The recent hacking of student accounts has caused new online security changes for Hamilton Southeastern High School. These changes, including new passwords and Two-Factor Authentication (2FA), are expected to reduce the number of compromised accounts.
These recent changes are due to security concerns that have affected the school’s entire Microsoft system, including the site Skyward. Chris Reinking, the Senior Systems Administrator for Hamilton Southeastern Schools, says that these compromised accounts were due to password reuse and predictable passwords.
Password reuse, or using the same password across multiple services, is one of many unsafe online practices.
According to said Georgetown University’s Information Security Office, “Password reuse attacks occur when a hacker manages to get a password for one of your accounts, then tries using it to sign in to your other accounts.”
2FA was also implemented because it requires someone to have access to not only a password, but also a phone belonging to that same person before they can enter an account. This is due to 2FA sending a one-time code through messages to the person attempting to log in.
“Digital security requires ongoing vigilance,” Reinking said.
Although the number of hacked accounts has significantly decreased, future changes may occur. These changes may include student training on digital security, password rotations, or implementing 2FA on an increased number of school sites.
As digital security continues to change, it is important to stay alert about the best online practices. Reinking advises using a password manager, such as LastPass or Bitwarden, which are apps that store and generate passwords. He also recommends locking devices when not in use and not logging onto sensitive accounts when on public Wi-Fi.
Creating strong, unique passwords is also a key step in the online safety process. Strong passwords are often characterized as having at least 12 characters, a combination of different letters and numbers, and not being based on personal information.
Student passwords were changed in part to be less predictable due to all passwords previously following the same structure: ‘Hse’ and then student ID numbers.
HSE may have been subject to online security breaches because most student passwords previously included ID numbers, which is a piece of personal information that should not be included in passwords. The predictability of students’ passwords made sites using those passwords vulnerable to brute force attacks, where programs systematically try password combinations until they gain access to an account.
In today’s ever-changing digital world, being informed on how to protect personal information online is an important part of life. Knowing how to create and keep strong passwords is key. The damages of weak online security practices can sometimes only be learned through real-life experiences.
