001Uh as a reminder that TEA cyber security team host a monthly meeting for Texas school systems cyber security coordinators, technology coordinators, education service center, cyber security personnel and other members of the community that support KTO cyber security efforts. It provides content designed to assist school systems and ESC's towards maturity in an information security program. Uh if you are here then you've registered but we do make the link handy here in the slides in case they're shared out uh if you need to register for future CCFs. A little bit about me for those of you who are joining for the first time. I am the u chief information security officer for TA as of August 1st of this year. So I've only been there for a couple months. Um I previously worked uh in a couple
002different places uh specifically in IT for 28 years uh mostly in higher ed and I did come before TEA from one of the education service centers region one. Um 13 of my IT years have been in information security. Boy, how time flies. Excuse me. Uh October is cyber security awareness month. Uh and so hopefully in in your organizations, you all have been uh making your staff aware of different cyber security themes for cyber security awareness month uh and the 2025 theme from NIST is stay safe online. Uh some things that you can remind staff and students about are password best practices. The longer the better. uh multiffactor authentication, protect all important accounts uh for MFA, secure email practices, think before you click uh keep your computer and personal device software updated and do your part.
003Share your knowledge with family and friends. Uh sometimes uh we are uh often hit upon by our family uh with questions and during cyber security awareness month I challenge all of you to help a family member uh learn something about security that maybe you will uh already practice uh because it's second nature to you but it may not be second nature to some family and friends. So do that. Uh if you need some resources for cyber security awareness month, the link down there from SIZA provides some uh toolkits that you can use to create emails or provide staff with uh and students with with the videos and and different resources like that. Um our agenda for today uh we will have a little bit of instate news. Uh we will talk about the AROCS. Um
004we will have an update on the cyber security initiative. Uh we will talk about the survey so far. Uh we we will also talk about defining what managed endpoint detection response should be. Uh and then we have a few cyber security news and advisories. So, instate news. Uh, just one quick note on HP35112, which was specifically on requiring all of us to take an AI training that will be provided by DIIR. Uh, so the training is still under development. Uh, I spoke with DIR and they said that it should be announced sometime early next year. So, there is no AI training uh that you need to take yet as will be provided by by D. So, just be aware that it is coming, but it won't be till till next year. We had a lot
005of folks uh on the previous um CCF that were asking specifically about this training uh and where they could find it. Well, it it doesn't exist just yet. Uh the Texas Cyber Command, so passed by the 89th Texas Legislature as HB150, and we mentioned it uh uh at the last CCF in September. Uh, Governor Abbott appointed retired uh, US Navy Vice Admiral Timothy James TJ White to lead the command and the the Texas Cyber Command does have an official website and that's that's there www.txcc.t texas.gov for all things Texas Cyber Command related including they are currently hiring. So, they do have a um an area for for jobs that are currently posted for uh the Texas Cyber Command. Uh and just kind of an overview of what we know so far about the Texas Cyber
006Command. It is the largest state-based cyber security department in the US. Uh it shifts from reactive defense to proactive prevention and resilience. Collaborates with universities, ARSOCs, federal agencies, and local state partners. It will strengthen cyber security on strategic fronts and key terrain at deploys cutting edge capabilities to secure Texas infrastructure. And this is all from their website. Uh and again like I said so they are hiring uh and some of the different areas that they intend to put staff on. Not all these are posted yet. Uh they do want to onboard staff for uh cyber threat intelligence unit, the cyber incident response unit, uh a digital forensics laboratory. Uh they want to have key staff that will continue to share information as part of the Texas Information Sharing Analysis Organization or the Texas ISO. Um
007and they are looking for some cyber security architects in IT and IoT and then a principal privacy engineer. So um as they post these different um roles um they are going to be looking for folks to fill them uh and you can find more information about these when they post on their on their careers website. Uh and a quote from TJ White, now and long term, people are why we do it and people are how we do it. So the Texas Cyber Command is very people focused. Uh and they definitely want to start, you know, uh bringing up uh their staff to meet the future initiatives that they'll be working on. Excuse me. A little bit about the regional security operations centers, the AROCs here in Texas. So there are three there was some folks
008that um were asking questions specifically about the AROCs. So as of now there are three funded Texas AROCs. The an the Angelo State ARSOC uh was the pilot uh and was the first ARS. Uh the University of Texas at Austin and the University of Texas Re Grand Valley uh ARSOCS came up second. And there in the map you kind of see where each of these ARS are are located. Um, and for the most part the they are handling a lot of the area uh that's closest to them. So they don't follow the ESC regions uh for for um for their area and their their customers are are a little larger. Um but they are expanding. So if you are close to one of these AROCS uh you can contact them if you want more information
009specifically from them. Uh let me go into a little bit of each one. So the uh ASU RSOC uh which which like I said the pilot and the first one uh they provide managed endpoint detection and response they do real-time network security monitoring uh they provide alerts and guidance for defeating security threats. Uh they do remote on-site cyber security inc I'm sorry they have remote on-site cyber security incident responders for their customers. Uh they provide guidance on implementing cyber policies and plans. They do a lot of educational and awareness services. uh they train university students in live security operation centers environment. So that's part of what the ARSOC's uh uh goal was is to not only provide ARS services for different customers in their areas but to also help train the college students so that
010they can go into the field with a degree and with experience. Uh and the ASU arch and a conversation I have with them they do a lot of community outreach. Uh they do have different um sessions that they do. uh they go to the community, especially with some of the the the elders uh in in the area. They do training for them, which is awesome. Uh and then there's their their link there at the bottom. It's rather long. Um but um you can grab it from the slide once these are shared. The uh excuse me, the UT Austin Ars um also provides managed endpoint detection response uh and they do real-time network monitoring. They do automated dark web monitoring, automated web application security assessments, threat alerts and guidance, uh incident response for their customers, cyber
011security policy guidance. They also have uh education and awareness programs. And they provide statewide services like Dorkbot, Credit Master and Scavenger. And those statewide services are like it mentions, they're for the whole state. They're not just for their ARSOC area. So these are some of the free services that the Utrgv I'm sorry that the UTROC uh is providing currently statewide. Uh and of course if you want more information on on them you can email them or you can go to their website. And then the UtrgvoC uh also provides managed endpoint diction excuse me they also provide managed endpoint detection and response uh EDR for for their customers incident response monitoring alerting policy and planning and and training and awareness. Um all of these ARS uh essentially provide the same service uh for their customers. Uh
012they do it in maybe slightly different ways uh and they have slightly different bandwidth but for the most part uh they are very similar in the services they provide. So it doesn't matter what area of the state you are. If you are close to an ARSOC and you can communicate with ARS about their services either one of the three uh that you're closest to will provide you excellent services. Um, okay. I was just trying to catch up timewise to make sure that since we started late, so I think I can slow down. I think I caught up to where I needed to be. So, I'm going to slow down a little bit. So, now let's talk a little bit about the uh Texas K12 cyber security initiative. So, as a reminder, these are fully funded
013services uh that are at zero cost to any of our school systems. Um the currently the initiatives that are fully funded uh and available for request are the managed endpoint detection and response and to participate the requirement is a student enrollment of 50,000 or less. Uh and you are provided with licenses up to 30% of enrollment or 30 licenses depending on your size. So you get no less than 30 but we do use 30% of your of your student enrollment. Uh once registered uh request a service via the managed security services from DI via the MSS portal uh and then school systems may choose between uh two currently EDR vendors crowd strike or sentinel one. Uh the shared option should be most common for school systems. Uh another service that can be requested is the
014Texas cyber security framework or TCF assessment. Uh this is a first come first serve for any school. So there are no limits on this one. You don't have to have any given uh student enrollment. If you are a K12 school in Texas, you do qualify for TCF assessment when you are ready to go. Once registered, uh you can request the service via the MSS portal. Uh and you can choose from three different sizes, small, medium, uh or large. Uh and what that means is that the small is the minimum of what we would expect a school to to do. Medium includes a little bit more controls and large is all of them. Right? So, a lot of the schools that have already taken it have chosen to go the large route. Figured, you know, this
015is this is free. This is just an indication for you to know, you know, where your cyber security program maturity is. So, why not get all of the um all of the security controls reviewed for you so they can provide you an an a report on your current status for the entire thing and not just pieces of it. It's up to you if you want to do a small, medium, or large. Um, this also may be ordered now and scheduled for anytime through August 2027. So, when you order the TCF assessment, you can request the service and then on the notes, you can place that you want it scheduled for, for example, if you were to put it in today, uh, but you're not going to be ready till June, you can put the June
016as the start date, uh, and then they'll queue you in. So you don't have to wait until a few days before you're ready uh to to to be to have it and and be on their calendar uh because they they they do fill up and they can work through them as quickly as they can. But the more school systems uh that join obviously the longer it's going to take the the assessors to to work through through all of them. Uh so you want to plan a little bit ahead. The um last is the network detection and response the NDR and that p the pilot program is currently closed. uh and we are still uh reviewing uh and evaluating you know how we're going to continue with this and what we're going to do. Uh and
017just for note the NDR vendor is Verra. All of this information uh can be found there at the bottom for the new customer form. I'm sorry. Uh next page. So just a little bit because some of the schools and some of the surveys uh that we re responses that we received already still said, hey, I'm not sure how how I can take advantage of of the program. How do I join? You know, how do we start? Uh so I did review this uh at the last um CCF, but I figured it'd be good to to do it one more time. So the process uh in a nutshell really is the school system would complete the new customer form and send it to DIR. The new customer form is just is it's the beginning and it
018requires absolutely no signatures. There's no commitment. Uh all it does is informs the hey the school district is is wanting to to participate uh and send them the ILC. Uh and so the ILC will be sent uh to the contacts that you put in the uh new customer form. So that's all the new customer form is. I had a few folks ask me, hey, where do we sign? Now the new customer form doesn't require any signatures. Uh once DIR receives the new customer form, they will send the contact uh specified in the new customer form, they will send the interlocal contract to them. Uh and that's when the fund will begin. So the ILC once the school res receives it, they should review it uh have conversations with with school leadership and make decisions on
019to whether or not the school will want to participate. Uh for some schools that might take having conversations with the school board. uh but the s the superintendent signature is definitely required on that. Um and then once once the OC is reviewed uh completed and approved and signed by school system then they are to return it to uh DI for processing. All of all of even submitting the ILC like I spoke last month uh there is no commitment for a school to request any of the services. All having an ILC in place does is make you ready to request the services. Uh there's no commitment. uh and it's just paperwork at this point right once once a school is ready to actually request the services uh and and DI has already reviewed and approved uh
020they will have granted you portal access and that's where you could actually request uh the MSS services via the portal but up until then just having the OC in place does not commit to anything nobody's going to reach out to you and say hey what are you going to request uh or things like that uh but it just means that you are ready to for whenever you are to request these services and no longer have to go through all the paperwork and the process that it could entail uh to getting the ILC signed. But once you are ready, you would go to the MSS portal uh and you could request uh EDR of your choice or the the TCF assessment. So hopefully this review kind of in a nutshell, like I said, provides the process
021of of getting onboarded on uh up until uh having the IOC in place uh and then requesting the services once you choose and are ready to do that. So uh some of the goals that we reviewed uh last month uh this will be our final review of of the goals. Uh so we are we are still these are goals that we've had since the you know the first the initial set of the initiative which are the endpoint detection response uh multiffactor authentication for all staff email systems uh to ensure uh demar uh compliance making sure that you have your SPF uh DKIM and demark in place uh restricting local administrator access to only those folks that absolutely need it on their system. Uh, and this typically is just IT and support personnel. Um, and then
022of course doing a TCF assessment uh, and getting an understanding of of where you are in your security program and then working year after year to to improve uh, and get to a better place. And then of course the the network detention and response which again it's it's currently uh, not an option for anybody new the pilot group uh that was selected. Uh so these will continue uh when as we move forward. So the program participation uh in the IOC so there are about 480 school systems who have signed the DI interlocal contract uh form. Uh that number has gone up a bit since our last uh conversation. Uh which is great. Um, a lot of folks have now started the the process. Uh, and so I'm surprised that we had uh a few already
023in there since the last time we reported because like I said, it could be a process. So, even though it's only been 28 days, you know, we we had two complete ones that have come in and then I'm sure there are others in flight. So, thank you for those that are working uh to get the ILC's in place. Uh again, my goal is to make sure that 100% of all you guys have assigned ILC with DI because again, there is zero commitment to request any services just to have the ILC out of the way. Uh any of the services that you do request as part of this initiative is zero cost to any of the school system. Uh and then IC process takes time to complete. So again, superintendent having to sign off, board approval,
024etc. And if you ever have the need for EDR service because you suffer a security incident where EDR could be helpful to uh contain it and to clean it and as part of your incident response process and you don't already have it in place, you know, DI can't do anything. We can't assist until the ILC is in place. So this is why I highly recommend that everybody get that ILC out of the way uh and just be ready to request the services so that it's the paperwork is out of the way and not causing a hurdle for when you need and are ready for the services as part of the initiative [clears throat] uh endpoint detection and response edr. So, and this this data I pulled from a certain area and it might be a
025little off. Uh, but there are 344 school systems and that number I think has climbed up a little bit. Uh, who have signed up for EDR. Uh, we are installed in about 238,000 endpoints. Uh, it is uh definitely over now. 41,000 attacks blocked uh and 10,500 ransomware threats have been neutralized. So, the program for the EDR is definitely working for the schools uh that that are are utilizing it. Um, excuse me. Um, the ESC's are contracted to assist school systems with deploying EDR no cost. So, if you need assistance with like, you know, you're like, "Hey, you know, our our staff is is uh, you know, don't really have the bandwidth to go and install all of these um agents to to the systems or or whatnot, you can contact the ESC in your area
026and they will help you uh at no cost to help deploy the EDR as part of the K12 initiative. If you are part of one of the RSOCs, they do the exact same thing. So there are different nocost ways to have the software installed on your computers, uh if if you can't do the self uh the self route, uh there's no cost assistance to to do that for for you. So please don't let that be a hurdle to to get into EDR. Uh I also wanted to note because the um surveys there was a few folks that said that they had not decided to go the EDR route because they didn't know how long this was going to continue. That was a concern when we first did the the EDR uh in the first two
027years of the initiative. Uh but that is no longer an item. So managed EDR is a budgeted item and this will remain for as long as EDR retains its utility. So for as long as EDR is worth having uh it is fully managed now I mean fully budgeted now uh and will continue indefinitely but but I will say this it the the funds for it are not infinite uh unfortunately and at some point once we reached a maximum uh budget amount uh then we would maybe need to uh no longer allow any more to be added on but until that happens and we will let everybody know in advance if we are getting close to that. But before that happens, you know, EDR for those that have it and those that are signed in um
028you know, during the program, we will keep it uh for as long as it is valuable for us to have EDR in place. Uh so many folks that say like, well, you know, it's not worth our time to deploy something that may be, you know, gotten rid of in a year or two. Well, that's not the case with the managed DDR that we are providing or any of the arts are providing. These will continue to be budgeted um indefinitely unless TEA goes away. That's the only thing I can't I can't foretell the future. And as long as TA is here and EDR is a valuable tool, EDR will be uh budgeted uh for and and will be allowed for any of the schools that are currently participating in the program. So I hope that helps
029uh some that had that that that concern. Um the the initiative um this slide was the same exact slide as before. What I wanted to talk a little bit about is because the numbers here uh of what currently is deployed versus what is currently requested is something that we're trying to address, something that we uh have been in communications with uh uh internally to make decisions around what exactly is what we need uh from the perspective of the schools, what what do they actually need versus what they've requested. Uh and because of the way that we have uh allowed the request to come in, there are um we we allowed maximum allocation based on your enrollment to be requested. Uh and then the schools uh kind of sat there um you know with with hey
030I have my thousand endpoints but I've only deployed 200 uh and that's all I've had the bandwidth to do at the moment. Uh or maybe that's all I needed and we don't know what that is. And so going forward, what we want to try to do is we're going to start to slowly reach out to the schools and start to see if we can't determine what is actual need. Uh and we're going to start adjusting uh the numbers so that we can better reflect actual need versus what you have requested. Uh and actual need is going to be based on the deployment numbers that we see because we do get information from sic uh on all of the uh endpoints that are installed across each of the schools. So, we're going to start comparing actual
031deployment versus was actually requested and try to determine if the amount uh that was actually fully requested is actually still in need. And if not, we are going to begin to reduce the numbers uh for the schools closer to uh what is actually in use. What does that mean? I wanted to explain so that I don't I don't uh cause any confusion and and it's a little complex, but let me try to make it simple. If you were allotted a thousand ages, just going to use round simple numbers, and you've currently only deployed 200 and you've had that deployment for almost two years now, h and you've not really moved past the 200 mark. So once we notice that, what we what we plan to do is to communicate with the schools and say, "Hey,
032is 200 all you need or do you still need, you know, some agents? You just haven't had a chance to to deploy them." Uh if if the school doesn't respond or says, "You know what? that that's that's pretty much all we need. Then we're going to do is we're going to round that number up by 10% to give you a cushion and we're going to change your allocated amount down to 10% of what your current uh agent employment is. Now, that does not mean that if you determine that you need more that you can't request more. So, you could submit additional add-on requests as needed up until the maximum amount needed. But what it does for us in our reporting is allows us to determine, you know, where where we actually are, where the actual
033need is um and make financial decisions going forward as to the actual amount that the EDR program is costing the initiative so that we can uh provide other services. Because right now, since we're going by the assumption that for the school that requested a thousand, even though they're only using 200, our budget for them is that entire thousand even though it's not costing TEA that at the moment, but we sort of have that as a just in case. But uh other schools have asked for add-ons requests and uh some of the larger schools who currently are are are not able to participate have also asked to see if they can. Uh and so we told them we were going to have internal conversations to see if we could do that. Uh and part of us
034being able to do that is to make better decisions around what is actual need versus request. And so we're going to try to tighten that up a little bit as we work through that. If you have any questions uh on that, uh please reach out to us and let us know. I I don't want to make it seem like we're going to cap you uh at some amount. Uh that that won't be the case. If once we adjust these numbers, if you do determine that you need more, it's just as simple as putting in a new add-on request uh and going through the approval process uh to get in there. But I will say this again, at some point we will reach maximum uh amount of money allocated to this, at which point we will
035say like, hey, we're we're at 90% of the money that we've earmarked for the EDR. We're going to request additional funds from from legis from the from the legislature. Uh but it's going to have to go through approval. So until then, the money that's earmarked will continue year after year, but any more above that uh we'll have to to go and request for additional to add additional. So don't be caught on that. Hey, I I waited too too long uh to get these services in place. But for you that are on there or are fixing to get onboarded on, this will continue uh indefinitely. Uh as I mentioned before, um I wanted to review the computers that should be part of the Inscope systems. uh and it is very important uh not because we don't
036want you to deploy to all systems but in the incidents that have been reported to us these are the systems typically that uh have had the biggest um incident uh cause incident causes for a school uh and those are the your on-prem servers. So, if your on-prem servers uh are the victim of of a ransomware or something like that and and taken online, the school has a difficult time of being able to provide, you know, daily services. Uh and so we want to make sure that 100% of all of your on-rem servers are covered by by EDR. Uh, and then next is your IT staff and central office staff computers. Because if these close up, then the staff that typically handles most of your day-to-day business uh, and IT support won't be able to do
037that uh, until their computers are um, remediated. And so, one and two are extremely important to have at 100% coverage uh, as part of any EDR. Uh and then as as licenses allow and as budgets allow if it's if it's not part of the K12 initiative are your teacher computers deploy to all teacher computers. Uh and if you reach a saturation point where you're like you know hey I need I I I need another 100red or so uh uh edr licenses to cover all my teachers. Hey submit the request. I don't make any promises that that it will be approved but uh it's not going to be approved for sure if you don't ask. So ask so that we can review so then we can make decisions and and and and then approve them through
038if if if we still have the budget to do so. And then a after that is all remaining staff computers, right? So if you still have based on your alloc allocated amount, if you still have licenses left for uh any of your staff that are not outside that are outside of two and three, then begin to deploy to those. Let's be your your your your teachers, I'm sorry, your um your uh other staff uh that are not teachers who maybe have computers. uh and and you know protect those. And then if you have any lab any computers that are like in a student lab uh then start covering those as well so that we make sure that we have any of the end points that are in a school district or a school uh charter
039system to be protected so that none of them are able to be a launch point uh for lateral movement if one of them becomes compromised with ransomware or anything else. Uh so again start at number one and move down the list until you are out of licenses. But we will always always make sure that at the very minimum you have the amount needed to cover one and two and as much as three as we can. Um the NDR pilot again the NDR pilot just has nine schools in them uh and is currently closed as we re-evaluate how how it would benefit us to to move forward uh with this. Uh I will begin to work with one particular school on some ideas that we have. I've reached out to the school. They've they've agreed uh
040to to assist and so we will start that work uh coming up here in November. And of course, as a reminder, uh you can request uh email domain security support from your ESC at no cost to make sure your SPF, DKIM, and Demark uh records are in place correctly. There is absolutely no cost to these to even to implement and it's mostly configuration. Uh the same thing for multiffactor authentication. Please please ensure that all of your employee email accounts are protected by MFA. We continue to see incidents reported where a uh district employees email account uh because they somebody breached their their password got compromised and so then they started spewing out uh other um you know infected emails to other staff within the district which now because it looked like it was coming from
041an employee more people were sub uh subject to clicking on those and reading that and the the the infection could spread. Uh we've also had some folks that because they don't have uh MFA enabled uh they've had their um passwords uh breached as part of the fact that they use Google and we'll talk about that here in a little bit. So it is vitally important that at the very minimum that MFA is enabled for all employee email accounts whether you use 365 or Google and there's no cost uh to do this for any of those platforms. And then of course restricting local admin privileges um is also mostly employee awareness uh and some configuration. Um the K12 cyber security initiative does have a website. So, I wanted to remind everybody that this is where we
042post uh any updates or information uh about the initiative going forward. Um and we'll talk about this in a little bit, but this will be the last CCF of this year. So, most of the other communication that we will be doing will be either via email, via ESC, or via the website. So, we will go slightly gray, not really dark, uh because we're not going to have CCF to announce most of this stuff until next year, but we will still communicate uh via emails and other and other things. But anything relating to the K12 cyber security initiative information that you need, we will always update and place on the website. So, please keep an eye on this uh for updates or if you have any questions. And the site also includes the email addresses to
043to use to contact us for for questions. Um, as a reminder, uh, I wanted to go over this one more time. Uh these emails and phone numbers are intended to be if there is a security incident at your school, something's on fire, for example, and you need absolute immediate attention, these are the places where you need to email so they can get and assist you ASAP, including uh uh a 800 number for both SAC and DIR. These are not meant to be, hey, I I need to whitelist a device or I need more agents or things like that. Don't tie up the folks using these um contact information. Uh because these are meant for priority assistance uh so that we we we can deal with with these issues when when there are something of of
044importance that needs to be handled immediately. Uh we had a few folks that used the information what I shared last time to request nonpriority stuff. Uh and so the the they wanted me to iterate that these really should be just for things that are critical. If you have non uh critical stuff, right? Uh so non non nothing that's an incident uh an operation request and you want to receive uh help. Um that's you go through the DSTS portal uh and submit that request. Uh we we they do ask that you provide a brief 40 character summary and that you start with MSS so that it gets routed even faster. all of them will be routed if you don't put that in there. But that just helps speed up the thing because of some of the
045workflow that they have configured on these requests. Um, but the when you submit the request through here, there's also SLAs's. So the teams, everybody has to be kept honest, right? when when once a incident uh request is received uh it'll be handled uh and I don't remember what the what the actual SLAs's are but this makes sure that they're not missed uh and things like that and or that we can have conversations with whoever it's stuck on to say hey like hey you know how do we move this forward so if it is like request for I need to uninstall agents or I need to add agents or I I can't log into the console things like that you could uh send out information uh to through the portal here as a reminder um because
046we've had a difficult time reaching out to some of the folks is to please continue to update your ASTED uh especially for your technology coordinator and cyber security coordinator. A lot of the emails that we used and we pulled from the survey to I to send out the survey turned out to be old and incorrect. So that made getting the survey out a little difficult. A lot of you all had to reach out to me and said, "Hey, we don't we don't have the survey. we've not received the link and and we sort of dealt with that, but primarily that was because we don't have accurate uh contacts for each school system uh across the state. And so we're trying to get creative on how to better do that. Uh but it's important to update
047your contacts as much as possible and ask TED uh update the the contact information with your ESC because we did reach out to the ESC's to assist with with uh getting a hold of folks uh and so that you should have been uh contacted regarding this the survey for example saying hey you know the TEA has not received any surveys from you. We just want to remind you that this is still ongoing uh and to please submit something. Uh if you are unable to access the STS portal uh obviously you can't log into the portal to to request assistance you can send an email to Teresa Shade from DI and she will uh assist you with getting access to to the portal again. Um and then of course make sure that you update uh your
048the information for these folks whether it be ask or the ESC uh whenever there's a cyber security coordinator or technology coordinator change at your district. very helpful. New goals. So, new goals, as I mentioned before, are still being developed. We've not made any final decisions on how this is going to be. Uh, but we did send out a survey on September 29th to all school systems. So, please complete the survey once you receive it if you haven't already. Thank you for all that have. Uh, your responses are essential for TA to accurately assess the current impact and understand the cyber security needs of all the school systems statewide. So, let's talk a little bit now about the survey. I'm sure some of you have been waiting for this piece. So, [clears throat] as of yesterday
049evening, we had a total of 764 total responses, which is 50% of all Texas school systems responded. For for those of you pulling out your calculators, I see you out there. Uh 764 does not equal 57% of school systems. But what I removed from the from the school systems metric are a few school systems uh actually submitted multiple surveys. So we might have had a district or a charter where the technology coordinator submitted something or the uh cyber security coordinator submit something or some the superintendent submitted something in addition. So we we we had a few school systems where we had two uh survey responses and so that's why we have a total of 764 responses but that really only represents 57% of school systems. So we're definitely receive responses for more than half of
050all of the um school systems uh in Texas. So that is awesome I think. Um so a little bit of of some of the information that we've pulled from the survey so far. So, of the people that responded, uh, we asked, uh, are you did you participate in the initiative this past time? Uh, the majority said yes, but we did have a lot of nos. Uh, and some folks that were unsure of whether or not they participated, and this is probably because what's added to some of the confusion is the rcks and some of the other areas where they may have been, but they're not sure if this is part of the initiative or not because this is some of the comments that I read. So, that that's fine. Uh so but we did have
051a majority of the folks report that they asked they did uh participate. Uh we also asked do you plan on participating uh on the initiative for this next uh bienium that we're working on. Uh and unsure was actually the the the most response. So that was kind of um surprising to me. Uh but one of the primary reasons was because of the the EDR um part which is seems to be the most popular uh and that being that they're not sure if it'll continue but like I mentioned if you are onboarded onto the EDR uh and you've got a set of of deployments already in your school it'll continue indefinitely for as long as EDR is a viable solution uh and you know tea exists. So there should be no fear there. So, I'm hoping
052that that unsure drops to more yeses based on that alone. Other folks that said, "No, I don't know because I'm I'm thinking of doing this through the AROC." I wanted to iterate that my goal is to make sure that all of the school systems in the state have EDR. It doesn't matter to me whether that comes from TEA's initiative or from an AROC or if you want to go out and get it on your own. To me the important thing is that you are protected on those items that I spoke about which is on-prem servers and your IT and uh central office staff computers at 100% uh and you can get creative on how you want to do that. That to me is the most important not you participate necessarily on the edr program through
053through us but that you have edr at your school system. Um of the respondents we asked them hey how has the K12 initiative been of value to you? Uh 212. The majority that answered said it was it's been extremely valuable. Uh some said, you know, somewhat valuable. Uh some were neutral. I had one that said not very valuable and and one that's not valuable at all. And so in reading the comments, I I understand why. Uh and so thankfully that wasn't the case for for most of the responses. Um so but it does shine a light that most of most of the your peers that have been taking advantage of the program have found it uh extremely valuable. As we continue um for the services that folks are using, uh EDR has been by far
054the one that is being um utilized the most by 209 folks and actually there are 344 plus school systems actually using EDR. Um the the Texas cyber security framework assessment 88 mentioned that they are participating. We have confirmed 50 uh 54 uh in flight that are in in already for 50 that are completed and four that are in process. Uh so the rest might be those that have already submitted that are in Q. So that's awesome. 88 as you can see of of your uh fellow uh school systems are taking advantage of the TCF assessment. Uh assistance from the ESC's for your email security there was 82. Assistance for MFA from the ESC was at 52 and assistance to uh kind of wrangle the whole local admin uh on your devices through an ESC's assistance
055uh was at 46. Uh of interesting to me was that the network detection response pilot the 21 of you said that you were participating. We only have nine pilot schools. Uh so that'll be some interesting review as to maybe there was some misunderstanding as to what we meant by by the NDR but there 21 participated but actually there's only nine. uh and those nine are are are locked and we're not currently accepting anymore. So what is it that everybody is asking for this next bienium? What is it that everybody needs? Right? So based on the responses that we've received so far, uh by far what everybody is is is wanting is advanced fishing simulation and user training. So security awareness uh seems to be uh what what most of them most of you all are
056are are saying that we need. So, we'll start looking at uh seeing what software we can provide that'll do uh fishing simulations and provide uh security awareness training uh to to your to your employees. And then next on the list seems to be email filtering and gateway protection. Uh and interestingly enough, these two things here are what's known how typically you know most of the threats enter the organization is via email and users they're clicking on on things that they shouldn't. Uh so this kind of reflects, you know, that uh that we need a little bit more training for our users not to click on things and a little more protection uh above the defaults uh for email that's coming into to to each of the school systems. Uh cloud security hardening was third on
057the list uh for Microsoft 365 and Google Workspace. And what we could do for this is provide guides that the ESC's could kind of uh work with you on and just kind of reviewing different configurations in Microsoft 365 or Google Workspace to make sure that they are uh at a level that they should be or that you can make note of how that might impact uh to move to those uh more secure settings uh and then make decisions around how to how to get there. So, it's not just not going to force anybody to to to click on all the settings, it would make your uh 365 or Google more hardened. Uh but definitely if you don't have the recommended pieces in place that you have conversations around how to get there and then of
058course the the rest of the list there shows what everybody's asking for so far. So, thank you for everybody that uh submitted the surveys. This is what we're learning and the information that we're getting has been really great and there's a lot of data. So, it's going to take us a while to sift through it all and make decisions, but so far it's it's looking like the things that we will be adding to the initiative most likely are going to be those top three there uh on on the needs list. But we'll see. I asked one of the questions that we ask is what EDR is in place at each of the different locations, right? And there is a rainbow of options that everybody's using. uh everything from what you see there, the most popular
059ones at the top uh on to to the bottom. Uh and so I wanted to address a little bit on EDR. I wanted to make sure that again to me the most important thing is that you have EDR in place and and to me less important is how you're getting it, but more importantly that you do have it at your school system. [laughter] So we'll talk about that here in a second. The survey will close on midnight, October 24th. So, if you have not submitted yours, please do so. You have about 50 hours left to submit yours. Uh, email your ESC or RTA team if you have an error that your link is expired or is not working because we had a few folks that reported that and we will definitely help you to get
060past that or if you have not received or cannot find your unique survey link. Uh, please reach out to us and there's the email address there. So, let's talk a little bit about managed endpoint detection response. Right. So, defining what managed EDR is. So the K12 cyber security initiative includes fully managed EDR. What is endpoint protection and response? Let's go over that. How does it differ from anti virus? What does it mean to be fully managed? So I want to show that I want to make sure that we're all talking on the same plane when we talk about managed EDR. So here is a table of traditional AV versus advanced EDR. Both of them have signaturebased detection, right? So EDR would not be able to do its thing 100% if it didn't at least understand
061thing like signatures like traditional AV does. However, EDR moves past that to include behavioral and machine learning detection. Some of your traditional AV partners have begun to incorporate that into their products. Uh but there's a higher cost typically uh as they start to slowly move towards EDR and get their customers to move towards in that direction. But advanced EDR for sure has that and that is you know by far way better than than just traditional AV. Uh EDR can provide continuous telemetry uh on everything going on in your system. What processes are running? You know how different processes or how different applications are are interacting with each other. It allows you to do threat hunting uh incident forensics when there is an incident. All these things traditional AV cannot do. automated responses uh like being
062able to kill isolate a file or or roll back something uh for for the managed piece is definitely something that's available by EDR for traditional AV that really depends on the product. A few do have it uh but not all. Uh and then threat threat integration. So the fact that your EDR can learn what is currently current since it's not just signature based uh anomalies that it sees or stuff that everybody else is reporting is added to the rules for EDR so that the EDR product deployed to you is stronger because we are getting information from the entire state and everybody that's in the program. It does miter attack mapping. Uh it can do endpoint installation. So if one of your endpoints becomes infected with ransomware, the EDR has the ability to essentially place it
063in a bubble that prevents it from communicating with anybody else except the EDR service. So this way we can still do investigations on it and things like that, but this the endpoint at that point cannot communicate with anybody else on the network. Uh and then of course some of the EDRs do have rollback capability, meaning that if something is uh encrypted once it's detected and and that action is stopped, it can return some of those files back to their pre uh encrypted state. Um and and typically uh the more advanced EDR is the only one that can do that. So when we talk about EDR, that's what I want everybody to keep in mind of the ones that we are offering as part of the K12 and as part of the RSOC is Sentinel One
064and Crowd Strike. and those definitely live on that uh far right column. I'm not saying that those are the only ones, but as you have information on your the product you're using, please review to make sure that you are using an EDR product and not just traditional AV. And then managed managed means that we have a security operations team that is monitoring the alerts 247 365. Uh that's either via SIC on ARSOC or your vendor depending on where you're getting your flavor of EDR. That means that they will analyze alerts first and engage you only if real threats require your attention. They can call you at 3:00 a.m. on a Saturday morning or act on a threat for you. And typically that is a conversation you have at the beginning of your services how you
065want to handle you know after hours uh issues that may pop up. Uh they provide 100% hand-free management or you can engage with your security operations center. That means if you don't have the bandwidth to learn a new tool or or configure a new tool, whatever, you don't have to. They will handle it 100% for you or you can work with them uh on on anything that may be specific to your area or I'm sorry to your to your to your network. Uh and it they will configure and tune the EDR for you. So you don't again you don't have to learn or figure out how to do that. Plus anything that they see like I said if you are in the state program whether that's an ARSOC or the K12 initiative anything that is
066identified at one customer is shared amongst the cloud and pushed out to all the other EDRs whether that's crowdstrike or sentinel one it's done to both uh and so thread intel is shared statewide and added to all customers uh and and apart from typical vendor threat feeds so keep that in mind that's what we're talking about when we say fully managed 100% EDR it's not just any flavor. There are specifics. We chose what we chose. We've we've tied it together like we have to make it more robust uh for anybody who's participating in the state program. That doesn't mean you have to use ours. I'm not saying that. I'm just saying that if you're does not provide currently some of these services, you might want to reconsider uh you know what you're using. Plus, if
067you do through an ARSOC or through through the K12 initiative, this is at zero cost to you. So that could be a savings where you could utilize that funding uh to some other part of of your security program. And then lastly, where are uh the EDRs that we provide and the ARS provide in regards to the Gartner Magic Quadrant? So CrowdStrike and Sentinel One are leaders compared to so many of the others out there. Uh and so that means that u you know Gartner does a lot of reviews uh and and research on the different ones out there for specific things uh to identify where they're at. And so what the ROCS and what the K12 initiative is offering to you is not just any EDR but it's one of the the Cadillacs, if you
068will, the top-of-the-line software uh that we're making available at no cost to the school districts. [clears throat] A lot of folks said, "Hey, I use Microsoft Defender for my EDR." And I wanted to make sure you all understand this. Microsoft Defender is not ed unless you're specifically talking about Microsoft Defender for Endpoint. The names are very similar. So I can see where there could be confusion where you might look up, hey, is Microsoft Defender EDR and you might get a return says yes. Uh and that really depends on whether you're talking about Microsoft Defender period or Microsoft Defender for endpoint period, right? And the easiest way to tell that is if on your device if you do a quick and this doesn't require admin rights. Anybody can do this. You bring up your command line
069window and you do a sequery scace query space sense. If you get anything but the message below meaning that the sense is running then you do not have defender for endpoint. Even if you paid for it if you paid for it and you think you have it just because you paid for it if you didn't configure it properly or it has not been deployed to each of your endpoints. If you do this query, it's not going to show that it's running. Uh, and you're like, "Wait a minute, but I paid for that, but maybe it's not configured properly." So, this is an awesome way to check to make sure that you are actually running Defender for Endpoint and not just Microsoft Defender. And then real quickly, because we're a little bit over time, cyber security
070news and advisories. Um, breach password managers. Uh, we have had over the last year and probably before that, information regarding, um, excuse me, uh folks who are using uh password managers and their passwords have been breached. Uh so specifically Google's uh and they we continue to get reports from from various school systems here in the state. Uh so this has resulted in unauthorizes access to a sender and other student information systems enabling threat actors to alter employee banking details and redirect payroll deposits for fraudulent accounts. So this is a real threat that is currently ongoing here in the state. So please be careful of this. Uh the best way to make sure that folks uh uh can prevent this is to provide them with regular training and enforcing the use of vetted password management policies
071uh so that they are only using password managers that you approve of uh and that are set up correctly. And this will empower your staff to prevent these type of attacks. Uh because it's not always that the staff did something wrong. It's it's often the time that the staff wasn't provided with additional guidance on on how to do this correctly. Um changes to employee banking details should require manual validation before being committed. This is the one thing that regardless of the passwords protecting you know it continues to be an issue where through the interwebs folks can change banking details and have their checks rerouted to other places. It is important that you put into place a manual check to make sure that the employee who says hey my bank changed from A to B is
072actually the employee and not somebody who's somehow gotten access to their account. So, some of the I wanted to go over real quickly some of the password manager best practices. A password manager should uh secure use of any password. The secure use of any password manager must include MFA. That's a non if it doesn't include MFA, you should not use it. Your password manager password should be unique. It should not be the same for your email account tied to your your password manager or anything else. You should have one long, very unique, MFA protected password on your password manager that then gives you access to the other stored passwords in there. That is the best and only way that a password manager should be used. Uh, your recovery email accounts for password manager must also
073require MFA. Don't say, "Hey, to your password manager, I forgot my password." And then it goes into your email uh with your new password and your email account does not have MFA because that is a definitely backdoor hidden uh vulnerability that exists for folks that are not using password managers correctly. Individual privileged or important like banking or work password should require MFA even if they're stored in your password manager. Yes, you do need that extra protection because it should be required by most folks anyways. if your password manager is breached like so many have. The fact that your individual accounts require MFA might be your only saving grace. So there are proper ways to use u password managers and there of course incorrect ways uh to use a password manager. Please avoid the use of
074built-in browser managers. uh they often lack a more robust security features and the Google one specifically is the one that keeps on being in the news where somebody's email account got compromised because that email account is their MFA I'm sorry is their Google password vault uh account the thread actors had access to their entire list of passwords and then of course they went and logged into whatever they could and wre havoc. Please be mindful of, you know, password managers because if you do have your password manager breached, you are providing somebody the king the keys to all your kingdoms. Uh, and this continues to be uh something that for our school systems is now impacting uh potentially other employees as well. The Texas is um just if you're not a member, go to the website,
075sign up to receive information. Anything that we see is always shared uh statewide if it's appropriate to do so. Uh including any threats that that that we're seeing for K12 specifically uh that that we should make mindful to everybody else so they can look up into their own organizations to make sure that they're safe. Uh as a reminder uh we don't have a CCF in November or December because of the holidays. Uh our next one will be in January. So please do a save the date uh if I don't see you between now and then. Have a great holiday season. uh and we will be in touch with you again on January. Uh of note, we are only accepting registered school system emails to join the CCF. All others are removed. So if you if
076you continue if you if you please continue to to use your school email when you sign up uh because if we see any others that are not registered to a school, uh they are dropped uh as much as we can. Uh and if you would like to let us know what you would like included in the next CCF, please send us an email uh and we will uh consider it um as topics that we can talk about. I want to make sure that the CCF is not just a vehicle that we use to communicate TA important things, but that we can communicate things that you guys want as well. Maybe there's some products or some information that's hot on on your I want to know list. Shoot them our way so that we can add
077them and communicate them out at the next CCF. And that is it. Sorry that I'm about eight minutes over. Uh have a great uh rest of your day. Uh and we will be in touch. Thank you everybody.