Full internet isolation is an underrated solution for critical systems. And it doesn't mean the students or staff themselves can't use the internet via mobile

Full internet isolation is an underrated solution for critical systems. And it doesn't mean the students or staff themselves can't use the internet via mobile devices or school-issued netbooks -- only that the critical data systems themselves aren't accessible online. Another helper technology that's underused is data diodes, which prevent two-way connections but allow one-directional data flows, such as security updates for a lab full of workstations, or in the other direction, allowing internet monitoring of a source-of-truth or sensor while preventing internet tampering. Unfortunately, distributed orgs can't as easily benefit from air gaps and data diodes, but they're effective tools when your physical boundaries align with your security boundaries such as in a lab or around a campus.