'They're big business': What some school systems are getting wrong about cyber security