Presenter: Joshua Martin

Room: Cedar Room, EMU 231, Level 2

Presentation: Cybersecurity for (Nearly) Zero Dollars

Time: 1:05p-1:40p

When I first arrived at Philomath School District as a level 1 tech in 2022, passwords were stored on several different spreadsheets, or written on sticky notes. One shared domain admin account was used for most admin tasks. Printer drivers were installed manually on each workstation. Service accounts were undocumented and ambiguously named. Many services were connected to the same domain admin account the techs used. Generic and shared accounts ran rampant. Our HVAC server was a physical machine on the facilities manager’s desk, running Windows 2008, using the local Administrator account with a password of “”1234″”, firewall disabled, no antivirus, no backups, and 24/7 remote access from undocumented HVAC technicians.

To most, this is a living nightmare. To some in K12, a typical Tuesday. The reality is, K12 cybersecurity is a mess.
Public Education has been among the primary targets of cyberattacks for many years now. A single incident can cost millions of dollars. Many districts are underinsured. Some districts have had to close their doors permanently as a result.

In my position at Philomath, I had a bit of a vested interest in cybersecurity, in that it was rather important to me that I remain gainfully employed. The instant I had the power to do so, I began making aggressive changes in order to ensure that remained the case. Working within the K12 budget of “”one shiny hay penny and a firm handshake”” meant I had to get creative. It was a ton of work. I made mistakes, I stepped on some toes along the way, but ultimately we are in a far, far better position now. Not only better than we were in the past, but from what I’ve seen, better than most school districts by a decent margin.

In this presentation, I would like to share some of that story with you all, along with the free (or nearly free) tools & methods I used, in the hope that we can all work together to make life a little harder for the bad guys.