State offering increased cybersecurity services for schools, nonprofits

DES MOINES — The Iowa Department of Management is increasing cybersecurity service options for schools and nonprofit organizations in Iowa in response to a demand from educational institutions.

The expanded cybersecurity services — through the Department of Management’s Office of the Chief Information Officer — allow for flexibility that schools and nonprofits have told the office they need, spokeswoman Gloria Van Rees said in an email to The Gazette.

The cost of these services is $8.24 per device per month. The Office of the Chief Information Officer suggests school districts prioritize services and system administrators in incident monitoring and response, followed by staff and educator devices and then student devices.

These scalable services are not in response to recent cybersecurity attacks against Iowa schools, Van Rees said.

The Cedar Rapids Community School District identified a cybersecurity breach July 2. The district canceled its summer school the following week from July 5-8, impacting more than 750 children enrolled in programs.

In an email last month to families, Superintendent Noreen Bush said the district made an undisclosed payment to a “third party” entity to ensure critical information that may have been accessed was not released.

Personal information from staff was included in data stolen from the school district. According to a letter to the Iowa Attorney General’s Office, the data of 8,790 Iowans was compromised in the incident.

The district is offering a free year’s worth of credit monitoring services to affected employees to see if the data are being used.

District officials did not respond to questions from The Gazette about how much ransom was paid, why data were still released if the district paid the ransom, what school systems if any are still affected and whether the district would be prepared for the first day of school on Aug. 23.

The Linn-Mar Community School District last month reported “technical difficulties” after its district network and phone systems went down. District officials said they were working with “third-party specialists to investigate the source of this disruption, assess its impact on our systems, and to restore full functionality to our systems as soon as possible.” The incident has not been confirmed as a cybersecurity breach.

Services offered through the Office of the Chief Information Officer will include Endpoint Detection and Response. The service is designed to prevent a wide range of known and unknown malware and threats, as well as to provide protection from such threats. Endpoints are things like personal computers, servers, tablets and other devices.

In addition, Endpoint Detection and Response provides the ability to investigate and solve problems that evade protection controls, according to a news release last month from the Office of the Chief Information Officer. This service also includes around the clock security incident response positioned to appropriately respond to cybersecurity threats against the protected endpoints.

The Office of the Chief Information Officer listened to feedback from customers to create a special rate for cybersecurity services for schools, school districts, and nonprofits, according to a news release, making it easier for schools to use the services officered.

Under Iowa Code 8b, the Office of the Chief Information Officer is able to provide cybersecurity services to state government agencies, cities, counties, educational institutions and nonprofits in Iowa. The increased cybersecurity services will protect students, teachers and schools, according to a news release.

Comments: (319) 398-8411; grace.king@thegazette.com