is the link to register and become a u u uh ready for for the next webinar. You'll get information when it when when they're coming. Uh so please, we only allow school system email accounts. So if you do register for it, use only your school provided uh
083accounts or your ESC or or other accounts, not any of the personal ones like Hotmails, Yahoos, AOLs, and things like that. They will not be allowed and will be removed once discovered. And that's it. Wanted to make sure I'm respectful everybody's time. So, I kind of flew over through those last slides. Stay safe, secure, and warm. Everybody out there, thank you. If you have any questions, you can always reach our team at k12 [email protected]. I hope all of you that are not in the ILC program, get that paperwork done and out of the way so that you can take advantage of these services when they become available. Again, there is no commitment, just means you're ready. New services are coming out soon and we are hoping that you take advantage and that you all like
084them. Thank you for all of you that participated in the survey. Thank you for all that uh is here on the presentation uh and we hope to talk to you soon. Thank you, Daniel. That was a wonderful presentation. We got a lot of really great questions and we'll be sending those out uh afterwards in the FAQ and posted on the website. Just want to make sure everybody knows that those will get sent out.