Building systems are a key point of vulnerability that facility managers must address as school districts adopt networking technologies as part of their education programs, experts say.
K-12 schools and school districts are increasingly adopting advanced technologies to aid learning and make schools more efficient and effective, but these technologies introduce risk, according to the U.S. Cybersecurity & Infrastructure Security Agency. As a result, cybersecurity risk management must be elevated as a priority for administrators, superintendents and other leaders at K-12 institutions, CISA says in a 2023 report.
The heightened risk extends to schools’ building systems, because they’re increasingly connected to the network as well, Keith Krueger, CEO of the Consortium for School Networking, or CoSN, told Facilities Dive in an interview. “Things are really changing,” he said. “Cybersecurity is a big concern because of everything [that] runs on the network.”
Bad actors are using vulnerabilities in building systems as their access point to a school’s network, Krueger said. “We’ve seen instances where facilities people have just left factory presets for security,” he said. “They’ve not changed the password, and the entire district network gets hacked because [threat actors] … have come through the security cameras. They’ve come through the HVAC system.”
Once cyber criminals access the network, they take the institution’s data, destroy backups where they can and blackmail districts, Krueger said. “You’re shut down until you pay the fees, and of course these are criminals, so you never know if you pay the ransom that you actually [get your data back].”
K-12 facility leaders that partner with technology and network leaders will be able to help provide better service to students as well as improve security, Krueger said.
“The number one thing is to really partner and collaborate with the [school district] chief technology officer, because it helps you understand the evolving needs” of the school, he said. “It goes to traditional facilities management like electricity. If every kid has a Chromebook, you need to be able to charge it.”
Above all, an understanding that the operation of facilities is no longer an independent function of the school is paramount, he said.
“They’re not independent things,” Krueger said of building systems. The systems are “all interdependent.”
Krueger advised facility managers to be part of preparations whenever schools step up the sophistication of their network.
“Having those conversations and taking part in tabletop cybersecurity experiences helps everyone who doesn’t have technology in their title,” Krueger said, “which facility people don’t [just as] the instructional people and the superintendent” don’t.
