Cybersecurity Part 4: Surviving Ransomware

By Tony DePrato | Follow Me on LinkedIn

The scope of all the following arguments is for equipment owned by the school, or equipment approved to use at school. This post is not promoting policies for personal devices used solely at home, nor is this post addressing devices that may be used for entertainment or non-academic purposes.

Ransomware, in its most basic form, is self-explanatory. Data is captured, encrypted, and held for ransom until a fee is paid. The two most common forms of ransomware delivery are through email and websites.~ https://insights.sei.cmu.edu/sei_blog/2017/05/ransomware-best-practices-for-prevention-and-response.html

Ransomware is scary. Ransomware, once it begins to propagate, becomes more about survival and mitigation and less about prevention.

I have thought about how to advise K12 schools around the world how to prepare for ransomware. I have concluded that there are only two approaches everyone can follow: Reduce or Completely Remove Windows and Create Very Inconvenient Backups of Data. 

Reduce or Completely Remove Windows

I decided to compile known types of ransomware. I stopped at 106 identified types. Here is a graph, and link to the sources, that demonstrate what operating systems are vulnerable:

Screen Shot 2020-02-19 at 8.58.44 AM
Data Link

If you want to do the math:

  • 106 Ransomware programs
  • 100 Target Windows Operating Systems
  • 93%-94% of Targets are Windows Operating Systems
  • Using Windows is Riskier than Using other Systems

“Riskier” is a little weak in this case. It is very likely that Windows users will be a target, it is very unlikely that Apple and Chromebook users will be a target. 

If the goal is to live in a relatively peaceful ransomware free environment, then the majority of end-users need to be using Apple or Chrome-based devices (Linux varieties are also an option for a subset of users). 

There are tools for Windows that help defend and protect against ransomware. However, nothing is better than not being attacked at all.

Create Very Inconvenient Backups of Data

Every time I ask an IT director or IT manager about backups, they claim they are 100% compliant and 100% able to deal with any problems. I have never believed my planning was close to 100%, nor have I ever believed I could restore 100% of all data. I would say, at my best, I am 60%-70% certain that I can restore 80%-90% of data. 

Data. Not operating systems and settings. Data. Not the software that was installed. Just all the data consisting of but not limited to documents, databases, movies, music, pictures, special configuration files, scripts and code, and the inclusive content of all websites.

There is only one question a person needs to ask to confirm if backups are safe from ransomware: “Can the backup be accessed right now if we need it?”.

If the answer is ‘Yes’, then backups are going to be vulnerable. 

There should be at least two layers of backups. Layer one can be data that is backed-up and accessible on the network, in the cloud, and/or from normal workstations. Meaning, someone can sit down and create or restore a laptop, database, etc by following a workflow at their desk. 

Layer two backups are inconvenient. These backups are stored outside of the normal network. These backups are scheduled and not even accessible by network administrators without taking extra steps. These backups require some level of multifactor authentication or even a physical lock and key.

Backup

Layer two backups also need to be tested at least monthly (this is only recommended for K12 schools most businesses need to test more frequently; school districts would need to test very often and on a predetermined schedule).

Tests need to include:

  1. Data restoration
  2. Data access and use
  3. A scan for malware, ransomware, etc
  4. An iterative process to consistently reduce the size of backups
  5. An archival process to store data that will most likely never be needed, but is legally required to store
  6. Imagination. Because you never know where you will be and what the situation will be when you need to access these backups

A very low tech approach to a layer two back-up could include someone taking an external drive to the data source, moving the data manually, and then locking the drive in a safe. Do not overthink this, just start doing it and keep improving the process. If you can access these backups from your workstation, then those backups are vulnerable by definition.

If ransomware happens, and the data cannot be decrypted, this layer two data would be safe as it would be offline. Layer one backups may stay secure, but layer two backups will be secure unless you are victim of very bad timing. 

The cybersecurity industry is rapidly developing better protocols for handling ransomware. Staying educated and studying cases is not only essential, but it should also be scheduled into the cycle of work at least once every 6-8 weeks.

The data above could change. An uptick in ransomware for Chrome or Apple of even 1% is enough to review internal processes and procedures. Until then though, get the number of Windows OS users down and make better backups. 

businessman hand holding money banknote for paying the key from

Start Your Research Here

Ransomware: Best Practices for Prevention and Response

https://insights.sei.cmu.edu/sei_blog/2017/05/ransomware-best-practices-for-prevention-and-response.html

Demos and feedback: Students learning from each other

This the fourth and final blog post in a series of reflections with Bill Tihen. I am pleased that, just as we finish processing Bill’s notes from his November visit with LAS visiting scholar Bret Thayer, Bill has scheduled a new visit to attend the ECIS STEAM conference we are hosting March 6-7.

Students must learn to give, hear, and accept feedback. Bill suggests that there are four general steps to make feedback effective. 

  1. Students plan and present a demonstration of their work, keeping the requirement for feedback in mind. Ideally students share their work for other students (and faculty members). Before presenting their work, students predict what sort of feedback they are likely to receive – both positive comments as well as suggestions for improvement.
  1. After students have presented their work, they receive feedback. When students receive feedback they keep it safe for those giving them feedback by restricting themselves to listening and taking notes. Students learn to resist the urge to challenge the feedback, clarify misunderstandings, or justify themselves. In this manner, students and faculty giving feedback do so in a safe environment – and the students receiving the feedback actually hear it. 
  1. Giving feedback entails:

(1) commenting on those aspects of the work that are well-liked and how the demonstration shows movement toward the end goal; and

(2) commenting on what would make the work even better. For those things that might need to be addressed, an acceptable formulation of constructive criticism might be: “I like the [whatever it is] and think it might be even better if you [did this, changed this, considered this alternative, etc.]

  1. And finally, working with the feedback requires clearly using one or more suggestions received from the group. Students give credit for the origin of the idea and explain how they made the suggestion their own and integrated it into their work. Work completed without adopting and adapting ideas from others is incomplete.

These four steps from Bill can lead to great use of feedback – or not. We’ve seen both results, so it’s probably fair to say that these may be necessary but not sufficient conditions in Bill’s framework. Other factors, like having the time and space to work without constant adult interruption, having an atmosphere of trust, and so on, are also important.

As I reflect on Bill’s four steps, two interesting parallels jump out. First, how similar his suggestions for receiving feedback are to student feedback sessions of LEINN International at the University of Mondragon. Second, how refreshing it is to hear someone require students to incorporate each other’s ideas. 

LEINN International is an undergraduate program for future entrepreneurs. (LEINN stands for Leadership, Entrepreneurship, and Innovation. It is managed by a highly creative company, Tazebaez, which is itself a product of the parent LEINN program.) The day I visited, a cohort of freshmen were giving each other feedback. They sat in a circle. The student receiving feedback took notes and limited his responses to a “thank you” for both positive and constructive comments from each colleague. I was amazed at how frank the feedback was, how carefully presented by the students, and how gracious those receiving feedback seemed. In hindsight, they were doing nothing other than what Bill suggests in (2) above, something we’ve adopted for our alternative 9th and 10th grade program at my school.

Requiring students to use the ideas of other students contradicts a lot of common practice in schools. How often have we heard teachers admonish students to “do your own work” and “keep your eyes on your own paper?” Bill is doing the opposite, requiring students to get and use feedback from other students, and above all else, not to try to go it alone. Please, please look at other students’ papers (plans, projects, models), he is saying. Learn from each other, exchange ideas. And then give credit where credit is due. What a refreshing take on learning.

Thanks, Bill, for the years of collaboration, the experimental classes, and the debriefings that continue when we get together, most recently in this series of blog posts. You are amazing to work with. 

Uplift: Contextual Exploration and Building Student Confidence

This is the third in a series of four posts based on ongoing conversations with Bill Tihen.

On a recent Sunday morning I was playing badminton with my nine-year old daughter. Our rallies were extraordinarily long, we had really gotten the hang of it.

Then she said, “Let’s count how many we do!” She served the birdie off the edge of her racket into the net. “0.” She sent the next one over and I missed it. We couldn’t get another good rally going. Soon she asked if we could switch activities. 

During the long rallies we experienced a feeling of “uplift,” the sense of each one of us doing well on account of the other, the sense that we were able to help each other have the next good shot. Individually we were a good team and being a good team made us good individually. We were in a state of “flow.”

When Bill speaks about uplift, he focuses on the creation of an atmosphere in which students build on existing strengths and grow their self-confidence. Bill feels that students are more likely to find joy in learning when they start from a position of strength, and that redirecting them from distracting activities toward helpful activities is easier. An uplifted atmosphere is full of exploration and meaningful context, one in which stress is reduced by focusing on what students do well. 

Dangerous to an atmosphere of uplift are traditional assessment practices. Assessment shouldn’t hinder motivation or impede performance – think of our terrible badminton shots when we started focusing on assessment! We need to avoid letting our assessment practices lead to student behavior that is safe for the assessment practice but damaging to a creative sense of exploration. Assessment serves learning, not the other way around.

For example, in our 3D Nautical Design class, where students designed and printed plastic boats, students tested the boats in a pool of water so that everyone could see what boat designs work and which do not. Assessment (and reflection) is needed to advance the learning. Students test as they are ready to test, not to demonstrate mastery, but to discover the next step, the next improvement. The students are experimenting with the performance issues that they are designing for. They don’t need a teacher to tell them if a boat is right or not, they will see for themselves if it can’t handle a payload or gets swamped by a wave. Assessment becomes personal, with a goal of iterative improvement, which can actually contribute to the atmosphere of uplift. Assessment is not a teacher’s judgment of ability, which ranks students against each other or to levels on a rubric. Assessment is what is needed to take the next logical step, discovered by the student.

Uplift by focusing and building on strengths. Increased ownership and student agency will follow. 

Turning Conversation Into Action

So I just returned home from the AAIE 2020 conference and frankly, I’m inspired. Actually, more than inspiration I’m feeling empowered and profoundly called to action as a result of the conversations that we all engaged in throughout the three days in New York. The themes that we deeply dove into revolved around diversity, inclusion, equity, and social justice, and the question that was posed was, how do we go after these issues purposely in schools…or do we at all? Great debates, provocative conversations and thoughtful questions related to how we tackle these themes in education, and the level of responsibility that we all have as leaders and educators to do so. My head is still spinning honestly, with the possibilities and opportunities that we have to change the narrative around what’s really important and imperative in today’s world…it’s time to turn these conversations into action and I’m excited to get going.


Not only did I enjoy the daily breakout sessions, I was also inspired by the keynote speakers and their messages related to shared humanity and joyful leadership, two things that I am personally passionate about. Dacher Keltner from the Greater Good Science Center, and Firoozeh Dumas, a New York Times best selling author called us all to action and implored us all to lead with our hearts, and to go after the conference themes with purpose and with a sense of urgency and responsibility…so good. I was fortunate enough to be a part of two panel discussions to do with inclusion, and how leaders can turn conversation into action, and I made a personal commitment to take a more proactive role in leading out some of these initiatives with our young people. I also challenged the other leaders at the conference to do the same, and to work with each other and hold each other accountable for bringing this change to life through our work with our students and communities. 


Thinking about accountability, I’ve been wondering about which systems and structures that schools and organizations can target to initiate these changes. Strategic planning, curriculum design, mission statement re-writes, hiring practices, and even professional development are good places to start, and I’m also wondering about the accreditation process. Thinking about the amazing and transformative work that CIS has done regarding child protection and safeguarding over the past several years, where it is now an expectation and requirement to have specific policies and procedures in place in order to be re-accredited, I’m thinking that we could leverage accrediting organizations to help hold international schools accountable around the themes of diversity, equity, inclusion and social justice. I’m not sure exactly what that would look like but once again, it’s time to turn these conversations into action. 


Anyway, I have to say that not only did I return home feeling inspired because of the conference conversations, but I also felt proud and validated that the work that we are doing at ASP is strongly connected to all of this. Actually, in many ways we are helping to lead the way and it feels great. We are doing meaningful and purposeful and transformative work through our strategic planning and this conference just pushed me to do even more to support our journey. I’ll leave you with a final quote that has stuck with me since I returned from Cornel West, who said that, “Justice is what love looks like in public”. Honestly, isn’t that what the world needs a bit more of these days…love. Have a wonderful week everyone and remember to be great for our students and good to each other. 

Quote of the Week…If we don’t grow, we aren’t really living.-Gail Sheehy


Inspiring Videos –

 College Tuition

Part 2 – Responsibility

All That We Share

Climate Change Rap

Social Justice in Schools


Related Articles –

What is Social Justice?

Curriculum Design

Diversity in Schools

What is Equity in Education?

Together We Learn Better

The Educational Advance of the Decade Will Be Gender & Sexual Diversity Inclusion

www.emilymeadows.org
@emilymeadowsorg

If your school has not yet opened a conversation about gender and sexual diversity, I predict it will in the 2020’s.

Gender and sexually diverse students attend international schools, and educators are increasingly aware of the benefits of inclusion. Right off the bat, I acknowledge that many countries have cultural or even legal barriers in place to suppress full inclusion. I have worked in religious schools, and also in the Middle East – I really do get the challenges. Still, there are data-based, safe, and effective interventions to increase the educational experience for LGBTQ+ children, appropriate for even the most conservative contexts (for specifics, see the books where I have written on this topic[1][2]). We have got to move past culture as an excuse for discrimination.

Inclusion of gender and sexually diverse children is relevant worldwide. UNESCO asserts that, “The education sector has a responsibility to provide safe and inclusive learning environments for all students. Addressing homophobic and transphobic violence in schools is critical to effective learning, to meet human rights commitments, … and to ensure inclusive and equitable quality education and promote lifelong learning opportunities for all”[3].

Gender and sexual diversity inclusion is relevant on a large scale. It is difficult to gather data on such sensitive metrics but, where we do have studies internationally, research indicates that somewhere between 5-10% of people self-identify as lesbian, gay, bisexual, or transgender[4][5]. Scholars and statisticians estimate that these figures are lower than the actual LGBTQ+ population because respondents may be reluctant to identify themselves, given the associated stigma, or may not connect with these labels, even if same-sex attracted or gender non-conforming[6]. Intersex people further increase diversity, representing an estimated 1.7% of the population[7]. Moreover, LGBTQ+ identities are on the rise, with Millennials self-identifying as the least cisgender and heterosexual generation to date[8][9]. This is not to reinforce the myth that gender and sexual diversity is new; rather, greater social acceptance has made space for more people to be open about their identities.  

Still, even if we consider the conservative end of the bracket, and posit that only 5% of people in the world are gender or sexually diverse today, this constitutes about 400 million individuals. If that was the population of a country, it would be the third largest nation on earth (and, dare I say, would sport the most colourful flag). Gender and sexually diverse people are significant.

Child-centred international schools cannot conscientiously ignore this population, and it is unethical to do so. Lesbian, gay, bisexual, and transgender children are among the most vulnerable to a range of mental health issues, including anxiety, depression, and suicidality[10][11]. Let this not be confounded with the tired trope of homosexuality as a mental illness; LGBTQ+ identities are risk factors for nothing, whereas contexts that pathologize and discriminate against LGBTQ+ people are risks factors for multiple negative outcomes.

Indeed, it is encouraging to discover that inclusive contextual factors can virtually eliminate the vulnerability we typically associate with LGBTQ+ youth. Gender and sexually diverse children who have access to affirming social support see benefits across multiple outcomes[12][13]. School-based interventions, such as non-discrimination policies and affirming students’ gender identities, substantially reduce LGBTQ+ mental health risks[14][15]. Robust research shows that gender and sexually diverse children are not inherently troubled, but exposure to stigmatizing social conditions is detrimental.


Fortunately, schools are well-positioned to make a tremendous positive impact in reducing this stigma. As an educational consultant on gender and sexual diversity, I train international school teachers, counselors, and administrators who may start with a modest understanding of LGBTQ+ children (because, truthfully, most of us did not learn much about this in our education courses). Nevertheless, even the most novice participants leave my sessions confidently prepared with knowledge and skills to improve their practice to be more inclusive of all students, regardless of where they work.

Gender and sexual diversity inclusion and equity will become an expectation among international schools this decade. If you act now, you still have time to become a leader in the movement.


[1] Meadows, E. S. (2019). “That would never work here”: Overcoming ‘context paralysis’ on behalf of gender & sexual minority students worldwide In Wiseman, A. W. (Ed.) Annual Review of Comparative and International Education 2018 (International Perspectives on Education and Society, Vol. 37), 287-305. Bingley, United Kingdom: Emerald Publishing.

[2] Meadows, E. S. & Shain, J. D. (2019). Supporting gender & sexual minority students in conservative school communities In Sprott, R. & Lytle, M. (Eds.) Walking the Walk: Addressing Gender and Sexual Orientation Diversity in Schools from Primary Education to College. Manuscript submitted for publication. Washington, DC: American Psychological Association Books.

[3] United Nations Educational, Scientific and Cultural Organization (UNESCO). (2016). Out in the open: Education sector responses to violence based on sexual orientation and gender identity/expression. Paris, France: UNESCO.

[4] Mor, Z. & Davidovich, U. (2016). Sexual orientation and behaviour of adult Jews in Israel and the association with risk behaviour. Archives of Sexual Behavior, 45(6), 1563-1571.

[5] Greaves, L. M., Barlow, F. K., Lee, C. H., Matika, C. M., Wang, W., Lindsay, C., Case, C. J. B., … & Sibley, C. G. (2016). The diversity and prevalence of sexual orientation self-labels in a New Zealand National Sample. Archives of Sexual Behavior, 46(5), 1-12.

[6] H., E. (2015, May 6). How to count how many people are gay. The Economist. Retrieved from: https://www.economist.com/the-economist-explains/2015/05/05/how-to-count-how-many-people-are-gay

[7] Fausto-Sterling, A. (2000). Sexing the Body: Gender Politics and the Construction of Sexuality. New York, NY: Basic Books.

[8] Newport, F. (2018). In U.S., estimate of LGBT population rises to 4.5%. Gallup. Retrieved from: https://news.gallup.com/poll/234863/estimate-lgbt-population-rises.aspx

[9] Lam, A. (2016, October 18). Counting the LGBT population: 6% of Europeans identify as LGB. Dalia. Retrieved from: https://daliaresearch.com/blog/counting-the-lgbt-population-6-of-europeans-identify-as-lgbt/

[10] Haas, A. P., Rodgers, P. L., & Herman, J. L. (2014). Suicide attempts among transgender and gender non-conforming adults: Findings of the national transgender discrimination survey. Los Angeles, CA: The Williams Institute.

[11] Mathy, R. M. Suicidality and sexual orientation in five continents: Asia, Australia, Europe, North America, and South America. International Journal of Sexuality and Gender Studies, 7(23), 215-225.

[12] Snapp, S. D., Watson, R. J., Russell, S. T., Diaz, R. M., & Ryan, C. (2015). Social support networks for LGBT young adults: Low cost strategies for positive adjustment. Family Relations Interdisciplinary Journal of Applied Family Science, 64(3), 420-430.

[13] Ryan, C., Russell, S. T., Huebner, D. M., Diaz, R. & Sanchez, J. (2010). Family acceptance in adolescence and the health of LGBT young adults. Journal of Child and Adolescent Psychiatric Nursing, 23(4), 205-213.

[14] Hatzenbuehler, M. L., Birkett, M., Van Wagenen, A., & Meyer, I. H. (2014). Protective School Climates and Reduced Risk for Suicide Ideation in Sexual Minority Youths. American Journal of Public Health, 104(2), 279-286.

[15] Russell, S.T., Pollitt, A. M., Li, G., Grossman, A. H. (2018). Chosen name use is linked to reduced depressive symptoms, suicidal ideation, and suicidal behavior among transgender youth. Journal of Adolescent Health, 63, 503-505.