The public school systems of both Rochester and its southern suburb Stewartville have started using the cybersecurity platform Arctic Wolf, which is based out of the Twin Cities. According to Rochester Public Schools Communications Director Mamisoa Knutson, RPS had started the search for stronger digital security even before the cyber attack.
"RPS has been working on improving its overall technology security posture for quite some time," Knutson said via email. "We had been aware of the threats against educational institutions and were evaluating solutions before our cybersecurity incident this year."
RPS's initial contract with the company costs $338,326 a year. According to RPS Chief Administrative Officer John Carlson, Arctic Wolf will be added security on top of what the district's own IT workers were already doing beforehand.
Rochester school officials have repeatedly cited the spring cyber attack as one of the reasons they believe the proposed $10 million technology levy would be needed. Although the district's technology needs go beyond cybersecurity, the contract with Arctic Wolf represents a new expense for the district.
As school officials explained earlier this summer, a tech worker was working on the district's network in the early morning hours when they noticed the unusual activity that was later found out to be the cyber attack.
With Arctic Wolf, the district's network would be routinely monitored on a 24/7 basis. While answering questions about how the platform differs from what the district had been using, Carlson said the program is "not just antivirus/endpoint detection and response software."
"Arctic Wolf offers a full platform that allows us to notice behaviors and patterns in advance of an incident," Carlson wrote. "Arctic Wolf also will monitor and alert us 24/7 in the event of an active incident while proactively mitigating the threat."
Knutson said the district initially intended to start its security overhaul with an endpoint detection and response (EDR) system. She said through the process of dealing with the cyber attack, the district learned it would "need to look beyond the devices and focus on solutions that would give insight into network activity that EDRs would not necessarily provide."
Enter the big wolf.
Superintendent Kent Pekel told the Rochester School Board that although RPS chose a local Minnesota company, the district considered companies from across the country. Arctic Wolf is based in Eden Prairie, but it has a worldwide presence.
Although it has a name better befitting a snowmobile company than a digital juggernaut, it apparently "processes over 3 trillion events per week," according to its website.
Stewartville Superintendent Belinda Selfors emphasized the importance of having that constant 24/7 monitoring capability when discussing the company with her own school board this summer.
"What we've learned through this whole process is that if there is a bad actor in your system and something happens, they've been there for about six months or more — studying how things work, how things get accessed, what the patterns of behavior are so they can imitate those. ... That's how they get in."
Even though Rochester and Stewartville have pursued the same solution, cybersecurity is something that's been on the minds of school districts across the board.
The threat was on districts' radars even before Rochester's cyber attack since a similar attack happened to Minneapolis Public Schools earlier in the year.
Based on its respective needs, Stewartville's cost will be $45,756 for its first year, more than seven times less than Rochester's cost for the system. Selfors told the Stewartville School Board the investment will be worth the protection they receive.
"It is a big price tag, but if there is an incident, it's going to be much more than this," Selfors told the school board this summer. "If we were going to try to find someone to do this work, it would cost more than this in salary."
©2023 the Post-Bulletin. Distributed by Tribune Content Agency, LLC.
