From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Education

Brianna Monsanto

itbrew.com

 when they are with your outdated network infrastructure.

Breakups can also be pretty eye-opening. At least, that was the case for Kenneth Burdine, associate VP and deputy CIO at the Kentucky Community and Technical College System (KCTCS). Last year, KCTCS underwent a massive network transformation to address some of the 

 student and faculty members encountered when on one of the college system’s 16 colleges.

Burdine told IT Brew the college system made the transition to Juniper Networks from an industry-standard networking provider, a move that has invigorated KCTCS users and staffers.

“I’ve been doing this for 30 years. I have a whole new outlook,” Burdine said. “I’m excited.”

 Burdine said uptime is crucial for KCTCS students, who need to complete their coursework at the school’s more than 80 campuses.

Support tickets prior to the college system’s recent overhaul were mainly related to dropped network coverage and slower connection speeds. Burdine said wireless is a “fun beast to tame” because when an issue arises, users will often do a “drive by” ticket request, meaning the request is solved before IT staffers get to it.

“By the time we answer the ticket and we go and investigate, the issue has resolved itself, thus exhausting any kind of troubleshooting methods that we have,” he said.

Addressing faculty members’ problems with KCTCS’s network had a “grapevine effect,” Burdine added, because of how tedious it was to find time to discuss the reported issues.

“By that time…they’re so busy and they have other things to worry about that they forget, or they don’t have a complete understanding of what happened,” Burdine said.

Burdine said KCTCS’s old network infrastructure was about five years old. Shashi Kiran, CMO at 

 provider Nile, said the fast rate of change on the vendor side of the network industry has shortened the lifespan of network investments for organizations.

“Networks used to be looked at as investments for a decade or more,” Kiran said. “Then, it got down to five to seven years. Now, we are seeing faster refreshes happen, particularly with the old type of networks, which are predominantly designed for static environments.”

A network overhaul for an entity like KCTCS is not an easy one given its large footprint of campuses and buildings.

“We had 3,000 units, indoor and outdoor,” Burdine said. “That’s a lot of units over 90-plus locations all across the state of Kentucky.”

However, Burdine said the deployment of the new network infrastructure was a “seamless” and non-disruptive process because the brunt of the installation process involved taking one access point (AP) down and putting the new one up.

“It took longer to climb that ladder to…take the AP down and put it up than for it to [actually] register and start taking on clients,” Burdine said.

“Because of this, we were able to implement a complete overhaul of our wireless to Juniper in less than 90 days, which, wow. I don’t know? I think it’s a world record,” he added.

Once access points were up and running, Burdine said Juniper’s Mist platform, which leverages AI to improve user experience, takes the guesswork out of troubleshooting problems.

“You could go into the issue itself and then Mist would go into whitepapers and describe what the issue is, and 99.9% [of the time] it would say, ‘This is the first action you should take, second action you should take, third action you should take to resolve that issue,’” Burdine said.

 The network upgrade has paid off for KCTCS on many fronts. Burdine said the revamp has “rejuvenated” his IT staffers because they are learning something new.

“They’re happy to have something that’s more proactive than reactive,” he said.

Kristin Russell, CEO of IT solutions provider CBTS, said KCTCS hasn’t logged any single access point-related tickets since January. CBTS has partnered with KCTCS since 2002 and assisted the college system in its transition.

“With fewer manual fixes, they can focus on higher value work for students,” Russell said.

Students have not been vocal about changes to connectivity on campus, which Russell takes as a good sign, as users typically only reach out when they encounter a negative experience.

“We take great pride in [making] sure that we’re 100% up,” Burdine said. “And I know nobody can do 100%, I’ll take 99.99999%. How about that?”

Update: Kenneth Burdine is deputy CIO. A previous version of this article stated that he was deputy CISO.

School building with Wi-Fi symbol above it.

A Kentucky college system’s seemingly seamless network overhaul

“We take great pride in [making] sure that we’re 100% up. And I know nobody can do 100%, I’ll take 99.99999%,” KCTCS Deputy CIO Kenneth Burdine says.

School may be in session for your local cyber adversary.

Malicious actors are going back to school…not to brush up on their skills, but to try to defraud the universities and colleges they enrolled in using fake or 

The fraudsters in these scenarios are known as “ghost students,” and they have become a costly problem for some post-secondary institutions. Earlier this year, the College of Southern Nevada claimed it lost roughly $7.5 million in federal aid because of ghost students. CalMatters 

 that California community colleges have distributed over $5 million in federal Pell Grants to ghost students, or “Pell runners,” since fall 2021.

Mike Cook, head of fraud insights at Socure, which handles digital identity verification, told IT Brew that universities have begun to seek out his company’s help to address the problem. Cook, who says he has examined college admission data from dozens of colleges, said the scheme is currently a “pervasive” problem. The bad actors posing as students fail to show up to class or will leave once they collect their financial aid, leading to the ghost student moniker.

“They’ll show up. It may be a chat bot, it might be deepfake, but they’ll show up to class. They will do an assignment, which is generally AI-created,” Cook said. “But they’ll do just enough to where they get paid, and then they’re gone.”

IT Brew went into detail with Cook about the phenomenon of ghost students and the behaviors associated with them.

These responses have been edited for length and clarity.

What types of schools or universities are most susceptible to ghost students?

All of them. So, everybody is going to get attacked. That’s just the nature of fraud. The ones that are successful in making sure that they don’t put money in those pockets, and they are making sure they put the money in the right students’ pockets, are those that have the right technologies in place, which many of the university systems don’t have. They’re kind of older systems. They weren’t getting attacked by fraudsters this way. And again, think about AI. It’s relatively new. Fraudsters are using it. I think they’re doing a pretty good job using AI. And so, this is a new attack vector for them. And so the universities weren’t prepared, and still, many of them are not.

What’s the motive of the malicious actor that is pretending to be a ghost student?

I believe it’s financially motivated. Some people have talked about [the adversary] getting the .edu email, and with that comes certain privileges. But I don’t think those are the main things. I do think it’s all financially motivated.

How do ghost students impact actual students at universities?

Well, it takes space. Universities only have so many people, and they only have so many classes. [Imagine] you’re two years into a two-year degree and you have to take a certain class, and it’s all booked up. What are you going to do? So, it really does impact students’ ability to be admitted and to take a class. It probably hurts the instructors because that’s got to be a bummer that 20% of people just all of a sudden don’t show up anymore.

Are there any stats that you’ve encountered on this topic that stand out?

One of the things that stood out for me…is that the names are all formal names. That’s what I noticed. I’m going through and I’m looking at the data, and I mean all the data, thousands and thousands of records, and I’m noticing “Michael,” “Michael,” “Michael.” I’m noticing “David,” “David,” “David,” “David,” “David”...It was interesting how they’re all formal names. So, either they stole a breached file that was from an organization that gathers formal names—maybe like a government source—and they were using these formal names in the advanced admissions process.

What are some ways that universities and colleges can catch ghost students in their systems?

A lot of these [schools] are online. When you’re online, it’s good and bad. You don’t get to see the person. They’re not right in front of you. There’s not cameras all over the place, which kind of scares fraudsters. But what they do have is a digital footprint. And what we’re finding with these bad actors is…because they’re using a proxy, it looks like they’re trying to come in from California, even though it could be in Russia or China. And what we’ll see is that, using that device information from the applicant, will tell you certain times that, “Oh, hey, this attack is coming from Russia, even though it looks like it’s here in California.”...The most important thing that the universities can do is scale up their fraud operations. It comes down to checking admissions in real time and stopping those guys.

Illustration a burglar ski mask with floating dollar signs in the eye holes, and a "Hello My Name Is" sticker on the mask.

What are ghost students, and why are they a problem for universities and colleges?

Socure’s head of fraud insights, Mike Cook, says the growing ghost students scheme is usually financially motivated.

Billy Hurley

Parents clocking a chocolate-smeared kid’s candy-fueled lies? Not a problem. Kids spotting digital scams better than their elders? Also not a problem, according to Infosec VP of Product and Portfolio Strategy Keatron Evans, especially ones about adult matters like unpaid tolls and unexpected Amazon orders.

“If you think of most public social-engineering attacks, they’re designed around 

 demographic, working adults, because they’re trying to compromise businesses and people at work. A lot of those things, kids find ridiculous and laugh at them,” Evans said.

That doesn’t mean kids aren’t subject to effective, 

. Young people face disturbing cyber threats, including fraudulent offers in 

Infosec, which offers enterprise security awareness training, is adding cybersecurity lessons for schools, thanks to a new partnership with nonprofit Common Sense Media (CSM).

“It gives us a way to provide that to customers without having to take the time and the resources to build it out, which could take some years,” Evans said.

Evans spoke with us about why this partnership is an important one, and how some third graders have better cybersecurity than adults.

Excerpts below have been edited for length and clarity.

Does K–12 cybersecurity training really start at “K”?

Well, it should definitely start at K now, because we start kids on mobile devices at K. We have been using iPads to take courses and learn how to do things. With the right piece of malware, or the right attacker with the right motivation, you will see, even on little kids’ apps, things popping up that they can click on that take them to places that can be harmful or unsafe.

How do you train young people to be aware of threats when some are difficult to explain to adults?

A lot of these kids were born with a mobile device in their hand. Some of the lessons that we teach them make sense right away. We don’t have to break it down like we maybe would for some adults. They teach each other as well…If we go from, let’s say, third grade up, they may have better cyber hygiene than most adults in our workplace today.

Is there a way to summarize your instruction for these kinds of threats?

Before you click anything [if] you don’t know what it is, make sure it’s okay with your parents. That’s typically the high-level messaging. Then we can get into very detailed specifics about, here are some things to look out for. If they’re offering you free currency or free things, it’s probably too good to be true. Don’t necessarily believe that until you get your parents to verify that it’s okay to do it.

Is there an obvious difference in instruction style, to reach kids versus adults?

That’s like asking, is there a difference between a kid’s show and an adult show, right?...Ninety percent of our content library that we have for the enterprise, which is who we mostly serve, would not go over well with kids. So, there is a difference in style, and I think there’s a difference in how it’s delivered and how much of it they can take at a time. Kids are a lot less tolerant of 10-minute videos. They need short pieces of content.

Why are these K–12 cybersecurity lessons important?

I think we owe it to our kids and that generation to bring them up to speed on this education. When you look at how they live their lives, they live them mostly in a digital world. They’re always on devices, so we owe it to them to, as best as we can, provide them information, to [teach] that security, because that’s the biggest risk to them. Most kids that are compromised through some type of human trafficking or child exploitation, it all starts with some type of digital communication.

Shopping cart, trolley with school stationery items on blue background.

Why Infosec Institute is adding K–12 cybersecurity to its training platform

Some third graders have better cyber hygiene than the average workplace adult, according to Infosec’s Keatron Evans.

Q&A: How kids compare to adults in cybersecurity training

Thanks to researchers at the University of Missouri, neurodivergent individuals who want to learn about cybersecurity can soon trade in their pencil and paper for a pair of virtual reality (VR) goggles and a good time.

, a VR platform that looks to prepare neurodivergent learners for a career in cybersecurity through a gamified experience, is in early stages of development. The platform, which has received roughly $850,000 in funding from the National Science Foundation, is currently being developed for Meta Quest headsets and will be released as open-source software.

So, what is it anyways? University of Missouri’s Noah Glaser and Prasad Calyam, who have been working on the platform for the past 10 months, told IT Brew that users who play USucceed will be tasked with solving escape room-like challenges that increase in complexity around cybersecurity concepts in a “futuristic space lab” setting.

“If you’ve seen an episode of Black Mirror, you have this scene with a bunch of arrays of servers,” Glaser said. “It’s kind of like that, but without the spooky undertone.”

For example, the researchers said, USucceed users may find themselves tasked with putting a halt to a distributed denial-of-service attack by completing a variety of interactive activities including scanning systems for malicious files and searching through IP addresses.

Glaser and Calyam told IT Brew that they have started to do user testing on neurodiverse individuals for USucceed and are in the process of building out different levels for the platform, which will be released as they are finished.

 Glaser, an assistant professor at the University of Missouri’s School of Information Science and Learning Technologies, told IT Brew that the research team opted to use VR as a vector for teaching because of its ability to create tailored experiences for users.

“What’s great about these immersive spaces is that we can control and manipulate an infinite amount of variables,” Glaser said. “So, if one individual is extra prone to overstimulation from stimuli, we can adapt [to] that.”

Calyam, who is the director of the Cyber Education, Research, and Infrastructure Center at the university, added that VR creates an accessible learning environment for neurodivergent individuals who find physical interactions challenging.

“In the avatar, they are more comfortable representing themselves or interacting and it gives us the ability to make mistakes without hurting people,” he said.

Along with a customized learning experience, USucceed will support its users with the help of Robi, an AI-based pedagogical agent that acts as an “encyclopedia” for cybersecurity knowledge.

“If they’re stuck, they can press a button, almost like they’re using Siri on [their] phone,” Glaser said.

 of the US population is neurodivergent, an umbrella term that includes conditions such as autism spectrum disorder, attention-deficit/hyperactivity disorder, and dyslexia. The researchers told IT Brew that the USucceed project intends to provide a pathway for a community that is often overlooked into an in-demand career path.

“Cybersecurity is more important than ever before but individuals with disabilities are oftentimes left out of these conversations and face higher unemployment rates even though there’s great paying jobs that fit their skill sets really well,” Glaser said. “The goal of this project is to provide those training and give them workforce opportunities so they can keep pace and gain access to some of these opportunities.”

And USucceed is not only for neurodiverse individuals, but also built by them. The researchers told IT Brew that they have collaborated with individuals from several of the university’s post-secondary programs tailored toward the neurodivergent communities—including Self-Determined Transition Readiness Through Individual Vocational Experiences (STRIVE), an employment skills program for young adults with autism and similar diagnoses—to work alongside them on the platform.

“In the spring of this year, we had two individuals from STRIVE come in and they had never worked in Unity,” Glaser said, adding that the individuals became fluent in the programming language by the end of the semester and created code and 3D design elements that are featured on the platform.

Calyam told IT Brew that he anticipates the project—which he says is called USucceed because of its purpose of helping students excel in cybersecurity careers—will have a much larger impact than anticipated.

“This initiative that we’re doing is going to become part of a much larger initiative that we hope to now go after to solve many related problems and build a…larger capacity for this kind of research,” he said.

Figure with VR headset surrounded by servers and security shield.

Researchers tap VR to make the cybersecurity industry accessible to all

USucceed is the brainchild of University of Missouri researchers who intend to create a pathway into the cybersecurity profession for neurodivergent individuals.

The Abby Kelley Foster (AKF) Charter Middle School has an IT team that sits in classrooms weekly, replacing screens, keyboards, and other odd parts that have been pulled out, dropped down, and yanked off during the course of a young student’s day. The IT fixers here lack the certifications and degrees often common for tech pros found in an educational setting.

In late 2023, as the Worcester, Massachusetts, middle school faced a growing number of broken Chromebooks, the school’s IT director and principal came up with an afterschool activity: IT Club. The effort has a two-fold impact: the school gets fixed-up laptops and a new class of young peers who know how to treat technology and lead by example.

The school this year has 488 fourth, fifth, sixth, and seventh graders. According to the school’s “1:1” policy, that means 488 Chromebooks—one for each student. Or more, once they start breaking.

“We went through so many Chromebooks last year. And it got to the point where it was just like, ‘How do we continue to replace these?’” Shelly-Anne Hinds, middle school principal at AKF, told IT Brew.

Gabriel Beltran, director of IT at AKF, said he thinks he and his IT department (a team of five at the moment) last year saw between 15 to 20 broken laptops monthly, and a heavy percentage came from the middle school. Some common problems found at the help desk: busted hinges leading to loose top covers, cracked screens, inoperative headphone jacks, the occasional keyboard missing the letter G.

In 2023, Beltran and Hinds came together to start the IT Club—a way to fix the Chromebooks and show kids the effort involved in fixing them. Beltran also wanted instruction that went beyond the basics of a standard computer course.

“There’s a difference between having just a computer class, which is your basic, ‘This is how you open a Word document. This is how you type. This is the internet,’ and having a computer science curriculum in the middle school,” Beltran said.

The main task during the IT club’s early sessions, Beltran said: Replace the keyboard. In the new year, the team is teaching other troubleshooting scenarios: what to do if the computer is not charging, or the cursor is not moving, for example.

IT Club students replace parts in a laptop computer. 

IT specialists on staff Caio Gravina and Marcus Valentin handle inventory and Chromebooks support for students and teachers across AKF’s three schools. On Thursdays, they instruct the students on a variety of hands-on help-desk scenarios.

“Our goal is not to make it too complex for the student,” Gravina said. “We’re trying to make them at least able to identify a problem and see how they’re able to resolve it from there. And we’re just going to be there in the background trying to mentor them as well.”

When IT Brew visited the Club on April 11, Gravina and Valentin had set the tables with Acer and HP devices, each featuring problems for the kids to find and solve with basic tools and a little dexterity.

On this day, Gravina and Valentin guided six students through the replacements of screens, cameras, keyboards, and USB cards.

Many of the IT Club leads have experience tinkering with early computers, learning largely through their own youthful determination. Beltran recalls early lessons from watching over a repairman’s shoulders as he fixed the family computer. Valentin remembers replacing a power supply as a young IT enthusiast (“even though it didn’t fit the chassis properly,” he said.)

The benefits of a gathering like IT Club go beyond repaired Chromebooks. Middle-schoolers have a chance to be problem solvers.

“That student probably has a chance to fix something that applies to their whole family,” Gravina said.

Valentin added that the problem-solving skills extend to a variety of technologies outside the school. Maybe a refrigerator stops working, Valentin suggested; the students can think critically about the kitchen appliances or electronics in a different way.

“You have to really think about what there is to a system in order to really troubleshoot it,” Valentin said.

Beltran said he sees about 10 to 15 broken devices per month these days. Still a little too high for his taste, he said, but he believes the IT Club's young tech exemplars will help to lower the number of broken Chromebooks

“If the kids see the work, and how hard it is to maintain these computers and to fix them, then maybe they can be like ambassadors,” Beltran told IT Brew.

Cracked Chromebooks at Abby Kelley Foster will likely never reach zero, but Beltran hopes that, with an effort like IT Club, the numbers inch closer and closer to 1:1: One student, one fully functional laptop.

Do you work in IT or have information about your IT department you want to share? Email bill@morningbrew.com.

Apple perched in front of disassembled motherboards

Join the club: Sixth graders learn to fix laptops

A Massachusetts middle school had a lot of broken laptops. An IT Club of sixth and seventh graders aims to bring the number down. 

Eoin Higgins

Some believe the children are our future; others say computers and AI will render humanity obsolete.

The state of North Dakota appears to be trying to have it both ways with a 

 that will require a cybersecurity course as a graduation condition for high schoolers, and provide computer training for kids starting in kindergarten.

The requirements of the bill, signed by Gov. Doug Burgum in March, will 

 the first state in the US to mandate cybersecurity education for K–12 students.

, students in kindergarten through second grade will learn basic computing skills and online safety; students in grades three through five will expand those lessons into basic coding and computer ethics; grades six through eight will learn data skills; and high schoolers will have the option of elevating those skills to more advanced lessons.

 in cybersecurity, will also provide grant money for adult education centers that offer computer education programs.

 delivered at the signing ceremony, North Dakota Superintendent of Schools Kirsten Baesler praised the “years of work” from stakeholders in the schools and state government that led to the new rules.

“Our vision is to integrate and underscore the importance of computer science and cybersecurity instruction into the classes our students take as they move through our K–12 system,” Baesler said. “Under this bill, the information and knowledge our students need will be part of every grade level, which is appropriate when you consider the role that technology plays in our everyday lives.”

Tiny shopping cart filled with school supplies

Kids from K–12 in North Dakota will take computer, cybersecurity courses: new law

The change is part of an ongoing effort by Gov. Doug Burgum to prioritize computer education in the state. 

When you need to get your team on board with new security rules, one of the best techniques is to make them fun—or at least entertaining.

That was the message from Amazon Security Director Jenny Brinkley and National Cybersecurity Alliance Executive Director Lisa Plaggemier during a 

 at the RSA Conference in San Francisco this April. Training has to catch people’s attention, but, “I believe we’re living through an epidemic of boringness,” Plaggemier said.

 On April 25, Brinkley and Plaggemier told the packed crowd at the Moscone Center about techniques and tricks to spur buy-in for cybersecurity preparedness at the staffer level.

Of primary importance? An emotional appeal. Without that, staffers will go through the motions, at best, rather than taking in the information and seeing it as a call-to-action.

You can’t force people to care, Plaggemier said, but you can use tactics to get staff to respond positively to training. “Deliver it through humor,” Brinkley advised.

“If you’re not responsible for trainings within your own business, have conversations with the teams that are—getting people bought into the vision [about] the way things can evolve and change,” she added.

Cybersecurity training is of particular importance because of how much damage can be done if people don’t take basic steps to protect their company’s information. That’s hard to do when the audience is checked out.

The problem of how to get information across to a workforce that’s not predisposed to excitement about cybersecurity is sticky. Mike Hanley, CSO for GitHub, told IT Brew at RSA that he believes in first things first—consistent communication can help get the message across.

Let employees know ahead of time, send them reminders, and give them options for logging in to the training, Hanley suggested. “Communication, socializing it so that it’s not a surprise, is really big,” he said. 

A person laughing while sitting at a desk with their laptop.