Skip to main content

What should I do when a user account is compromised?

What is a compromised user account?

An account is compromised when a valid user loses control of their login credentials because an attacker learns of their username and password. This would allow an attacker to log in to SchoolInsight and download student data as well as reroute direct deposit funds to fraudulent accounts.

There are a few common cyberattacks that cause compromises:

  • A user receives a phishing email and is tricked into entering their login credentials to a counterfeit site, which then steals their username and password.
  • A user unintentionally installs malicious software that monitors keystrokes and steals their username and password. This malware often attempts to spread by attacking other devices on the network.
  • A user utilizes the same username and password across multiple websites. If one of those sites is compromised, attackers can steal this information and use it on other sites. 
  • For schools that use Login with Google, a compromised Google Account leads to access to SchoolInsight.

A compromised account should be addressed using the following processes:

  1. Secure User Accounts
  2. Re-Establish Account Control
  3. Reactivate the User

Secure User Accounts

When an account is compromised, lock the impacted user out of SchoolInsight. This needs to occur immediately, as removing access has the potential to disrupt an attack.

To secure a compromised account, please complete the following processes:

Mark All User Roles Inactive

A user may have a number of roles in SchoolInsight, such as admin, instructor, employee portal, and/or financials user. These roles need to be inactivated to prevent compromised log ins and attacker access to sensitive data.

To inactivate an admin account:

  1. Go to District Main > Admins 
  2. Select the icon to Edit the necessary admin 
  3. Select the icon in the admin role column 
  4. Select Make Inactive 
  5. Repeat this process until all roles are inactive
  6. Click Save

To inactivate an instructor account:

  1. Go to School Main > Instructors 
  2. Select edit in the row of the necessary instructor 
  3. Set Active to No 
  4. Click Save
  5. Repeat this process for every school where the instructor has a role

To inactivate a financials user:

  1. Go to Financials Main > Employee - Single View
  2. Search for the necessary employee
  3. In the General tab select the icon to Edit
  4. Uncheck Active 
  5. Click Save

To inactivate an employee portal user:

  1. Go to Financials Main > Setup > Users
  2. Select Edit on the necessary user
  3. Uncheck Active
  4. Click Save

Forget All Saved Devices

Log the compromised user out of SchoolInsight on any saved devices. 

To log a user out of all devices in SchoolInsight:

  1. Go to Main > Employees - Single View
  2. Search for the necessary employee
  3. Select the Logins tab 
  4. In the Login Settings section, select the icon to Force Logout of All Devices
  5. Confirm Force Logout

Change the User’s Password

Change the compromised user’s password to avoid future security issues. SchoolInsight advises a long password that can be reset once it is confirmed the user has regained control of their account. 

To update a password in SchoolInsight:

  1. Go to Main > Employees - Single View
  2. Search for the necessary employee
  3. Select the Logins tab 
  4. In the Login Settings section, select the icon 
  5. Select Edit Password
  6. Enter new Password and Confirm Password
  7. Click Save

Verify Direct Deposit Account

If using SchoolInsight Financials, review the direct deposit information for the compromised user. If this information has been changed by the attacker, stop payroll for the user until the validity of this information can be verified. This ensures funds are not redirected to a different account. 

To remove the compromised direct deposit account:

  1. Go to Financials Main > Employee Direct Deposit Accounts
  2. Select Edit for the needed employee
  3. In the Paycheck Accounts section, select the icon to Clear row for the impacted account
  4. Click Save 

After these steps are completed, an attacker will no longer have access to SchoolInsight. However, it is possible that the user’s Google Account has also been compromised. You can secure their account in Google by disabling it and changing the password.

It is also possible that malicious software has been installed on the compromised user’s computer. To ensure that this malware cannot be spread on the school network, you should disconnect all impacted devices from the network, including unplugging any ethernet cables and turning off WiFi.

Please work with your cybersecurity experts to verify that any other needed steps outside of SchoolInsight have been taken. 

Re-Establish Account Control

Once attackers can no longer access SchoolInsight through the compromised user account, the incident should be investigated. This is less time sensitive due to the attacker losing access to SchoolInsight. Please engage with your cybersecurity insurance and any district or insurance provided technical experts to clarify how the compromise occurred. 

The investigation may include the following:

  • Scanning the compromised user’s devices
  • Reviewing the login history of the user’s accounts, such as SchoolInsight, email, etc. 
  • Scanning other devices on the school network that may have been affected by malware

SchoolInsight maintains a list of authenticated devices and login history, including IP addresses, for each employee. It is therefore possible to identify attacker logins based on the use of a new device from a new IP address. 

To review employee login information:

  1. Go to Main > Employees - Single View
  2. Search for the necessary employee
  3. Select the Logins tab 
  4. Review the Login History section

Once an attacker’s devices, IP addresses, and login sessions have been identified, please contact our Technical Services Organization at support@common-goal.com. We can support the investigation by querying the web pages accessed. By cross referencing this with the activity pattern and application permissions, it should be possible to understand what data the attacker viewed. 

The findings of the investigation will identify vulnerabilities and determine next steps. This could include implementing two-factor authentication (2FA), updating device management standards, engaging in security best practices training, etc. 

At minimum, the compromised user must have a secure computer in order to reestablish access. 

This may be done by:

  • Providing a new device with an organization’s standard software image/installation
  • Wiping the compromised device and performing a fresh install
  • Using the original device after it passes a malware scan 
    • Note that this is riskier than the previous two options, which ensure that any malware has been eliminated

Before re-enabling access to SchoolInsight, the compromised user should re-establish control of their email account. 

This should include the following:

  1. Log out of all devices
  2. Reset the user password
  3. Validate that the user can log in
  4. Enable two-factor authentication in the email account
  5. Validate that the user can log in with two-factor authentication
  6. Remove any unknown two-factor authentication methods

If applicable, please refer to the following article with additional Google recommendations: Google Workplace: Identify and secure compromised accounts

Reactivate the User

Once the compromised user’s devices and other accounts are secure, you can reactivate them in SchoolInsight. It is recommended to complete these processes with the user present to ensure their renewed access and to help the user with any challenges. Additionally, this allows you to confirm that you’re working with the employee and not the attacker.

There are several processes that will need to be completed to ensure the user’s access and improved security:

Reactivate User Roles

To activate an admin account:

  1. Go to District Main > Admins 
  2. In the Active column select the icon 
  3. Click Clear
  4. Select the icon to Edit the necessary admin 
  5. Check Show Inactive Roles
  6. Select the icon in the admin role column 
  7. Select Make Active 
  8. Repeat this process until all roles are active
  9. Click Save

To activate an instructor account:

  1. Go to School Main > Instructors 
  2. Uncheck Hide Inactive Instructors
  3. Select edit in the row of the necessary instructor 
  4. Set to Active to Yes
  5. Click Save
  6. Repeat this process for every school where the instructor has a role

To activate a financials user:

  1. Go to Financials Main > Employee - Single View
  2. Select the icon and check Show inactive Employees 
  3. Search for the necessary employee
  4. In the General tab select the icon to Edit
  5. Check Active 
  6. Click Save

To activate an employee portal user:

  1. Go to Financials Main > Setup > Users
  2. Select Edit on the necessary user
  3. Check Active
  4. Click Save

Send a Password Reset

A user’s password was manually updated when their account was being secured. They can now reset it to regain access to their account. 

To send the user a reset password link:

  1. Go to Main > Employees - Single View
  2. Search for the necessary employee
  3. Select the Logins tab 
  4. In the Login Settings section, select the icon 
  5. Select Send Password Reset
  6. Confirm Reset

Once the employee has reset their password, confirm that they can once again access SchoolInsight.

Enable Two-Factor Authentication for the User

A user who has experienced compromise in the past should be required to use two-factor authentication to log in. Users with two-factor authentication are a much harder target for cyberattackers. Currently, two-factor authentication may need to be configured at your district before it can be enabled for an employee. Please reach out to us at support@common-goal.com if you need to configure two-factor authentication at your district.   

To enable two-factor authentication for a user:

  1. Go to Main > Employee - Single view
  2. Search and select the necessary employee
  3. Select the Logins tab
  4. In the Login Settings section, select the icon
  5. Select Edit Login Info
  6. Set Force 2FA 
  7. Click Save

Securing the username and password of a compromised account is the customer’s responsibility. However, our Technical Services Organization is happy to answer any questions regarding these essential processes. Please reach out to us at support@common-goal.com.