Page 22 - The EDGE BTS 2024

INFORMATION TECHNOLOGY

BY DON HARRIS
George Gerardo Alex Robles
Phishing Hooks Unprepared, Unprotected School Districts

School districts are considered prime targets
of phishing exploits that can be devastating for
critical infrastructure systems, but there are ways
to avoid being hooked.

Alex Robles, cyber security consultant with
Cyberpools, and George Gerardo, Information
Technology Director for Western Maricopa
Education Center, outlined defenses against
phishing in a breakout session at the AASBO
Summer Conference and Expo in Tucson.

“We all know that having Multi Factor email compromise, traditional methods like SMS
Authentication – MFA – in the first place (Short Message Service), which is the technology
substantially decreases the possibility of a behind text messages) and one-time codes are
compromised account,” Robles said. “However, susceptible to being compromised.”
these authentication methods we rely on aren’t
100% fail proof.” Research shows that 74% of breaches are due to
some form of the human element, and phishing
As reported in a breach and investigation report, was involved in 55% of breaches from 2019-2023.
between 2019 and 2023 74% of breaches were “Attackers make their email look like the real

due to the so-called “human factor.” thing,” Robles cautioned.

“These are things like phishing, where someone He mentioned a recent cyber attack on an Arizona
may be socially engineered – fooled – to give educational institution whereby a phishing email
their information,” Robles said. “This can had a malicious attachment designed to capture
also be achieved through malware or network login tokens which allowed the attackers to
interception.” bypass MFA.

But AITM attacks (Adversary-in-the-Middle), How does token hijacking work, even with MFA
which are more sophisticated, are on the rise, protection? He explained: “The methodology
according to Robles. “The attacker sets up a fake of MFA isn't broken. MFA works as intended.
version of legitimate website to get you to log in It’s the human factor that makes organizations
and steal your credentials and session token in vulnerable. There’s a gap in knowledge. It’s not
real time. So, as you login, they login,” he said. enough to set up MFA and give everyone a set of
“Although the use of MFA decreases the impact of keys and say, ‘hey you’re responsible for securing

|
22 THE EDGE BACK TO SCHOOL 2024