On September 18 the Florida Consortium of Public Charter Schools sent every member school a cybersecurity alert. It asks each school to review six areas of its defenses, and it was sent because one Florida charter school is currently working through a ransomware incident with forensic investigators and the FBI.
When the consortium added contact details for schools that wanted help working through that list, Dynamic Network Solutions was the partner named in the alert. We are proud of that, and the useful thing we can do with it is explain what those six items mean in practice, because every one of them reads like something you could confirm in a meeting and none of them can be.
The six checks, and what each one means
1. Review network and server activity for unusual or unauthorized access
Before you review anything, find out how far back your logs go.
Most school environments retain 30 days by default, and some retain a week. Ransomware is rarely the first thing that happens. Attackers are frequently inside for weeks before anything encrypts, finding the backups and the admin accounts first. If your retention is shorter than the time they were in, the evidence of how they got in expired before anyone thought to look.
So the first check is not whether anything looks odd. It is whether you could still see something that happened six weeks ago. If the answer is no, fixing that beats reading this month’s logs.
2. Confirm endpoint protection, firewalls, backups and MFA are functioning properly
The word doing the work is functioning, and the gap between installed and functioning is where incidents live.
Endpoint protection that is deployed, with an exclusion somebody added years ago to stop a grading tool being flagged. Multifactor authentication switched on, with legacy authentication still permitted, so it can be walked around entirely. A service account exempted once during a rollout and never put back.
None of that is visible from a dashboard that says Protected. Pick one machine and one account and test them properly.
3. Pay close attention to administrative accounts
Go and count them. Most schools are surprised by the number.
In a charter school the recurring problems are specific. The shared administrator account whose password four people know. The account belonging to the IT vendor you stopped using two years ago, still enabled. Domain administrator credentials used for ordinary daily work, so a single phishing click lands on the keys to everything rather than on one teacher’s mailbox.
Two questions settle most of it. Who left in the past twelve months, and is their access gone? And does anyone read email signed in as an account that could rebuild the domain?
4. Ensure backups are protected, offline where possible, and restorable independently
This is the one that fails most often, and nothing tells you it has.
Backups that live on the same domain, reachable with the same administrator credentials, get encrypted alongside everything else. That is not a theoretical risk. Finding and destroying the backups is a standard step for the people doing this, because it is what makes a school pay.
The real test is not whether backups are running. It is whether you have ever restored from one. Pick a file, restore it to a machine that is not joined to the domain, and time it. A school that has never tested a restore does not know whether its backups work.
5. Immediately isolate affected systems and contact professionals
Immediately means the decision has to already be made.
If something surfaces at six on a Saturday morning, somebody has to be able to pull the network without waiting for permission. Decide now who that person is, write down how they physically do it, and make sure the answer does not require a board vote or a call to someone on holiday. The hours where isolation still helps are the hours when nobody can reach anybody.
6. Report to law enforcement and state authorities
Report to the FBI at ic3.gov and follow your state reporting obligations.
There is a step that gets missed here and it is expensive. Check your cyber insurance policy before you call anyone in to help. Most policies require you to use firms from their approved panel, and require notification inside a short window. Bringing in your own people first, however good they are, is a documented way to have a claim reduced or refused. The call that protects the claim goes to the broker, and it goes early.
We wrote about how much that renewal process has tightened in a previous piece. The same paperwork that made the renewal harder is the paperwork that decides whether a claim pays.
Why charter schools keep appearing in these alerts
It is not carelessness. It is structure.
A charter school runs enterprise systems, a student information system, Google Workspace or Microsoft 365, a building full of devices, cameras and door access, on a budget that does not stretch to a dedicated security person. Infrastructure gets built over a summer by whoever was available and then runs for years without anyone whose job is to look at it. Vendors come and go and their access does not always go with them.
Attackers know this. They are not choosing schools because schools are rich. They are choosing them because the gap between what a school runs and who watches it is wider than in most businesses.
Why our name was on that alert
We have spent years doing this work for charter schools, districts, county agencies and nonprofits across the United States. Not selling a product into them, running the environment: the identity controls, the backups, the network, the cameras and the doors, and the unglamorous quarterly work of checking that what was true last year is still true.
That is why we were the partner the consortium pointed to, and it is the reason we would rather publish the six checks than a sales page. A school that works through this list on its own and finds nothing has had a good week. If you work through it and something looks wrong, that is exactly the moment to call somebody.
If you want help
Any Florida charter school is welcome to call and talk through that list, client or not. The two items schools most often get stuck on are the backup restore test and the administrator account count, and both are quicker with someone who has done them before.
If you are working through the list, our free security check covers the same ground in about two minutes and gives you something to take to your board.
If you think something is already happening, our incident response page sets out what to do in the first hour, and the order matters more than most people expect.
If something is happening right now, stop reading and call 833-DNS-ONIT, option 4.