No Free Lunch: Combating Social Engineering in K-12 School Districts

October is Cybersecurity Awareness Month. Learn more about how the LTC can make your school’s team more cyber-aware with staff trainings, consultations, and resources →

Back in the day, saloon owners offered salty lunches at a discount to draw in big crowds. Their ingredient choice wasn’t just a matter of taste; salty foods left patrons parched and saloon owners were more than happy to sell them a beverage or two at a premium.

That practice – offering something at seemingly no cost, just to charge extra on the back end – gave  rise to the term “no free lunch”. When used as an admonition, it’s a reminder that some offers are too good to be true, with the true cost revealed only after you’re on the hook.

We could all use that reminder from time to time, especially when our “boss” emails us about a sudden emergency that only *we* can fix. But that’s not the only social engineering strategy cyber criminals use to target K-12 district staff.

The “free lunch” model from the saloon era is a vivid example of social engineering. This type of induced manipulation leaves the target vulnerable – to financial exploitation, in this case, or to turning over sensitive personal information.

A cyber criminal may try to impersonate your principal or superintendent because, as high-level leaders in your school or district, they’re trusted  as a rule and placed in a position of authority that’s challenging to question.

After all, your principal is just being nice and sending around a link to a digital birthday card for the school’s nurse. They wouldn’t send you a malicious link…right?

Gaining trust through a perceived high-value transaction is only one way to hack human trust. Another common strategy cyber criminals use to gain their target’s trust is through a false sense of urgency. It’s a very effective strategy because if the target feels pressured to act, they’re less likely to second guess why they’re being asked to take an out-of-the-ordinary action.

In school districts, these come in many forms: a manufactured emergency from your boss’ boss, a malicious thank-you or birthday card email from a trusted sender, an email that hits in the middle of the day, seems slightly out of place, but is common enough that you open it and move on. 

All of these put the pressure on the target to act fast and take the bait. When paired with another strategy, such as  relying on trust in the perceived sender, this falsified urgency can increase the likelihood that even a wary target will error on the side of action.

This elevation puts even more pressure on the target, triggering them to overlook potential red flags and satisfy their own need to meet expectations. Your principal is counting on you – and only you –  to send her three pre-paid gift cards, right, and you don’t want to let her down? That’s a request that calls for a hero.

These “human hacking” techniques, sadly, have been very successful lately.

I watched these strategies play out  in my district a few years back. We were on an e-learning day, and around noon, a bulk e-card email went out that appeared to come from leadership. In it: a thank-you card to staff for handling the schedule change. 

The card landed well, not least because of the context surrounding it. An e-learning day is enough of a break from the routine that a kind note from leadership felt normal, even welcome, rather than suspicious. The card sent recipients to a fake authentication screen, complete with an MFA prompt. 

Unfortunately, this combination of social engineering techniques (especially its reliance on trusting leadership) found its mark. Over 60% of recipients clicked through on the e-card, and of those who did, 40% had their accounts maliciously taken over.

In my district’s example, the problem is plain to see: a significant portion of our staff fell for a well-tailored phishing attack.

So, what is the solution? To start, IT staff (or anyone) cannot rewrite human nature. School staff are problem solvers who  want to be helpful, efficient, and attuned to their supervisor’s expectations. Trying to brute force a change in those baseline behaviors is effectively swimming against the current.

A layered approach: all of the above, plus a protection we haven’t discussed. That protection is culture, an institutional acknowledgment that every day, hard-working staff are exposed to these attacks, and a collective understanding that if an employee sees an email they are unsure of, they don’t immediately take action. 

When an email creates a sense of urgency, staff are  encouraged to slow down, and no employee is criticized for taking that time because they were being cautious. Emails get reported to IT for examination, and requests that fall outside the normal process get routed back through it.

These all contribute to a school-wide culture that’s more resilient to these types of social engineering. In turn, that also makes a school that fosters a collective security culture more resistant to targeted cyber attacks.

Information security is not an IT problem. As everyone in a district is a target, everyone is a soldier in the war against cybercrime. Changing culture is not bought; it is built. It takes a long time to build, and once built, it is fragile and requires constant maintenance. 

Done right, a culture built to identify social engineering and combat cyberattacks pays dividends too numerous to count. While not easy, the reward is priceless.