Cybersecurity

Government & Law Enforcement Cyber Contacts

• Multi-State Information Sharing and Analysis Center (MS-ISAC)
  • Membership is free for K-12 agencies. MS-ISAC provides a number of free and low-cost services, including cybersecurity advisory alerts, Malicious Domain Name Blocking and Reporting (MDBR), passive threat notification service, and many others.
• Cybersecurity and Infrastructure Security Agency (CISA) 
  • CISA provides risk and risk mitigation advice, outreach, assessments, inspections, trainings, and support to government agencies. 
• Center for Internet Security (CIS)
  • The CIS establishes and maintains cybersecurity best practices, including the CIS Controls and CIS Benchmarks.  They are a partner of MS-ISAC.
• California Cybersecurity Integration Center (Cal-CSIC) (Part of California Office of Emergency Services, or Cal-OES)
  • Maintains a 24/7 report line that provides no-cost services as well as coordination with cyber insurance incident response services.
  • Phone: 833-737-6781 (833-REPORT1)
  • Email: calcsic@caloes.ca.gov
  • Quick Reference Brochure
• Federal Bureau of Investigation (FBI)
  • Cybercrime Information Page
  • FBI Internet Crime Complaint Center (IC3)

This guide was created as a resource you can provide to your Board Members, Cabinet members, or other non-technical staff in your agency.

• Cybersecurity Risks and Responsibilities Guide

• Implement Multi-Factor Authentication (MFA) for all staff accounts if you have not already.
• Implement the recommendations in the Top Considerations for Cyber Security Insurance document.
• Create a Cyber Incident Response Plan (CIRP).
• Support and encourage an ongoing investment in IT systems and services that will improve the organization's cybersecurity posture and operational resilience.
• Encourage and support cybersecurity and digital citizenship training at all staff levels.
• Support the district and/or COE's ability to hire cybersecurity and technology staff. 
• Ensure your LEA has a cyber liability insurance policy and ensure decisionmakers understand the requirements to stay insured.
• Review board policies and administrative regulations related to technology use by staff and students and record storage and retention.

• Business Email Compromise & Wire Fraud: The use of social engineering and phishing to trick employees into processing fraudulent payments to criminal actors.
  
  
• Cyber Incident Response Plan (CIRP): a documented strategy outlining how an organization will detect, respond to, and recover from cyber security incidents like data breaches, ransomware attacks, and other disruptions.
  
  
• DDoS, Distributed Denial of Services (DDoS), pronounced "D-Daws": An attempt to disrupt a network or server by flooding with requests from various systems on the internet which can prevent users from accessing your agency's website or other network resources. 
  
  
• Malware: A type of software (commonly called a virus) designed to gain unauthorized access or damage a computer.
  
  
• MFA, Multi-Factor Authentication, (MFA): is the use of a second method of verification besides a password to allow authorized access to a system. Increasingly this is a requirement for all cyber insurance.
  
  
• Phishing: An attempt to have someone click on a link with the intent on stealing your password or other login credentials or provide private information via email, text, or other forms. Used in conjunction with other items like malware.
  
  
• Ransomware: Malicious software designed to extort money by blocking access to files.
  
  
• Social Engineering: Describes the efforts by attackers to use methods like phone calls, in-person visits, or similar tactics to gain sensitive information.