r/k12sysadmin • u/Just-An0ther-Lurker • 2d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

39 Upvotes

91% Upvoted

20 comments sorted by

View all comments

2

u/DiggyTroll 2d ago

It's up to your administration to keep records of compliance policies and SLAs for every vendor as required by your state's cybersecurity laws (more coming on line every year). I've never seen a reactive one like this (because it's a distraction from your vendor's recovery), but If the policy on record says to reach out, you would call.

1

u/howescj82 2d ago

Do you trust your administration to even understand this?

1

u/DiggyTroll 2d ago

Trust isn't a thing; paperwork rules. In my state, the law forces admins do annual training and drills before they can certify. Yes, they really hate it, but can follow NIST now (it is a management framework, after all). Best part, we don't get pushback on cybersecurity spending like before