In this continuation of our story about LAUSD’s cyberattack recovery, we review the vital 90-day recovery plan MGT helped to organize, lessons learned, and what it means to “recover forward.” (Read part one here).
90-Day Plan
According to Rajeev Bajaj, MGT executive vice president of Education Solutions, much credit goes to the leadership team at LAUSD, including the CIO, senior administrators, and the Superintendent for activating an independent information technology task force of internal and external leaders from industry, including MGT and other organizations experienced in cybersecurity. At the outset, LAUSD wanted a 90-day plan to recover and move forward strategically, ensuring best practices based on the feedback and guidance of the task force.
MGT supported the development of the 90-day plan that translated technical tactics into a strong, strategic, long-term process for cybersecurity recovery and technology modernization. MGT addressed the implications of what digital transformation means for LAUSD and other K-12 school districts of this size and smaller.
“We facilitated and led the task force conversations, incorporating a lot of feedback as part of a continuous improvement process,” said Rajeev. “Our ability to build an inside-outside task force after the LAUSD cyberattack was critical. We had five comprehensive meetings from September through December 2022, which evolved into a community that we all value. MGT was able to bring high-quality facilitation, support, and processes for leaders and experts to work together in building a durable, sustainable plan.”
Currently, the task force is pivoting into a quarterly advisory committee beginning May 2023 bringing together private and public sector cybersecurity leaders from across Los Angeles with MGT’s continued planning and facilitation support. There was value and trust gained for both LAUSD and the participants in the development of the 90-day plan. “We all wanted a high-level, objective view of the right architecture and products for the protection of the IT infrastructure going forward,” added Rajeev.
Priorities ― Preparedness and Communications
At school districts or in any organization ― public or private sector ― MGT focuses on a proactive assessment of the client’s cybersecurity posture and preparedness, knowing what steps should be taken if an attack occurs.
MGT believes that it is necessary to anticipate that a cyberattack is going to happen, so be prepared. Being ready, being prepared, and having a playbook or plan that’s mapped out, organized, and practiced regularly helps visualize the steps required if a cyberattack occurs.
There is no such thing as 100% security, so preparedness is critical. That includes the governance of complicated organizational structures that can create pockets of “unknowns” or vulnerabilities that can slow down a rapid response to a cyberattack. Having a holistic, well-practiced cyber defense plan can help harden an organization and speed defense against cyber criminals.
According to Rajeev, “LAUSD didn’t just see this as a technology issue ― education and operations were intertwined. The Superintendent took charge in terms of recovery communications. I give them so much credit as a district. Often school districts don’t want to talk about these issues. They want to get through the news cycle. In cases of ransomware, they want to pay the ransom and get back online.”
LAUSD took a much more muscular, open approach in its response. They wanted to share their learnings, which was insightful and refreshing. It showed true leadership from the Superintendent and the LAUSD team. As an organization, they wanted to respond to this issue proactively and inform others of what they learned as a school district and everything MGT offered regarding the intersection of education and technology to continue operations. “We can all contribute by sharing what we’re learning in a variety of ways to help make other districts more informed and better equipped,” added Rajeev.
Learnings
Cyber events are becoming more frequent, particularly in K-12 systems with older infrastructure. From a technology perspective in K-12 education, there’s more modernization that’s needed to close the gap on existing vulnerabilities. The move to digital learning during the pandemic opened up school districts to hundreds of thousands of new devices and endpoints. For many schools, it was done on an accelerated timeline that didn’t necessarily start with a resilient and secure infrastructure top of mind.
MGT’s approach focuses on the integrated processes and protocols to deal with cyberattacks and enable in-school and remote learning safely. During the last three years of the pandemic, school districts had to become more open with digital access to interact with students, teachers and subcontractors through portals that were not available before. Remote learning was accelerated, ramping up new technologies quickly, without knowing what future impacts may occur. Schools needed to ensure the core mission of educating students, however, it created some new pathways and vulnerabilities in the IT environment. Inevitably, cracks can occur where bad actors slip through. MGT is working toward closing and preventing those gaps.
Recovering Forward
MGT embraced the philosophy of “recovering forward” to help assess, manage, and prioritize LAUSD’s recovery and the beginning of its technology modernization effort in a strategic, integrated way. The goal is to help define and operationalize resources and investments to take the organization forward over the next five years. The approach with LAUSD focused on security and modernization as the entry point to strategic conversations about organizational IT needs. That includes everything from additional talent headcount, tools, and software to the governance of people, processes, policies, and systems across the organization for the continuity of learning. “Much of the new technology that has entered the ecosystem is around digital learning ― how we bring our partners on the learning side to the table to make decisions on technology to ensure that it can support students with reading, math, social studies and science in a secure, accessible environment. Taking the holistic, comprehensive view is not just from a services standpoint at MGT, but also from a client advocacy perspective,” emphasized Rajeev.
“We think about the overall work of the school district and how we cohere and support that best. In this case, technology is the entry point for that conversation. We do this consistently, whether it’s building a strategic plan for a superintendent or helping to design a new innovative school model that’s aligned and comprehensive. Creating a coherent, integrated approach based on our team’s diverse expertise and experience in technology, education, and performance is the main reason organizations select MGT, it’s our differentiator.”
Long-Term Protection And Performance
MGT works on a variety of fronts from a technology, education, operations, and performance perspective at LAUSD, which differentiates MGT from other companies.
MGT’s long-term value becomes even more apparent when the problem is not obvious during the normal business-as-usual environment. Often departments in an organization act independently, securing new software or IT features without the translation or centralization of knowledge to the business operations. Individuals are intending to do the right actions for the school’s mission but without a centralized, holistic view of how all these technologies are intertwined and can impact the organization’s cybersecurity posture.
During the pandemic, technology was rushed in for remote learning, often without a comprehensive, cyber-defensive posture. This acceleration resulted in vulnerable IT environments. MGT helps organizations examine, assess, strengthen, and control the day-to-day normal activities when a cyberattack isn’t the biggest problem they are faced with from a technology or operations perspective. Technology and education need that same integrated, holistic, comprehensive approach.
Rajeev highlighted, “It’s coherence, translation, and capacity. We cohere all the elements, translate that for the organization, and then bring the diverse capabilities needed. Organizationally, we can synthesize information quickly and strategically to advance. The process never stops, it is a continuously evolving improvement process.”
The often siloed nature of IT is not unique to K-12. Organizations are moving away from the idea that technology is a separate function. MGT believes that the CIO is a central part of an organization’s core leadership team. This concept is emerging, not just in the public sector or K-12, but throughout industries because technology is central to all of the day-to-day activities and mission of an organization.
“To achieve better performance, we are enabling a governance learning framework that aligns business objectives and strategies with technology for greater clarity and decision-making at all levels of the organization,” noted Rajeev.
Social Impact
From a social impact perspective, it’s rarely realized how impactful a school district of LAUSD’s size and operation is in the community. While a school’s mission is to educate students, if children can’t get there or food service is not available, so many families, community members, and organizations in the community are affected.
A school district is a critical component of a community, not just to parents and children, but to the people that work there ― it’s massive. As the second-largest school district in the U.S., LAUSD’s reach is immense, employing nearly 65,000 individuals and providing the payroll, benefits, and other services to support their staff. Every aspect of a school district intersects with the livelihood of a community. At MGT, it is an honor to be a client partner and advocate to assess, study, and recommend strategies that can transform and improve the performance of schools and public agencies in such an integrated, meaningful way.
“We were grateful to be able to partner with the LAUSD team. During a difficult and complicated process, we helped to ease some of that burden as they now move towards a more resilient IT infrastructure. There were so many mission-aligned people working hard to deal with the crisis and still do their day job,” said Rajeev.
At the onset, MGT was aligned with LAUSD’s mission to focus simultaneously on the students’ academic, social, and emotional well-being, while ensuring their physical and digital safety and security. The gravity of the situation was intense. Rajeev concluded, “I’m a parent of two elementary school children. Their digital lives have already started. To protect their privacy and defend against cyber criminals, digital and physical safety is the next frontier in our holistic ‘student-centered’ approach to help ensure that every child has a high-quality education in a safe, nurturing environment. That’s MGT’s mission ― to impact people’s lives for the better.”
To learn more about school district solutions engineered by MGT Technology Solutions and Education Solutions, click here.
For more information about MGT’s aid in LAUSD’s cyberattack recovery, please visit https://www.mgt.us/case-studies/mgt-lausd-cybersecurity-attack/
