New York City DOE Serves As Reminder on Encryption Trust but Verify – The Daily Hodl

HodlX Guest PostSubmit Your Post

Eight hundred twenty thousand thats how many NYC students were affected by 2022 hackers whoattacked a vulnerability in the school systems technology infrastructure. The breach occurred in software provided to the school system by Illuminate Education, and it resulted in access to names,birthdays, ethnicities and free-lunch statuses, among other items.

It is possible that the system was targeted with the hope of finding a treasure trove of SSNs or financial information both items that we have been told were not collected. The attack was the result of the company failing to encrypt its platforms.

Chancellor David Banks, while calling for city, state and federal investigations, told The Post,

We are outraged that Illuminate represented to us and schools that legally required, industry standard critical safeguards were in place when they were not.

Perhaps it might make sense to elected officials unfamiliar with cybercrime that a companys assurances in regard to encryption and other cybersecurity measures are sufficient.

However, this attack isnt unique. So many institutions, relying on external technology providers simply take their word for it when it comes to security and it isnt unique to public schools, which may not feel that they are a top-tier target for cybercrimes.

Consider the number of cryptocurrency exchanges and other DeFi marketplaces that have seen exploitations and breaches. Many exchanges and marketplaces are more interested in the business of garnering new customers than keeping user assets safe.

As a consequence, they utilize technology that is no match for the skill set of todays hackers. Many times, though, they arent rich in technological knowledge. Even CTOs are without extensive experience in preventing sophisticated cyberattacks. Often, they outsource their entire security apparatus, relying entirely on the claims of external providers and vendors.

The mistake is not in utilizing outside vendors. In fact, finding a provider that has more significant experience in building the technology infrastructure required for your business is often an excellent idea. The mistake is in trusting a provider without verifying the quality of their work. It isnt enough for a vendor to say that they offer industry-standard encryption services.

Theres nothing more important to a digital asset exchanges long-term success than its ability to keep those assets safe. It is incumbent on the operator of an exchange or in this case, the school district to ensure that they are prudently spending their cybersecurity funds. Any company that collects personal information or financial data has a duty to be a good steward of the trust they have been given.

You may think that school districts and cryptocurrency exchanges have a vastly different set of challenges. In some ways, that is true. Different kinds of hackers target different kinds of entities, utilizing different skill sets. But fundamentally, both must be prepared to deal with bad actors.

In this attack, teachers saw homework completion decrease significantly. And the system was also used to track Covid-19. When the system went down in January, so did their ability to track student exposure. There were real consequences in this failure to protect students. And while the attack wasnt one that saw $600 million in assets disappear as we recently saw in theexploitation of the Ronin sidechain it was one that could have been avoided.

Fundamentally, we as a society must hit the reset button on cybersecurity. We need to throw out the old playbook and develop a new vision for dealing with cutting-edge threats, especially with an ever-expanding cyberwar brewing as a result of the Russia-Ukraine conflict. The urgent need for a paradigm shift has never been greater.

Richard Gardner is the CEO of Modulus. He has been a globally recognized subject matter expert for more than two decades, offering complex insight and analysis on cryptocurrency, cybersecurity, financial technology, surveillance technology, blockchain technologies and general management best practices.

Follow Us on Twitter Facebook Telegram

Featured Image: Shutterstock/Design Projects

Continue reading here:
New York City DOE Serves As Reminder on Encryption Trust but Verify - The Daily Hodl