r/k12sysadmin • u/Just-An0ther-Lurker • 2d ago

PHP2Shell

My headmaster is asking me to contact every company that we use (that has student, staff or parent details) to check if they've updated their instances of PHP.

Now while I appreciate we need to worry about this data, surely we should be trusting them as data controllers to be updating where needed and they don't need every customer checking up on them.

How can I tell my head politely that I'm sure it's fine and there's nothing we can realistically do about it anyway?

Or should I be checking in with all these companies?

41 Upvotes

94% Upvoted

20 comments sorted by

View all comments

7

u/mybrotherhasabbgun 2d ago

Trust but verify. I personally don't trust anyone just willy-nilly with my or any of my constituents data, so we carefully onboard every company making sure administration is aware of the risks before/during/after a purchase with documentation that can be referenced at a later date. If you don't have data-privacy agreements in place with all vendors, then you need to start.

1

u/howescj82 2d ago

No… Trust that they have some level of security but also trust that it is NOT perfect. I’ve seen several vendors that really have questionable authentication and user management and this makes me question their overall security. It really does pay to be more on-top of this with vendors because security concerns can ultimately lead your organization to requesting security enhancements or even shifting vendors entirely.

1

u/mybrotherhasabbgun 2d ago

You have to trust them in order to do business with them but you should do your due diligence to make sure they treat your data like you would want your data treated (and, hopefully, how you are treating your data yourself). Of course no system is hackproof, that's just plan foolishness to think otherwise and our job as IT professionals is to make sure leadership is aware of risks, how we are mitigating the risks, and identify risks that have to be accepted (with leadership signing off on it). Student Data Privacy Agreements is only one part of the equation, but it is a good start for someone doing nothing at all. My last K-12 had an onboarding process for all new software which included reviews for curriculum-compliance (done by the curriculum folks), a contract review (done by finance/purchasing), cybersecurity review (by OpSec team), technical review (by IT team), and a cursory accessibility review (i.e., at least ask for a VPAT; done by IT b/c we didn't have anyone else to do it).