Revised Summary

The Defcon Education Community session was an interactive discussion led by Navar, an IT administrator at a K12 school district, and Ancho, a security professional with 25+ years of experience. The session evolved from a planned panel into an open audience participation format with red team versus blue team exercises 0:03.

Key Discussion Points:

• K-12 schools as targets: Educational institutions are considered soft targets primarily for student data, personal information, and payroll systems rather than intellectual property. Attackers exploit student data for identity theft since students have clean credit histories that can be misused for years before detection 5:03.

• Students as insider threats: Students often bypass security controls using technical skills and powerful hardware. Many have gaming computers capable of running password cracking tools and can write their own proxies or VPNs to circumvent school security measures. One participant noted students with machines containing multiple high-end GPUs can brute force passwords quickly 13:01.

• Security vs. education balance: Educational institutions must balance implementing security controls with enabling their educational mission. Overly restrictive security measures can hinder learning, while too much openness creates vulnerabilities. This tension is evident in conflicts between IT departments and teaching staff over appropriate access levels 25:11.

• Physical security challenges: School buildings are designed to be open and accessible, making physical security difficult. While front entrances may be fortified, service entrances, maintenance areas, and network infrastructure locations often remain unsecured. IDFs in janitorial closets near water so