Home Cybersecurity
Category:

Cybersecurity

Stay informed on cybersecurity in education. Discover tips, tools, and strategies to protect schools, educators, and students online.

CybersecurityDigital CitizenshipSocial MediaSocial-Emotional Learning

Where Do We Go from Here?

by Luann Hughes
written by Luann Hughes

I can’t stop thinking about May 24. Nineteen innocent students and two faultless teachers senselessly lost their lives. One teen, only 18 years old, was so troubled that he shot his own grandmother and murdered 21 people in what should be a place of safety– school.  

I have been in public education for 42 years. As all of us who have been around for a while can attest, there are many changes and challenges that public schools have weathered. But this continuing trend of hatred and rage has me worried and heartsick.  

The Effects of Social Media and Online Content

We are seeing the profound effect of social media, access to inappropriate information, and easy anonymous communication on those that we in public schools want most to protect– our students. In our physical world, the boundaries and restrictions are easier to maintain. But, in the world of technology, “anything goes.”  The easy access to hatred and violence online can cause children to be desensitized and create the potential for aggression. Things that people would never say to each other in a civilized conversation in our society are celebrated on social media. Make no mistake, our students are watching how adults, including our country’s leadership, behave (or misbehave) online. 

Managing and Monitoring Online Access: How?

School districts spend thousands of dollars every year trying to keep inappropriate websites off the screens of school computers. Parents face an almost insurmountable challenge in trying to keep their children away from information that should never be exposed to those of such a tender age. Our children have access at their fingertips to things that can be very harmful to them (think sexting, cyberbullying, and pornography.) There are reasons why children SHOULD have restricted access to certain content until they are adults. Children do not have the skill set, maturity, or experience to handle it. 

Digital Citizenship Needs Action, Not Just Talk 

The time has come for us to recognize this problem and take action. Digital citizenship requires more than mere lip service in our state standards and local curriculum. It must be intentionally taught and supported in the classroom. However, teachers have not been provided with the right tools to help students navigate this brave new world that technology has brought us. Technology leaders and parents must demand that funding be provided and regulations enacted to keep our children safe and smart online, both in and out of school. Additionally, it is imperative that we find better ways to use technology for recognizing students who are crying out for help. We have left our students alone to manage technology that is too much for them for too long.   

Five Ways to Take Action 

Now we ask, “Where do we go from here?”  Here are some steps we can take to 

  1. Contact your state legislators.  
    • Let them know the importance of funding ways for students to ask for help online, or help other students by reporting what they see.  
    • Stress the importance of teaching digital citizenship and safety as a required part of the curriculum.
  2. Explore some of these free resources to learn more:
  3. Get students involved on your campus to help create a Digital Safety Awareness program.  
  4. Partner with your counselors or student services department to have digital safety and awareness sessions for parents. Even better still, engage and encourage parents to help lead these sessions.
  5. Speak up often about how to be safe and healthy online. You know that your students (and your own children and grandchildren) are listening and looking to you for guidance. Learn how your students can get help online and then share with them how to use those resources. Let them know that it is OK to ask for help or tell an adult when they know someone who needs help.

I have talked about this for too long without taking enough action to correct the problems that unsafe online access is creating for our students. I’m ready to take action. Will you join me?

0 comments
0 FacebookTwitterPinterestLinkedinEmail
CTO/CIOCybersecurityTechnical Support

What Your Tech Director Wants You to Know about Cybersecurity

by Luann Hughes
written by Luann Hughes

Gone are the “good old days” when the only emails we had to worry about were from a Nigerian prince asking for half a million dollars or an occasional threat of a computer virus. Your tech director has been faced with many new threats to school technology assets– networks, computers, and data security. You can be a big help in keeping your school district and your own personal devices secure by following a few time-honored adages from one of our founding fathers, Ben Franklin.

“An Ounce of Prevention Is Worth a Pound of Cure.”

Endpoint Detection and Response (EDR)

While viruses and worms are no longer the primary threat, they are still a problem for schools and your personal devices. Antivirus software has grown to meet the challenges of today’s threats. Many solutions are now “EDR” (Endpoint Detection and Response). If you have a personal device (Windows or Mac) and need some protection for your laptop or desktop, you might want to consider an EDR solution for a more comprehensive answer that includes better protection against malware, phishing, and ADT’s (advanced persistent threats.)  Just search for “best Endpoint Detection and Response solutions” to get some ideas about what might be best for your device. Getting an EDR solution for your personal device can provide good security coverage for both your device and personal data.

Your school computer most likely has the district’s endpoint protection already installed. You might check with your Technology Department to see what’s being used and if you need to check to make sure it is updated, especially over the summer. You probably have some limitations on your school laptop when it comes to downloading apps and drivers. That can be frustrating, but know your device is set up that way to keep your device, you, and your district safe. If you need something installed, check with your Technology Department.

Password Rotation

To make it harder to hack into any of your accounts, plan a password rotation schedule. No one likes having to remember new passwords, but changing passwords is an easy way to deter potential security breaches. You can also use a passphrase instead of a traditional password. A passphrase is a series of words or a sentence that will be easy to remember for you, but because it is longer than a traditional password, will be harder to compromise.

“Don’t Put Off Until Tomorrow What You Can Do Today.”

Device Updates

It is also important that you keep your device updates current. These updates are often released to help protect against new cybersecurity threats that come out. If you are using Windows 10 or 11, go to Settings, Update and Security, and then Windows Update. If you have a Mac, go to Systems Preferences and Software Update. Don’t forget about your cell phone when you are doing updates. Cell phone updates can help patch any security issues and keep your phone from being hacked. 

Your school device is probably set to update automatically but check it regularly to make sure it is updating. If you aren’t sure your device is up to date, get in touch with your Technology Department.

“When in Doubt, Don’t.”

Spoof Emails

These days, emails are the most likely source of cybersecurity threats. There are several reasons for this, but one of the primary reasons is spoofing. Spoofing is impersonating someone else via email. It doesn’t take much technical skill to spoof someone’s account. Hackers often spoof emails in order to “phish,” which is when they try to get you to do something that will benefit them and hurt you by taking your identity, personal information, or money.

It is important that you read your emails carefully before you respond. Spoofers like to target administrators in school districts, including principals. If you get an email from your principal or another administrator in the district that doesn’t seem quite right, check it out verbally with that person first. Your technology department or help desk can also help you determine if an email is legitimate.

You might encourage your principal to start all of his/her emails with “Hello Mustangs!” or some other catchphrase that only the staff will know. It is most likely that a hacker won’t have access to that catchphrase. You can do the same with your friends and family to help keep everyone safe.

Social Media and Email Links

Look long and hard (and then look again) before you click on links on social media or in emails. If it seems too good to be true, it probably is. You can always do a search for a product or topic in the search bar of your favorite search engine to find information about the topic that is supposed to be in the link. If you do accidentally click on a link take immediate action. You should run a virus scan, change passwords, clear your browser history, and contact your Technology Department if you were using your school account and/or device.

“An Investment in Knowledge Pays the Best Interest.”

I’m hoping you find that your investment in reading this article pays the best interest– safe and happy travels online!

0 comments
0 FacebookTwitterPinterestLinkedinEmail
AdvocacyCoding/Computer ScienceCurricular StandardsCybersecurityDigital CitizenshipDigital LiteracySTEM/STEAMTechnology ApplicationsTEKS

SBOE to Consider Tech TEKS and Computer Science Update

by Jennifer Bergland
written by Jennifer Bergland

The Texas Education Agency, at the request of the Texas State Board of Education (SBOE), has been working with various groups of educators to review and revise the K-8 Technology Applications TEKS and four high school computer science courses. At the April board meeting, the SBOE approved the revisions on first reading. This triggered a required period for the public to provide comments on the new TEKS. The board will vote to approve the revised standards at their June meeting. Below is a brief summary of their work with instructions on how you can provide feedback to the board. I have also included a link to the proposed TEKS at the bottom of this post. 

Review of the Process

In order to facilitate the review and revision of a set of standards, the SBOE nominates educators, parents, business and industry representatives, and employers to serve on TEKS review work groups. Work groups make recommendations to the SBOE for revisions to the TEKS.

K-8 Technology Applications TEKS

The K-8 Technology Applications were last revised in 2011. Since then, several pieces of legislation have passed that have changed the scope and direction of the standards. In 2019, the passage of HB 2984 (86R) required the SBOE to include “coding, computer programming, computational thinking, and cybersecurity” into the K-8 Tech Apps curriculum. Also in 2019, SB 11 (86R) required the inclusion of digital citizenship and cyberbullying into the curriculum. 

Overview of the K-8 TEKS Changes

From their inception, the K-5 Technology Applications standards were grouped into grade bands (K-2; 3-5). The reviewers have recommended that the K-5 standards be broken into single grades just as they are in other content areas. Each grade level has its own set of TEKS. The different work group documents for the K-8 TEKS can be found on this TEA web page. 

The work groups also combined strands, added new ones, and even reduced the number of strands. There are now five strands instead of six. I have listed them below and provided the group’s rationale for their proposed changes. 

The primary change is the direction and rigor of the standards. The former TEKS were primarily teaching students how to use technology. With the introduction of computational thinking, coding, computer programming, and cybersecurity the TEKS are substantially more focused on building the academic skills that are involved in computer science.

My advice to teachers and school districts is to begin reviewing and studying the standards now so you will be prepared for their implementation in the 2024-2025 school year. These standards will take a much more concerted effort to implement than the ones they are replacing.

Strand Changes for the K-8 TEKS

Below are the strands the work groups have recommended. I’ve inserted the comments from the work group documents that gave rationale for their recommendations. I have also included those strands that were recommended for elimination. 

Computational Thinking – New

This strand aligns with the Computational Thinker strand in the ISTE Standards for Students and CSTA concepts for Algorithms and Programming in accordance with recommendations from the content advisors and Work Group A. Programming, coding, and computational thinking are also required to be included in the K– 8 technology applications TEKS by the Texas Education Code §28.002(c3).

Creativity and Innovation – Current

This strand promotes creating original works that showcase the knowledge students have acquired. It aligns with the Creative Communicator strand in the ISTE Standards for Students, CTE Programming and Software Development TEKS Work Group recommendations, and Work Group A recommendations. Creativity is the process and creation is the product

Data literacy, Management, and Representation (New)

This strand encourages students to use critical thinking skills and digital tools to create visual representations of gathered data or knowledge to display, analyze, and evaluate results. This strand vertically aligns with the CTE Programming and Software Development TEKS Work Group recommendations. 

Digital Citizenship (Current)

Work Group B reviewed current law and determined that this strand was still necessary. 

Practical Technology Concepts (New Name) 

This strand was previously titled Technology Operations and Concepts. It addresses the fundamental skills that students will need to use or create with technology across the curriculum and future courses. These are transferable skills in school and life. Addressing computer systems and operating systems aligns with the Computer Science Teachers Association (CSTA) standards.

Deleted Strands: 

Communication and Collaboration: 

Work Group D eliminated this strand because they didn’t feel that a stand-alone strand for Communication and Collaboration is necessary. Communication and collaboration are woven throughout the design process and there are explicit examples in other technology application strands. 

Critical Thinking, Problem Solving, and Decision Making

This strand was deleted by Work Group B because these skills are incorporated across the standards.

Creativity and Innovation

This strand was deleted by Work Group B because these skills are incorporated across the standards.

Research and Information Fluency

This strand was deleted by Work Group B because these skills are incorporated across the standards.:

9-12 Computer Science and Cybersecurity Standards

I asked John Owen to provide a brief review of the revisions that were made to the high school courses. He is the Computer Science Project Manager for We Teach_CS at the University of Texas. He was involved in the revision of the four high school computer science courses. 

“The four high school level computer science courses now under the CTE umbrella, Fundamentals of Computer Science, Computer Science I, II and III, underwent a revision process this past year which included a slight modification to the strand structure and adjustments to several student expectations in each of the courses. For the most part each course retained its original structure with wording changes to several Student Expectations to provide better clarity, relocating and consolidating several Student Expectations to under the various strands to improve the clarity and flow of the course, and a few Student Expectations added that needed to be deleted for being no longer relevant or beyond the scope of the course, or consolidated with other Student Expectations due to some duplication instances.

A significant effort was made to provide a seamless transition through these four courses to make for a seamless and logical vertical progression for the student taking two or more of these courses in sequence. Also, several of the Student Expectations from the existing topics were too closely aligned with specific languages, particularly Java, and efforts were made to create more general language describing the student expectation. For example, there were several Student Expectations that alluded to the use of object reference variables, a particular aspect of Java not always common to other languages, and broader language was used instead to enable use of other language choices.”

The different work group documents for the high school courses can be found on this TEA web page. 

TEA TEKS feedback

Providing Feedback

The deadline to provide feedback on the revised K-8 Technology Applications TEKS and/or the high school computer science and cybersecurity courses is 5 p.m., June 10, 2022. You can provide your comments using this form. 

My advice is to be very specific about what you propose. If you want to recommend the removal or insertion of text in the standards, you should create a document that can be uploaded. Copy and paste the text you want to change. Then, strike the language you want to be deleted and underline the new text you want to include. 

Here are the revised standards for Chapter 126, the K-8 Technology Applications. Here are the revised standards for Chapter 127, Subchapter O, the high school computer science and cybersecurity courses

Photo Credits:

Photo of students pointing to laptop by John Schnobrich on Unsplash

Photo of teacher helping student with coding by Mars Sector-6 on Unsplash

Photo of secure phone by Dan Nelson on Unsplash

0 comments
0 FacebookTwitterPinterestLinkedinEmail
Image of cell phone being held by person
AdvocacyBYODChromebooksCTO/CIOCybersecurityDigital CitizenshipLeadership

Top Five Questions About App Data Privacy

by Dr. Bruce Ellis
written by Dr. Bruce Ellis

In our society, few folks actually take the time to read the terms of service before installing apps on their devices. This is true for students and adults alike. If we find an app that looks like it will meet a need, we typically install it without considering what we might be giving up. Here are five questions to ask before installing apps, and then we’ll look at several helpful resources to expand your understanding of the critical nature of data privacy.

Q1:Does the app developer clearly state what data they collect and how they use that data on its website?
Q2:Does the app developer share what permissions are granted to use the app BEFORE installing the app?
Q3:Does the app identify a relatively recent date of its last update?
Q4:Does the app developer give information on their website if they handle data in accordance with the European General Data Protection Regulation (GDPR) or the Children Online Privacy Protection Act (COPPA)?
Q5:Does the app developer allow you to request that your personal data be removed?

Asking these five questions while searching for and researching apps will help you choose ones that are in alignment with your safety concerns for your students. If you don’t find the answer to any of these five questions on their app’s website, developer’s page, or privacy policy page, take the initiative to contact them and ask.

If you realize that these five questions reveal you need to brush up on data privacy concerns, here are some resources to help bring you up to speed. These resources make the biggest impact when you provide opportunities for discussion with peers, parents, and leaders in your school/district.

Data Quality Campaign

The Data Quality Campaign (DQC) is a national nonprofit policy and advocacy organization dedicated to ensuring that education data works for individuals, families, educators, communities, and policymakers. They provide many helpful resources that you might consider sharing with your peers, parents, and leaders in your district.

Image of people with lock symbol covering face

Encryption

Encryption is a common method often used to protect sensitive student information. Encryption is a common security practice, but privacy policies rarely mention it. Most commonly, encryption is mentioned in connection with billing information. Without examining its policy, there is no way to tell which data a service encrypts. De-identification is another important aspect of student data privacy on apps. Almost half of the privacy policies mention de-identification as a primary reason for collecting data. These policies are almost exclusively used for analyzing user behavior and reporting on student performance within districts.

If you are looking for more information or need help, go to Terms of Service; Didn’t Read. They may have reviewed the app already. If not, you can submit a request to help answer your question.

Image of sketches of people in a row

Parental Responsibility in Data Privacy

Parental responsibility for student privacy is a crucial responsibility. In addition to protecting their children’s privacy, parents must educate themselves about the technology their children are using. If parents allow their children to use technology without parental supervision, they could be agreeing to data tracking. In addition to educating themselves, parents should always check the privacy practices of the websites and apps they use. By ensuring these services are transparent about their data collection practices, parents can rest assured that their children’s privacy is protected.

Parents who want to learn more about taking a proactive role in protecting children’s privacy can go to one of these sites for relevant help.

  • Connect Safely – A nonprofit dedicated to educating users of connected technology about safety, privacy, and security. You can easily explore information sorted by topics and access quick guides, news, and podcasts on their website.
  • Parent Coalition for Student Privacy – This coalition focuses on being advocates with parents in helping keep their child’s data safe. Check out their website for an interactive state student privacy report card, an educator toolkit, and a parent toolkit.
  • The Education Cooperative – Helpful information to support parents in understanding legal issues such as COPPA, PPRA, CIPA, and FERPA and how it relates to the safety of their child.
Image of variety of avatars in a line

Teacher Responsibility

Teachers, too, need to educate themselves about the privacy practices of third-party developers. Connecticut has passed a law establishing a task force to study student data privacy on apps. The task force will explore whether local boards of education should adopt data contracting policies, and they will train employees on best practices. The law will also develop a list of websites and software approved by the state and approved by school districts. By providing more information about the privacy practices of third-party providers, parents will feel more comfortable with these platforms.

Each district is responsible for managing student data generated within the school environment and on school devices. The following points can help teachers know how they play a critical role in ensuring student safety. Ignorance of your responsibilities as an educator does not protect you. Seek out the information to be an informed and proactive educator and advocate for your students.

  • Contact your Technology Department and ask where they provide training for educators on digital citizenship, student online safety, and best practices in relation to using apps and digital devices in the classroom.
  • Contact your Professional Development Department (or HR) to find out what resources are available to help teachers better understand their role when using technology with students.
  • Contact your local educational service center (or state education association) for information on student data privacy they’ve already prepared and made available. Sometimes this is posted on their respective websites; sometimes, you will need to call and track down the person with the information.

While most students are comfortable sharing their social-emotional learning survey results, they may be less comfortable sharing their social-emotional learning results with a school or other third party, for example. Regardless of the level of privacy concerns, a student’s privacy is the most important thing parents, teachers, schools, and he or she can protect.

0 comments
0 FacebookTwitterPinterestLinkedinEmail
AdvocacyCoding/Computer ScienceCybersecurityTechnology ApplicationsTEKS

Technology Was a Hot Topic at April’s SBOE Meeting

by Jennifer Bergland
written by Jennifer Bergland

The Texas State Board of Education (SBOE) met the week of April 5-8. At this meeting, the board heard from the Commissioner of Education. It also dealt with several issues that pertain to technology policy that affect Texas schools.

Commissioner Update

Commissioner Mike Morath

At each meeting, the Commissioner of Education, Mike Morath, updates the board on items pertaining to Texas schools. He usually provides the board with pertinent updates and then answers questions posed to him by individual board members. At the April meeting, he provided them with a summary of the TEA’s 2021 Annual Report. The report focuses on key areas of achievement based on the Agency’s Strategic Priorities: 

  • Recruit, Support, and Retain Teachers and Principals
  • Build a Foundation of Reading and Math
  • Connect High School to Career and College
  • Improve Low Performing Schools 

Morath began by reviewing the historical performance data. As most people already are aware, COVID had a negative impact on student academic performance. One noteworthy observation is that, in the past, the commissioner tied the negative academic performance to virtual learning. In my opinion, in this review, he properly attributed the learning loss to the COVID pandemic. Although virtual learning is a part of that calculus, it is a false assumption to blame the academic struggles our students exhibited during the pandemic entirely on virtual learning. A myriad of factors contributed to our student’s learning loss, and each one needs to be addressed. 

Morath also discussed the Teacher Vacancy Task Force, which was launched on March 10. He provided the board with the data the task force will use to frame their discussions. 

I found the commissioner’s presentation and the questions that some of the board members asked after his presentation to be very enlightening. The board members’ questions seemed to reflect the issues facing teachers and the board’s constituents.  

Technology Applications and Computer Science Standards Revised

Photo created by Patrick Amoy on Unsplash

The board had two agenda items related to the proposed revisions to K-8 Technology Applications TEKS and four high school computer science courses. They considered and voted to accept the proposed changes to the K-8 Technology standards on first reading. This triggers a period for public comment. When this time is published in the Texas Register, TCEA will communicate where and how individuals can provide their input through the TCEA Community and our social media accounts. This public comment period is the last chance practitioners have to provide feedback before the board votes to approve the standards in June. 

The board also considered and voted to approve the proposed changes to Fundamentals of Computer Science, Computer Science I, Computer Science II, Computer Science III, Foundations of Cybersecurity, Digital Forensics, and Cybersecurity Capstone on first reading. A public comment period will also be announced in the Texas Register. TCEA will communicate this via our communication channels as well. 

The Long-Range Plan for Technology Is Getting an Update

TEA is in the process of reviewing and updating the Long Range Plan for Technology. They provided the board with an update on their progress. The plan was approved by the SBOE in 2018. And state law requires it to be updated at least every five years. TEA has chosen to begin that process now because of two issues.

Device Refresh Cycles

Due to the COVID pandemic, most Texas school districts have provided each student with a device they can take home. For years, having a device for every student has been in the Long Range Plan for Technology. However, before the pandemic, it seemed almost unobtainable. COVID suddenly made this a reality due to the need for school districts to provide instruction virtually. TEA wants to update the plan to include guidance on methods for refreshing these devices. TEA and school districts have discovered that a device receives significant wear and tear when transported between home and school every day. To maintain the 1:1 device-to-student implementation, districts will need to make plans for a device refresh cycle. 

Cybersecurity and Ransomware

The other issue TEA wants to update in the LRPT is the issue of cybersecurity and ransomware. School districts have increasingly become a target for cyber and ransom attacks. Therefore, it’s important for the state’s plan for technology to address this vital safety concern. 

Some of the SBOE members had additional questions about at-home wi-fi access and protecting students from objectionable content. TEA indicated these issues are being addressed through other initiatives, but, more than likely, they will also be included in the LRPT.

Internet Safety Policy

Keven Ellis, SBOE Chairman

There has been an increased interest in ensuring that students do not access pornographic content via the Internet. Chairman Keven Ellis announced that he plans to include an agenda item at the June SBOE meeting. This item would add a requirement to the Texas Education Code (Chapter 66.105) for districts to certify they have an Internet safety policy. This would be included in the required certification districts make to access their Instructional Materials and Technology Allotment.

He referenced the federal code that requires districts to have an Internet safety policy before accessing and using E-rate discounts. Chairman Ellis said that TEA staff indicated that 85% of Texas school districts utilize the E-rate discounts and, thus, currently certify they have such a policy. He wants to include such a requirement in the Texas Education Code. This would ensure that 100% of school districts are mandated to have and enforce an Internet safety policy. 

In Conclusion

As you can see, technology policy was one of the major topics of discussion at this month’s SBOE meeting. TCEA is committed to monitoring these items as they make their way through the process. We will let you know when and how you can let your board member know what you think about these issues.

0 comments
0 FacebookTwitterPinterestLinkedinEmail
phone, pencil, earbuds, and eyeglasses
CTO/CIOCybersecurity

Cybersecurity Resources for Planning, Prevention, and Safeguarding Data

by Miguel Guhlin
written by Miguel Guhlin

As Cybersecurity Month 2021 looms, I am reminded of two incidents that occurred under my watch as a technology director. The first was a ransomware attack due to a Yahoo email attachment. At an elementary school, the ransomware knocked the point of sale food service computers offline. The problem had hit right after lunch. But no one reported it until late in the day. Consequently, I scrambled the team and descended on the campus at 4 p.m. on a Friday afternoon. Then, the second ransomware attack came. As a result of this attack, five years of federal reporting data went missing. With a data protection impact assessment or privacy impact assessment, the issues might have been lessened. It was all preventable if only district staff had listened to recommendations.

“I don’t think there’s a school district in America that doesn’t have important digital assets sitting on a computer somewhere that needs to be protected,” said Michael Kaiser, executive director of the National Cybersecurity Alliance. “We know schools sometimes don’t like to report incidents. Responding right away and bringing in law enforcement should be encouraged.”

Source: Cybersecurity in K-12 education

Recent Cyber Incidents

In August of 2021, there were 84 cyber incidents worldwide. Those accounted for 60,854,828 breached records (source). Here are a few more in the last few months, which affected school districts in the United States:

September 2021 wasn’t looking any more promising than August. For example, at the time this blog entry was written, North East ISD in San Antonio, Texas reported a potential breach as well. Would anyone argue that there isn’t a problem?

Have You Seen This?

If you go to StopRansomware.gov, you will access a resource from the United States Government. Once there, you can access resources, a newsroom, see alerts, and report ransomware.

NBC News Reports Leaked Children’s Data

In their article Hackers Are Leaking Children’s Data — and There’s Little Parents Can Do, NBC News reported data breaches for over 1,200 school districts in 2021. Here is just some of the harrowing information from the article:

“Some of the data is personal, like medical conditions or family financial statuses. Other pieces of data, such as Social Security numbers or birthdays, are permanent indicators of who they are. Their theft can set up a child for a lifetime of potential identity theft.”

“One of those [files], still posted online, is an Excel spreadsheet. It lists approximately 16,000 students. That is, roughly, the combined student population of Weslaco’s 20 schools last year. It lists students by name and includes entries for their date of birth, race, and gender.  Social Security number is indicated as well as whether they’re an immigrant, homeless, marked as economically disadvantaged. It also flags those potentially dyslexic.”

cybersecurity week

Safeguarding Sensitive Data

What can students and their parents do? Check out some suggested steps, including freezing student credit while they are still underage.

You can also get a copy of my free guide Safeguarding Sensitive Data: Data Breach Prevention and Response Plan. It’s available as a Google Doc or an electronic ebook (ePub format). In it, you will find suggestions on prevention. You will also find policies to put into place which I developed to guide my school district’s efforts. Is your organization ready for ransomware and data breaches?

Explore Relevant Resources

In the meantime, what can school districts do? Focus on prevention with proactive measures instead of being reactionary. Most importantly, safeguard against ransomware and cyberattacks. In addition, provide professional learning for all staff on how to protect sensitive data. Finally, take the time to review cybersecurity resources and guides like the resources I provide here.

cybersecurity week

Resource #1: The Cybersecurity Workforce Training Guide

Not sure where to start? Explore the Cybersecurity Workforce Training Guide released in August of 2021. The guide helps professionals develop a training plan. It also provides over 100 training resources and certification prep courses for technical support. The guide is interactive and available online. At the very least, it suggests that this topic requires study.

Resource #2: National Standards for Districts

In August of 2021, the K12 Security Information Exchange (K12 SIX) shared resources that include protective measures every school district should put in place.

cybersecurity week

Resource #3: Cybersecurity K-12 Fact Sheet

Need assistance in selling the message? Grab a copy of the Cybersecurity K-12 Fact Sheet. It can help you explain the complexities of protecting your school’s data assets. For this purpose, it covers a wide variety of topics, including cyber insurance. Another great resource to consider is The Data Breach Survival Guide.

Resource #4: Statewide Cybersecurity Awareness and Training

Looking for a starting point aside from what has been shared above? Take a look at Texas’ Statewide Cybersecurity Awareness Training website. You may also find the Texas Cybersecurity Council resources worth looking into. As you may not know:

Texas Government Code 2054.519 State Certified Cybersecurity Training Programs requires DIR, in consultation with the Texas Cybersecurity Council, to certify at least five cybersecurity training programs for state and local government employees and Section 2054.5191 requires state and local government employees to complete a certified training program. The statute also requires state and local government employees to complete a certified training program.

School districts only need to have a cybersecurity coordinator to receive the training. A reporting form is available online.

Start the Work

Cybersecurity Month (October 2021) may be the time your organization takes cybersecurity, protecting against data breaches, seriously. If not, consequently, the next major network news source may find your district’s student confidential data on the dark web.

Did You Know?

TCEA offers an online, self-paced course to prepare you to protect your own and district data. It is geared towards individuals who may want to learn more about safeguarding sensitive data. Register now for TCEA’s Data Guardian course.

Feature Image Source

Photo by Dan Nelson on Unsplash

0 comments
1 FacebookTwitterPinterestLinkedinEmail
CTO/CIOCybersecurityTechnical Support

Cybersecurity Month: Resources, Data, and Information for K-12 Settings

by Emily Horn
written by Emily Horn

October is Cybersecurity Awareness Month! CISA and the National Cyber Security Alliance are keeping with the theme of “Do Your Part. #BeCyberSmart.” If you haven’t already, I would highly recommend checking out their resources for this month. They have tip sheets and one-pagers galore offered in many languages. They also have six resources available for kids on cybersecurity, which are fantastic. CISA‘s promotion and outreach this month will focus on being “Cyber Smart” (Week 1), phishing (Week 2), cybersecurity careers (Week 3), and “Cybersecurity First” (Week 4).

Cybersecurity and K-12

Why is cybersecurity becoming more and more of a “hot topic” in K-12? The 2021 EdTech Leadership Survey Report from Consortium for School Networking (CoSN) states:

“Given that the FBI, [MS-ISAC], and CISA jointly stated that K-12 is the most targeted public sector for ransomware, it is surprising that district IT leaders do not rate this risk higher.”

Whoa. I had to read that twice. The most targeted public sector for ransomware? This statement is in response to survey data indicating that cybersecurity threats, while a top priority, are generally underestimated by district technology leaders. In fact, this report says, “The vast majority (84%) don’t rate any cybersecurity threat as high risk.”

Budget challenges and this underestimation of the severity of threats make schools and districts vulnerable. Not only that, but the report found that 77% of districts do not have a full-time employee whose work is solely focused on network security. Take a look at the top challenges according to the CoSN report.

cybersecurity K-12
Table from CoSN Report

What Does the Data Say? 

In addition to the 2021 CoSN EdTech Leadership Survey Report, data from the 2020 State of K-12 Cybersecurity: Year in Review (K12 SIX) was released in March of 2021. This data showed that moving to remote learning put schools at significantly higher risk of cyber crimes. As a result of this move, cyber incidents rose drastically in the late summer and early fall of 2020.

cybersecurity incidents
Data from K12 SIX Report

Based on their data analysis, K12 SIX identified four major factors for this swell of occurrences: 

  1. Increased reliance on devices
  2. Devices used during remote learning being brought back into schools
  3. IT staff being unable to actively service devices used during COVID-19
  4. More focused efforts by threat actors during vulnerable times of the school year using more sophisticated methods

In this study, they also identified five trends in data:

  • Data breaches involving the personal information of both students and staff were the most reported type of incident.
  • A new kind of cyber threat emerged during COVID-19– class invasion– which was used to enhance and propel other incidents like denial of service and ransomware attacks.
  • Spear-phishing continues to be a problem for K-12 schools. $9.8 million was stolen from one school district alone in 2020, with the average amount being $2 million since 2016.
  • Larger schools in urban and suburban districts with higher-income communities and districts with higher proportions of students experiencing poverty are at higher risk.

What Are the Top Threats to K-12 Institutions?

types of cybersecurity incidents
Data from CoSN Report

In 2017, the Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center published a fact sheet. This document outlines the six most common online threats for school and district networks. CoSN has also rated the top five threats. Here is a list of what the two have in common:  

  1. Data Breach
  2. Denial of Service
  3. Phishing
  4. Ransomware
  5. IOT Vulnerabilities 

Both K12 SIX and CoSN refer to 2020 as a “record-breaking” year for cybersecurity incidents.  

What Do We Do Now?

Ed Tech Magazine suggests that being proactive with protocols, planning, and training staff is essential to preventing and addressing cybersecurity threats, among other measures. Additionally, CoSN agrees: “TRAIN, TRAIN, TRAIN! Make sure everyone knows security awareness is their job and who to talk to if they make a mistake.” 

Luckily, TCEA can help with this. If you know us, you know that we strive to provide educators with quality professional development in areas that are relevant and essential to the safety, well-being, and quality of education for students in Texas and beyond. That said, we have a two-day System Administrator and Technical Support Conference coming up November 4-5, and anyone can attend. Because we know cybersecurity is a top priority, we have several sponsors specializing in this area who will be available to discuss the latest and greatest trends and solutions to help with assessment, planning, and threat management. We are also offering educational sessions that address this hot topic. Take a look at the full schedule here, and if you’d like to register for the conference, you can do so here. 

Additional Cybersecurity Resources

0 comments
1 FacebookTwitterPinterestLinkedinEmail
policy
AdvocacyCTO/CIOCybersecurityDigital LiteracyFunding

Texas Legislature and SBOE Make Policy Changes Affecting Ed Tech

by Jennifer Bergland
written by Jennifer Bergland

The Texas Legislature meets every two years for 140 days. It’s a whirlwind of activity, even in the midst of a pandemic. The 87th Legislature ended their regular session on May 31, 2021. I have highlighted below some of the legislation that passed that affects educational technology, as well as a brief update on the Texas State Board of Education and its actions.

Broadband

TCEA has been working on broadband policy since 2013. We are very pleased that many of the things we have been advocating for were enacted into law in this recent session.

Governor Abbott signing HB 5

HB 5 was an omnibus bill that addressed several of the inequities surrounding broadband access. 

  • One key element of the bill established a broadband office that will be housed in the State Comptroller’s office.  
    • The office will be a resource for information regarding the expansion and adoption of broadband service in the state. It will also engage in outreach to help expand broadband service in areas that are currently underserved and unserved. 
    • The office will also create a broadband development program to provide grants, low-interest loans, and other financial incentives to expand broadband across the state. 
  • HB 5 also created a Broadband Development Account that will be used to administer the steps outlined in the bill. 
  • In addition, the bill included provisions that will assist in providing more accurate broadband maps.

HB 3853 allows electric utility companies to sell middle mile wholesale broadband to providers that would sell broadband directly to the customer. 

SB 507 directs TxDOT to adopt rules to allow broadband-only providers to use state highway right-of-ways in the same manner that other utilities currently enjoy. This puts broadband-only providers on par with other utilities that access state highway right-of-ways., thus removing a barrier to the efficient deployment of broadband.

HB 1505 creates a pole replacement program and fund that will help defray the cost of broadband installation.

Online Assessment 

STAAR Test Logo

HB 3261 puts into place the needed support for districts to administer online assessments. The state will administer almost all assessments online beginning in the 2022-23 school year. 

Use of TIMA to Administer Online Assessments

Below are the provisions in HB 3261 that pertain to the Technology and Instructional Materials Allotment: 

  • Requires the Commissioner to estimate how much money school districts need in the TIMA for technology.
  • Requires the SBOE to take into consideration how much districts need for technology (as reported by the Commissioner), as well as how much they need for instructional materials.
  • Deleted the language in the law that required districts to purchase instructional materials before they could spend their TIMA on technology.
  • Requires the SBOE to limit the size of the proclamation to 75% of the TIMA.
  • Adds four allowable expenditures for the TIMA funds.
    • Broadband services (currently allowed in TEA’s rules)
    • Broadband equipment (currently allowed in TEA rules)
    • Technology infrastructure that is necessary to ensure adequate internet connectivity
    • Personnel to train teachers in the administration of online assessment instruments

Grant to Help Fund Broadband Infrastructure

  • HB 3261 creates a grant that will help districts that do not have adequate infrastructure to support the necessary bandwidth required for online assessments.

Online Assessment Provisions

  • The bill also stipulates that no more than 75% of the available points on the assessment can be multiple-choice questions.
  • It also allows districts to administer the test on the first instructional day of the week.
  • HB 3261 prevents TEA from requiring school districts to provide a device with a keyboard for online assessments. This decision is up to the district.
  • The transition plan will begin September 1, 2021.

TIMA

When HB 1525 passed the last day of the legislative session, it enacted a budget rider that had been written in the waning days of the session. Riders convey specific instructions on how agency funds can be collected or spent. Riders may also express legislative intent and be used to provide funds for administrative functions. The HB 1525 rider reduced the amount of the TIMA by $620,690,923. This means that the legislature appropriated only $429,290,923 for the TIMA for the 2022-2023 biennium. This is the lowest amount that has been appropriated for the TIMA since its inception. 

At the June SBOE meeting, the Commissioner addressed the cut to the TIMA funds. He indicated that the cost for this biennium’s proclamation is light ($120 million), which means there are still funds available for districts to spend on technology and staff from their TIMA ($430 million). He also pointed out that the state used up to $800 million of federal CARES Act funding during the 2020-2021 school year for technology. He further suggested that there is funding appropriated in HB 1525 that can be used for technology. He finally reminded the SBOE that Texas school districts have recently received $15 billion in federal funding, for which technology is an allowable expenditure.

TEA’s website indicates that they will load the new TIMA allotments into EMAT sometime in June or July. 

TIMA May Be Used for Conference Fees

There is some good news related to the Technology and Instructional Allotment. TEA will once again allow districts to use their TIMA for professional learning fees, including the registration fees to conferences. This is something they allowed for years and then changed the policy to prohibit the use of TIMA funds for conference fees. We have been petitioning them to change this rule because the law clearly states that the allotment can be used for training personnel on how to use technology and the instructional materials. We received an email this week indicating that they have reverted to their original policy of allowing districts to use their TIMA for conference fees, but not to pay for the travel expenses to attend a conference or professional learning experience. 

Virtual Learning

HB 1468, a bill that would have allowed districts to offer virtual learning for students living within their boundary, was a casualty of the session ending before midnight on May 30. We had hoped that this issue would have been added to the list of issues that could have been discussed in a special session, but so far it has not been added. Senator Taylor, the Senate sponsor for 1468, has indicated a desire to pass this type of legislation during a special session. 

Student Data Privacy

HB 363 by Representative Van Deaver was amended into HB 1525. It requires that a company that has been approved or adopted by TEA and possesses personally identifiable student information must use the unique identifier established by the Texas Student Data System (TSDS) for any account creation, data upload, data transmission, analysis, or reporting to mask all personally identifiable student information. The company must also adhere to a state-required student data sharing agreement that includes the established unique identifier standard.  

TCEA was able to amend the bill to give districts more flexibility. The language that was changed allows districts to add to the list of data that a company can collect on a student. They also have the ability to negotiate with the company to adjust the data sharing agreement. Both of these changes were meant to help meet the district’s specific needs. 

Cybersecurity Training

There were two bills that passed that dealt with cyber security training. HB 1118 requires that any employee who uses a computer for 25% of their duties or more is required to participate in the cybersecurity training. SB 1267 only requires the Cybersecurity Coordinator to take the training and then leaves it up to the district to determine who may also participate in the training. I’ve heard the last bill signed by the Governor takes precedence over the issue when there are two conflicting bills. SB 1267 was signed by the governor after HB 1118, so SB 1267 should be the one that governs who must be trained within the district. On the DIR website, they advise that your district seek legal advice on which bill to follow. They also address these two bills in their FAQs.  

SBOE News

Technology Applications

The SBOE is currently reviewing the K-8 Technology Applications standards. Below is a timeline of the process. 

Anticipated Timeline

  • Summer 2021 – Work groups revise and review the TEKS.
  • Fall 2021 – SBOE discusses and receives initial feedback.
  • Spring 2022 – Public hearing is held and SBOE votes on the first reading and filing authorization. This triggers the 30-day public comment period.
  • Summer 2022 – SBOE adopts the revised Technology Applications standards.
  • School Year 2024-2025 – Revised K-8 Technology Applications are required to be taught.

Additional Resources

Additional information and updates will be provided throughout the review process on the Technology Applications TEKS Review, Kindergarten-Grade 8 web page.

The current K-8 technology applications TEKS are available on the TEA website.

This site provides more detailed information about the legislation that passed in the 87th legislature that affects educational technology.

Photo of Texas State Capitol taken by Dale Honeycutt on Unsplash

Photo of Jar of Money was taken by Michael Longmire on Unsplash

Photo of girl in home library by Annie Spratt on Unsplash

2 comments
0 FacebookTwitterPinterestLinkedinEmail
Sidewalk
CybersecurityTechnical Support

Sidewalk May Share Too Much from Your Alexa

by Lori Gracey
written by Lori Gracey

As you may know, I am a huge Amazon Alexa fan. I own four of these devices (two at my house, one at my office, and one in my car) and have purchased at least one for each of my relatives. The convenience and time savings that the Alexa provides me is something I don’t want to live without.

However, there are a few times that I am reminded that Amazon devices, like all technology, can also have a dark side, and this is one of those times.

Where the Sidewalk Needs to End

On June 8, 2021, Amazon will automatically enroll all of your Alexa-type devices into a new program of theirs called Sidewalk. Devices this will affect include Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers. Note the word above: automatically. This is going to happen unless you take action to stop it.

“Operated by Amazon at no charge to customers, Sidewalk can help simplify new device setup, extend the low-bandwidth working range of devices to help find pets or valuables with Tile trackers, and help devices stay online even if they are outside the range of their home Wi-Fi. In the future, Sidewalk will support a range of experiences from using Sidewalk-enabled devices, such as smart security and lighting and diagnostics for appliances and tools.”

(Amazon website)

Sidewalk is a “mesh network” that is designed to extend your Wi-Fi and Bluetooth connection range by up to a mile. This is being done to ensure that your devices that are connected to the Internet always have a strong Wi-Fi signal, including those that may be at the end of your driveway like lights. This sounds great, right? It does until you look at it a little closer.

Sharing Bandwidth

Sidewalk uses a “small portion” of your internet bandwidth to pass low-energy Bluetooth connections and 900 MHz radio signals across all those connected devices, including almost anything Amazon has produced since 2016. If your neighbors don’t have enough bandwidth for their devices to connect via Sidewalk, the program will automatically “borrow” a little bit of yours and share it with them. The goal is create large neighborhood networks.

But how much is a “small portion?” Well, to be honest, it’s really not a lot. Amazon says the total monthly data that may be borrowed from your network is capped at 500MB per account or the rough equivalent of streaming 10 minutes of HD video. That’s not the real problem.

Sidewalk and Data Privacy

While the shared network should be secure, according to Amazon, any network can be hacked. And once that happens, then your data and your devices are in someone else’s hands. That includes your security system and what is said in your home. That’s a definite “no” for me. So I took steps to ensure that none of my Amazon devices will be automatically joined to the Sidewalk program. If you want to do that, too, here are the simple steps. You only need to do this one time for all of your Amazon devices.

  1. Open the Alexa app, tap More at the bottom of the screen, and then tap Settings.
  2. Next, tap Account Settings and then Amazon Sidewalk.
  3. Turn Amazon Sidewalk off if you do not want to participate.

If you want to learn about other privacy measures you should take with your Amazon devices, check out this blog from technology guru Kim Komando.

Image from The Digital Hacker on May 30, 2021

0 comments
1 FacebookTwitterPinterestLinkedinEmail
CTO/CIOCybersecurityLeadershipTechnical Support

Checklist: Learning with Technology

by Miguel Guhlin
written by Miguel Guhlin

When schools take a look at campus educational technology efforts and how the technology is being leveraged for learning, they need to keep a few points in mind. This checklist focuses on three key areas you can use to do that. Let’s take a quick look at each area.

checklist

Key Area #1: Impacting Growth

When discussing growth, it’s almost always student growth you need to consider. That is, are students able to show growth from beginning of the year to the middle and end of the year? How about from year to year? When adapting technology for use in the classroom, you need strategies that work. You can use this free app to get some insights and access digital tools. All strategies have an effect size. What you are looking for is the pairing of one digital tool that amplifies the positive effect.

Another key checklist component is ensuring that you have a well-established coaching program. Kickstart your coaching program with this easy to use multimedia text set.

checklist

Get a copy of this multimedia text set

Key Area #2: Supporting Technology

You’re not alone if you find yourself wondering, “How long will it take to get technical support?” This particular area of the checklist focuses on technical support and response time. What’s more, it addresses two sore points with end users.

The first is being able to check the status of an help request (a.k.a. trouble ticket). In one small urban school district, the help desk lead “improved” his numbers by assigning active tickets to an inactive technician account. This made them “disappear” or appear as closed in the help desk system. Ensuring that end users can check the status of their help requests can stop fraud like that.

checklist

The second sore point? Safeguarding sensitive data. It’s important that the district or campus have a process in place for protecting data. What’s more, it’s critical that all staff be a part of that process.

Key Area #3: Planning for Anytime, Anywhere Access

checklistWondering how to provide anytime, anywhere access for students and staff? It’s been a big issue for both small and large schools and districts. One of the most important ways to achieve this is to establish clear standards for all locations. In this way, you can ensure everyone has the connectivity they must have at the point of need.

Go Even Deeper: Become a Data Guardian

You can find the best ways to secure your data and device(s), as well as what you put in the cloud, plus even more, with TCEA’s affordable, self-paced Data Guardian course. Learn more here.

Learning with Technology Checklist

Here’s the learning with technology checklist which can be used to help you gauge how you are leveraging technology. The goal is ensure a positive impact on teaching, learning, and leading at your campus. Although the checklist has evolved since its creation, you can find the original in this Google Doc.

Get the PDF version for printing (Updated: 9/2/2021)

Feature Image Source

Photo by Volodymyr Hryshchenko on Unsplash

0 comments
0 FacebookTwitterPinterestLinkedinEmail
Newer Posts
Older Posts