A recent audit by the New York state comptroller’s office found Whitney Point Central School District’s information technology (IT) system has weaknesses that could make its network vulnerable to a cyberattack.
The audit examined the way Whitney Point CSD managed its user network from 2021 to 2023.
Auditors found the school district did not have a clear system for disabling non-student user accounts, such as those used by staff or vendors, once they were no longer needed or out of use.
The comptroller’s office said those old accounts could be used to inappropriately access data and information from the district’s network.
The audit also found the district didn’t have an IT contingency plan in case of a major disruption, such as from a cyberattack or natural disaster.
In response to the audit, the school district said it is working with the South Central Regional Information Center (SCRIC) and Broome-Tioga BOCES, which help manage the district’s technology systems, to address the issue and develop written procedures for dealing with unused network accounts.
“The SCRIC is currently working on a project to automate the creation and deletion of staff accounts,” Whitney Point CSD Superintendent Jo-Ann Sexton said in a statement. “This automation will help ensure that only current and necessary accounts are active, significantly reducing the risk associated with unused accounts.”
Sexton said the district does have an IT contingency plan, but the school board hasn’t officially approved it. She said the district will move to finalize that plan and obtain official board approval.
“We are taking this audit as a positive learning experience and will continue to improve our cybersecurity for the safety of all Whitney Point Central School District’s digital data,” Sexton said.