You might have seen the recent Inside Higher Ed article published in March of 2021 titled “Colleges a ‘Juicy Target” for Cyberextortion.” As if mask mandates (or lack thereof), vaccination hesitancy, the Delta Variant, and all the other disruptions that we’ve seen over the last 18 months aren’t enough, now cybercriminals have our schools in their crosshairs. And it’s not just higher ed institutions that are at risk. Someone could soon find my 5-year-old niece’s Social Security Number on the dark web if more attacks happen in K-12 systems as we start the 2021-2022 school year as predicted here.
As educational leaders, how can we possibly tackle this problem? And, how can we increase our IT systems’ overall cyber defenses amid all the critical issues we are facing right now? This example is great to demonstrate how an entrepreneurial approach can pay bigger dividends over time than a more traditional managerial approach to this problem.
The Traditional Leadership Approach
Let’s start with that traditional approach. Many leaders would look at this problem, turn to their IT professionals and ask them to provide a solution. Being the dedicated professionals they are, the IT folks would return to their offices and begin researching how to best create an impenetrable line of defense within the school’s IT systems. After a few months of research, tech specialists develop a new “cyber defense plan.”
Then, they would submit budget requests to procure the required software and hardware. Afterward, IT professionals will implement the solution with little or no notice to faculty, staff, or students expected to use the new systems. The specialists then write a new policy (with lots of technical jargon). And then, administrators send out that policy via email. This email would include 20 other new policies or “important updates” during the faculty workdays before school begins.
They have seemingly solved the problem; everyone involved gets a pat on the back for their hard work. Then, six months later, a faculty member unwittingly clicks on a phishing email. After this, the school’s IT systems are undergoing a ransomware attack that shuts down the school for two weeks. Recriminations follow; board members, parents, students, and the press are all outside the gates with pitchforks.
What happened? In this case, the school’s administrators followed good traditional management practices. These ensured that new systems were in place and that the IT professionals produced and disseminated updated policies. But here’s where the big “aha” needs to happen. With the complexities and interrelatedness of our educational leaders’ problems today, traditional management practices are much less effective than in the past.
Thinking About This Approach
I’ve always understood the crux of this type of issue through this lens: We can manage things, but we must lead people. The fallacy with the solution developed in our example is that because this is an IT issue, the assumption was only those professionals can solve it. Therefore, it requires only those experts to design and implement the perfect technical solution.
But this isn’t a problem that we can manage with purely technical means. The human element plays an enormous role, and whenever humans are in the mix, uncertainty follows. And an entrepreneurial approach is most effective in uncertain environments. In the previous example, problem-solvers did not consider the people who had to operate and interact with this new system. This is also an example of an issue on the periphery for virtually all instructors and their students. Because it’s on the edge of their primary mission, it goes to the bottom of the priority list in their minds. This leads to vulnerabilities across the broader system.
An Entrepreneurial Approach to Leadership
Now, let’s look at this issue through an entrepreneurial mindset lens. An entrepreneurial leader at a school would see the potential cyberattack as an opportunity for their campus. They would see it as a way to bring their team together around mitigating threats that can impact the entire school. Rather than IT folks heading off to develop a solution, collaborators would spend a month deeply analyzing the problem and potential solutions from an empathic perspective of the impacts on everyone involved in the school.
Collaborators identifying all stakeholders affected by possible solutions is critical. They must consider the stakeholder’s inputs and ideas to develop a solution, not after the fact. Administrators will probably see this as a peripheral problem for the instructors. So, those solving the problem will need to make it clear that instructor inclusion is essential. If the problem is not solved correctly, instructors could be impacted even more in the long run, just like the 115,000 students and all their teachers in Baltimore County Schools last year.
Once the broader team has bought in about the first steps, the team can design low-cost experiments to test ideas with input from stakeholders across the board rather than building and executing a large-scale plan. We refer to this process as micro-experimentation. It’s a critical difference between those who lead with an entrepreneurial mindset and traditional management practices. Through micro-experimentation, the school can test some of the hypotheses developed around the best solutions to deploy.
The Benefits of This Approach
In this phase, it’s critical to have input from all potential stakeholders. And, analysis of the small experiments must take place. Do the solutions work as advertised? How will the new potential rules or technology impact the core mission of the school, student learning? Do the new changes make teachers’ jobs harder or easier, and what can we do to address this new problem?
We must use this iterative, scientific method-type process over and over again to get to a solution. This solution will provide the best defense against a cyberattack. It will also critically get people involved as early as possible, determining the success or failure of the whole effort. A full, system-wide approach is taken in this process, with the human element at the center. This is opposed to a stove-piped technical solution where the human element is mostly ignored.
Closing Thoughts
Of course, there is no guarantee that any solution will be 100% effective with these types of problems. But, in this case, taking the entrepreneurial approach ensures a higher probability of success. It also leads to more positive impacts on the organization’s culture, such as creating a more collaborative and connected workforce.
In future blogs, I’ll address the more profound positive consequences on school culture when we use this leadership approach to problem-solving. When organizational leaders develop an entrepreneurial culture over time, the positive results can be widespread and lead to more than anyone would imagine possible.