Passing the Torch - Mentoring and Protecting Our Students

Passing the Torch - Mentoring and Protecting Our Students

Speakers: Navaar Johnson (IT Administrator, K12 school district in upstate New York); Sam Comini (Security Professional)

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=AviifoOuaBE

Overview

"Passing the Torch - Mentoring and Protecting Our Students" at DEF CON was an unconventional yet highly insightful session that transformed from a planned panel discussion into an interactive community forum. Led by Navaar Johnson, an IT administrator with 15 years of experience in K12 education, and Sam Comini, a security professional with over 25 years in consulting, the talk aimed to address the unique and pressing cybersecurity challenges faced by educational institutions. The format, which invited audience members to act as "panelists" contributing red team attack vectors and blue team defensive strategies, underscored the collaborative spirit necessary to tackle these complex issues.

The core premise of the talk revolved around the vulnerability of K12 and higher education environments, often seen as "soft targets" by adversaries. Unlike corporate entities focused on intellectual property or financial assets, schools primarily grapple with safeguarding sensitive student and staff data, maintaining instructional continuity, and securing often under-resourced infrastructure against a diverse threat landscape. This includes not only external attackers but also the significant "insider threat" posed by tech-savvy students. The session served as a crucial platform for security professionals, educators, and community members to collectively brainstorm, share experiences, and identify actionable strategies for protecting these vital institutions while simultaneously fostering the next generation of cybersecurity talent.

Background

▶ Watch: Introduction and setting up interactive panel format (0:00)

Educational institutions, from K12 districts to universities, operate within a unique and often paradoxical security landscape. By their very nature, schools are open environments designed for access, collaboration, and learning, which inherently conflicts with traditional lockdown security models. This openness extends to physical access, network permeability, and the widespread adoption of new technologies for pedagogical purposes. Compounding these challenges are severe budgetary constraints, limited IT and security staffing, and a diverse user base—ranging from young students to non-technical faculty—each presenting distinct vulnerabilities and requirements.

Prior work in cybersecurity has largely focused on corporate or government sectors, leaving educational institutions to adapt best practices often ill-suited to their specific context. The problem is exacerbated by the sheer volume and sensitivity of data managed by schools, including personally identifiable information (PII) of minors, health records, financial data, and academic records, all subject to stringent compliance regulations such as FERPA, CIPA, COPPA, HIPAA, and state-specific laws like California’s COPPA (note: speaker meant CalCIPA or similar state-level privacy acts, as COPPA is federal) and New York State's Edlaw 2D. Despite these requirements, resources for robust security implementation and ongoing training are often scarce. The rise of Shadow IT, the proliferation of IoT devices in classrooms, and the increasing sophistication of phishing attacks further complicate defense efforts, demanding innovative and community-driven solutions.

Key Findings

▶ Watch: Red Team: Attacking ERP/student systems for data (3:58)

The interactive format of the talk yielded several critical findings derived from the collective experience of the DEF CON audience, acting as both red and blue teams. These insights highlighted the multifaceted vulnerabilities of educational environments and the evolving nature of threats:

1. High Value of Student Data and Financial Exploitation: Red team participants quickly identified student data, particularly Social Security numbers and lack of credit history, as a prime target for long-term identity theft. Financial systems (ERP, payroll) were also highlighted for immediate monetary gain through direct deposit changes, illustrating the dual threat of data exfiltration and financial fraud.
2. Education as a Soft Target for Infrastructure Compromise: Schools are often seen as easy targets for adversaries to establish a foothold, serving as infrastructure for further malicious activities like hosting data, launching attacks, or deploying malware/ransomware, especially given perceived lower security capabilities compared to .gov or higher education institutions.
3. The Pervasive Insider Threat from Students: Beyond external actors, students themselves were identified as a significant "insider threat." Motivated by curiosity, boredom, or even frustration (e.g., Roblox blocks), students actively seek ways to bypass security controls, often leveraging readily available online resources like YouTube, Reddit, and ChatGPT. This includes developing custom proxies, VPNs, and exploiting accessibility features.
4. Human Element as the Primary Vulnerability: Across all attack vectors, the human factor emerged as the weakest link. This includes teachers using weak, easily guessable passwords (e.g., "password123"), falling victim to MFA fatigue in higher education, or simply being too trusting of official-looking emails. Physical security gaps often stem from staff complacency (e.g., propping doors open, letting unknown individuals in).
5. Challenges of Balancing Security with Education: A recurring theme was the inherent tension between stringent security measures and the educational mission. Overly restrictive filtering, blocking USB ports, or disallowing innovative applications can hinder learning and teaching, forcing IT administrators to walk a "fine line."
6. Proliferation of Unvetted Applications and IoT Devices: The ease of adopting "free apps" and teachers bringing in personal IoT devices or "Timu garbage" creates significant Shadow IT challenges. These unvetted applications and insecure devices often bypass established security protocols and compliance requirements, leading to data leakage or network compromise.

Technical Deep Dive

▶ Watch: Red Team: Using school infrastructure as attack pivot (5:08)

The session, though conversational, touched upon several specific technical attack vectors and defensive strategies relevant to educational settings.

Red Team Tactics and Vulnerabilities:

• ERP and Student Information System Exploitation: A primary attack vector identified was targeting Enterprise Resource Planning (ERP) systems and student information systems (e.g., "PowerSchool"). Attackers seek known vulnerabilities or backdoors to exfiltrate student data, which is highly valuable due to students' clean credit histories, making them ideal for long-term identity theft. The goal is often to "expel all your data."
• Financial Fraud via Payroll Systems: Adversaries can target direct deposit information within payroll systems. By changing direct deposit details to attacker-controlled accounts, they can divert employee paychecks, with the money quickly moved out of the country. This highlights the risk of Business Email Compromise (BEC) tactics against finance departments.
• Infrastructure Abuse: Schools, with their extensive networks and numerous devices, can be exploited as infrastructure. Attackers might use compromised school systems for data storage, as launchpads for other attacks, or to build botnets, leveraging the school's internet egress.
• Phishing and Social Engineering: This remains a top threat.
• Credential Phishing: Targeting employees for their paychecks.
• MFA Fatigue: In higher education, the use of Duo or similar Multi-Factor Authentication (MFA) systems can be circumvented if users, bombarded with pushes, accidentally approve a malicious login attempt. This directly leads to Business Email Compromise (BEC).
• AI-Enhanced Phishing: The explosion of AI tools (like large language models and voice cloning) makes phishing attempts significantly more sophisticated. The speaker demonstrated how a voice clone of a superintendent could fool 30% of staff, eliminating traditional indicators like spelling errors and making detection much harder.
• Student-Driven Circumvention:
• Arbitrary JavaScript Execution: Students bypass filtering software by using legitimate educational platforms like W3Schools to execute arbitrary JavaScript code, effectively creating their own proxies or access points. A SOCKS proxy written entirely in JavaScript was mentioned as a possible tool.
• Accessibility Framework Exploitation: A student was observed exploiting a Mac's underlying accessibility framework to bypass lockdown browsers. This involved using a buffer to store typing, triggering a Gemini API call with the buffered content as a prompt, and then inserting the AI's response back into the buffer, making it appear as if the student was typing normally. This technique successfully bypassed College Board lockdown tests.
• Physical Hotspots: Students brought in personal cellular hotspots and charged peers for "open internet access," bypassing district network filters entirely.
• Flipper Zero: The Flipper Zero was raised as a potential threat for physical access, particularly if school door systems use default keys for HID class readers, allowing easy cloning of access badges.

Blue Team Defensive Strategies and Challenges:

• Training and Awareness:
• Internet Hygiene and Password Policies: Crucial for all users, starting young (e.g., 5th grade) with concepts like passphrases over simple passwords. Education on the dangers of brute-forcing NLM hashes (e.g., an 8-character NLM hash can be cracked in 2 hours with two Nvidia 5090 GPUs) is vital.
• Real-World Consequences: Sharing stories of individuals who faced legal repercussions for hacking (e.g., jail time) can deter students.
• Negotiating with Unions: Integrating security awareness training into teacher contracts can address "work to rule" periods and ensure consistent participation.
• Network Segmentation and Filtering:
• Micro-segmentation: Essential for isolating IoT devices and segmenting networks (e.g., putting them off the standard network, limiting accessibility to correct channels).
• Walled Gardens for K12 Email: Implementing strict email filtering, especially for elementary and middle school students, preventing external emails from reaching them and limiting their ability to email outside the district.
• Controlled Email Publishing: Only publishing district-registered email addresses for students, never personal ones, to prevent third-party vendors from exposing student personal emails.
• Application Vetting and Purchasing Policies:
• Formal Vetting Process: Districts must establish a rigorous process for vetting all software and applications, especially those requiring Single Sign-On (SSO) via Google or Microsoft accounts. This ensures compliance with FERPA, CIPA, COPPA, HIPAA, and state laws (e.g., NY Edlaw 2D).
• Teacher Involvement: Requiring teachers to conduct initial investigations into requested applications can reduce the volume of unvetted requests.
• CoSN Guidelines: Leveraging resources from organizations like CoSN (Consortium for School Networking) for guidelines on purchasing and vetting processes.
• Purchasing Restrictions: Implementing policies that prohibit teachers from purchasing and bringing in unapproved IoT devices or other hardware, potentially by not reimbursing them.
• Physical Security Measures:
• Securing Neglected Access Points: Addressing vulnerabilities like propped-open janitor or service department doors, which bypass front-door security.
• Hardware and Network Inventory: Maintaining detailed inventories of hardware, network ports, and authorized devices to control access (e.g., knowing which USB ports can be open in which labs).
• IDF Closet Protection: Securing Intermediate Distribution Frames (IDFs), especially in old buildings where they might be co-located with slop sinks, to prevent water damage or unauthorized access.
• Empowering IT Staff and Self-Service:
• Adequate Staffing: Acknowledging that many IT departments are severely understaffed (e.g., one IT person for 1,700 students), which leads to Shadow IT when staff bypass controls for quick fixes.
• Self-Service Options: Providing legitimate self-service tools for teachers to address minor issues without resorting to shadow IT.
• Proactive Student Engagement:
• Student Help Desks: Establishing student help desks provides practical experience, channels student tech interest productively, and offers an "amazing way to get in front of" and provide interventions for tech-savvy students.
• Hacking Clubs/Esports: Fostering interest in cybersecurity through ethical hacking clubs (e.g., "Cyber Ranger Battalion," "Unit 18/19") or esports clubs. This provides a safe environment for experimentation and mentorship, teaching valuable skills while emphasizing ethical boundaries ("Don't go to jail").

Demo / Proof of Concept

▶ Watch: Red Team: Targeting payroll and financial data (6:22)

While the talk did not feature a live, interactive demonstration in the traditional sense, speaker Navaar Johnson shared a compelling proof of concept from a security awareness campaign he conducted. He revealed that he had obtained permission to create a voice clone of his superintendent from a YouTube video. He then presented two audio samples—one real, one AI-generated—to faculty and staff, asking them to identify the authentic voice. Approximately 30% of participants incorrectly identified the AI-generated voice as real. This experiment served as a stark demonstration of the increasing sophistication of AI-driven phishing and social engineering attacks, particularly vishing, highlighting how easily individuals can be deceived by seemingly legitimate communications that lack traditional indicators of fakery. This practical example underscored the challenges of current security awareness training against advanced threats.

Defensive Implications

▶ Watch: Red Team: Rationale for student identity theft (6:52)

The insights from this DEF CON session provide a robust framework for educational institutions to bolster their cybersecurity posture. Defenders must adopt a multi-layered, adaptive, and community-centric approach:

1. Comprehensive Human-Centric Security: Prioritize continuous, engaging, and context-specific security awareness training for all stakeholders—students, teachers, and staff. This must go beyond basic compliance to address advanced threats like AI-enhanced phishing and MFA fatigue. Training should incorporate real-world examples, emphasize the value of data, and foster a culture of skepticism. Negotiating with teacher unions to integrate security training into professional development days can ensure broader participation and compliance.
2. Robust Data Governance and Application Vetting: Implement a stringent, well-documented application vetting process for all software and services, especially those requiring SSO. This must explicitly address data privacy regulations (FERPA, CIPA, COPPA, state-specific laws) and security posture. Establish clear purchasing policies that prevent the introduction of unapproved Shadow IT and insecure IoT devices into the network. Leverage resources from organizations like CoSN for best practices.
3. Proactive Network Segmentation and Access Control: Deploy micro-segmentation strategies to isolate critical systems, sensitive data, and vulnerable devices (e.g., IoT, guest networks). Implement strict email filtering, particularly for younger students, creating "walled gardens" to minimize external threats. Maintain comprehensive hardware and network inventories to manage and control access to physical ports (USB, Ethernet) and ensure appropriate security configurations for authorized devices.
4. Physical Security Reinforcement and Awareness: Conduct regular physical security assessments, paying particular attention to often-overlooked entry points like service doors and IDF closets. Implement and enforce policies for securing physical spaces. Educate staff about the human element in physical security, emphasizing vigilance against unauthorized access and the risks of actions like propping doors open. Regularly audit access control systems (e.g., HID card readers) to ensure they are not using default keys vulnerable to tools like Flipper Zero.
5. Empowering and Mentoring Students: Recognize students as potential assets rather than solely threats. Establish student help desks, cybersecurity clubs, or ethical hacking groups to channel their technical curiosity productively. Provide mentorship, resources, and safe environments for experimentation, teaching ethical hacking principles and career pathways in cybersecurity. This proactive engagement can transform potential insider threats into future defenders.
6. Adequate Resource Allocation and Self-Service: Advocate for increased funding and staffing for IT and cybersecurity departments in educational institutions. Where staffing is limited, explore and implement secure self-service tools that empower teachers and staff to resolve minor technical issues without resorting to Shadow IT or bypassing security controls.

Key Takeaways

• Educational institutions are "soft targets" with unique vulnerabilities, primarily due to open environments, limited resources, and sensitive student data, making them attractive to diverse adversaries.
• The human element is the weakest link, with phishing (now AI-enhanced), MFA fatigue, weak passwords, and physical complacency being critical entry points for attackers.
• Students are a significant insider threat (and asset); their tech-savviness, if unchanneled, can lead to security circumvention, but if nurtured, can develop into future cybersecurity talent.
• Comprehensive defense requires multi-layered strategies, including robust security awareness training, strict application vetting, network micro-segmentation, and reinforced physical security measures.
• Balancing security with the educational mission is a constant challenge, necessitating adaptive policies that protect data and systems without unduly hindering learning or innovation.
• Community engagement and mentorship are vital, transforming the collective experience into actionable defensive strategies and fostering the next generation of cybersecurity professionals.

About the Speaker(s)

Navaar Johnson is an IT Administrator for a K12 school district in upstate New York. With approximately 15 years of experience in the education sector, he brings a deep understanding of the unique technological and security challenges faced by schools. He has witnessed firsthand the evolving landscape of educational IT and is passionate about protecting students and fostering technological growth through initiatives like student help desks.

Sam Comini is a seasoned Security Professional with over 25 years of experience in security consulting. A long-time attendee of DEF CON since Defcon 6, Sam is deeply embedded in the cybersecurity community. He has a vested interest in education, with his wife being an educator, and is actively involved in efforts to bring educational institutions together to share unique security challenges and solutions.