When Trust Is the Target: Understanding Social Engineering

     October is Cybersecurity Awareness Month, a timely reminder that protecting our learning environment, even our digital one, is everyone’s responsibility..not just the responsibility of the IT department.

Why Schools Are Targets

     Schools depend on communication and collaboration. Every day, employees exchange information with administrators, colleagues, families, students, vendors, and community partners.

     Cybercriminals can use those familiar relationships to make fraudulent requests appear legitimate. They may also target the sensitive student, employee, financial, and operational information school districts are responsible for protecting.

Social engineering works because it is designed to resemble an ordinary interaction during a busy workday.

A Teacher’s Wake-Up Call

Consider this scenario:

     Mrs. Patterson, a high school English teacher, receives an email that appears to be from her principal. The message requests student grades for an urgent district report and includes a link where the information should be uploaded.

     The email uses familiar terminology and creates a sense of urgency. Still, something feels unusual. Before responding or clicking the link, Mrs. Patterson contacts the principal through a separate channel. She learns that the principal did not send the message.

     That brief pause may have prevented sensitive student information and Mrs. Patterson’s login credentials from being compromised.

Her decision was not about distrusting a colleague. It was about verifying an unexpected request before acting.

Recognize. Repel. Report

• Stop before acting. Urgency is often used to prevent people from examining a request carefully.
• Question the request. Consider whether the person would normally contact you this way or ask for this information.
• Check the details. Review the complete sender address, links, attachments, phone number, wording, and requested action.
• Verify through a separate channel. Call a known number, begin a new message using the district directory, or speak with the person directly. Do not use the contact information included in the suspicious message.
• Protect your credentials. Never share your password or multifactor authentication code. Legitimate technical support personnel should not ask you to provide them.
• Report suspicious activity. Use the Outlook Report Phish button for suspicious emails. Contact your TST or ITI Coach when an email, text, call, or request seems unusual.