Cybersecurity Awareness Month

Use Strong Passwords

Introduction

Compromised credentials are the single most common entry point for cyberattacks. Stolen credentials were used as the initial access vector in 22% of all data breaches, and an overwhelming 88% of basic web application attacks involved the use of stolen credentials. Across the United States, school districts encounter an average of 5 cyber incidents per week, threatening sensitive student data and school operations. The K-12 Education sector is heavily targeted and 82% of reporting K-12 school districts experienced cyber threat impacts during a recent reporting period.

Why Password Security Matters for K-12 Employees

• Protecting Confidential Student Data (FERPA Compliance)
• Preventing System-Wide Ransomware Attacks
• Securing Employee Payroll and HR Information
• Stopping Account Takeovers Across Multiple Platforms

Password Best Practices 

1. Make it Long

• Use at least 16 characters to guard against automated password-cracking tools.

2. Make it Random

• Combine UPPER, lower-case letters, numbers, special characters, and spaces.

• Use a passphrase made of 5 to 7 unrelated words (e.g., coffee-Desk-88-stapler-Blue-mountain). Passphrases are easy to memorize on the go without writing them down on a sticky note.

3. Make it Unique

• Use a different password for every work and personal account (e.g., district email, payroll portal, LMS, benefit sites).

• NEVER reuse passwords. If an external site is compromised, a unique password keeps district network infrastructure and student privacy secure.

4. Never Share It

• Never provide your password over the phone or via email.
• Never enter your password into a form access through a link from an email.
• Never share your password with anymore.

Source: (CISA, Verizon Data Breach Investigations Report - 2026, US Department of Education)

Recognize and Report Phishing

What Is Phishing?

Phishing is a common tactic used by cybercriminals to trick people into clicking harmful links or sharing private information. These messages often look like they come from a trusted source - a coworker, a district office, or even a familiar company. Staying alert helps protect you, your students, and your school community.

1. Recognize the Signs

Watch for these common indicators of phishing:

• Messages that create urgency or fear, such as warnings that your account will be closed
• Requests for personal, financial, or login information
• Suspicious shortened URLs
• Misspelled website addresses (like amazan.com)
• Polished wording that still feels “off” — AI tools can make scams look professional

2. Pause Before You Click

If something doesn’t feel right, trust your instincts. Avoid opening links or attachments from unknown or unusual senders. Instead, use your email system’s “report spam” or “report phishing” options, or flag the message for review.

3. Delete Immediately

Don’t reply. Don’t click. Don’t try to unsubscribe. Simply delete the message to keep your device and school network safe.

4. Report Phishing

If you receive a suspicious email or text, notify your school or district IT department right away.

*For GGUSD Employees

A “Report” button is now on every email. Simply click on the button to report the email as suspicious. See examples below:

Outlook Web:

Outlook 365 Client:

Outlook Classic Client ***:

***Please contact GGUSD Helpdesk for assistance if you do not see the Report Message button.

COMMON PHISHING RED FLAGS:

• A tone that’s urgent or makes you scared​

Ex: "Click now or your account will be closed"​

• Sender email address doesn’t match the company it’s coming from

Ex: Amazon.com vs. Amaz0n.com

• Unexpected communication

Ex: Emails or calls you weren’t anticipating.

• Requests to send personal info

Ex: Legitimate companies don’t ask for sensitive data via email or unsolicited calls.

• Misspelled words, bad grammar​ and odd URLs can still be a sign of phishing.

[Source: CISA, used with permission.]