The FCC’s Schools and Libraries Cybersecurity Pilot program is now open for FCC Form 484 Part 1 and we’d like to take a moment to help qualifying organizations get the most bang from their submission.
We’ve conducted security assessments on hundreds of school and library systems, and we want to highlight some key areas that you may want to consider for your Pilot project. The amount that you may be eligible for depends on your student counts for schools, and location counts for libraries, so you should be careful in your planning. Remember that you don’t get to select vendors and partners yet, that will come after you are awarded funds.
Within the eligible services category of “Monitoring, Detection, and Response” we recommend requesting the following:
- Asset and Attack Surface Management: With limited resources and far too many moving parts, it’s challenging to keep up with all the devices and software on your network or in your cloud. It’s a core theorem of cybersecurity management that you must first know about a thing before you can even start thinking about how to keep it safe and secure! Ongoing and consistent scans allow you to know about all the weird, outdated, and out-of-support things like Xerox Print Servers last updated in 1995 (Yes, we’ve seen that on a test) so that you can do the right thing… like giving it a proper burial)!
- Managed Detection and Response: It’s not fun carrying a pager. (Remember those and the codes we used to prioritize call-backs?!) If watching alerts 24x7 doesn’t sound like a good time, consider leveraging professionals to take on your endpoint security, monitoring, and alerting. Good MDR partners will also have capabilities to respond to threats, reducing their impact.
- Penetration Testing: If you want a comprehensive way to identify cyber risks and vulnerabilities in your organization, penetration testing is your best option. Remember that you should get tested from the outside and inside of your networks. Schools especially have another threat source to worry about: their students. Some partners can bundle in social engineering as well.
Remember, you can’t have your favorite vendor write your proposal for you. We know, it makes us sad too. You still need to do your own homework. However, we can provide the modern-day Cliffs Notes including advice and guidance about how best to protect your organization.
