Home Cybersecurity
Category:

Cybersecurity

A toy wizard commanding a windstorm
CybersecurityDigital LiteracyLeadershipProfessional LearningTechnical Support

It’s Not the Phishing, It’s Your Lack of Influence

by Miguel Guhlin
written by Miguel Guhlin

“Why did he click on that email attachment?” asked one technology director I spoke with recently. The click led to a ransomware attack that expanded to the business department’s server, resulting in frantic data-saving actions.  For many technology directors, the problem is not the phishing or the ransomware. The real problem is their lack of influence to bring about change in the organization. Consider this problem in light of a common occurrence in education today.

Knowing vs Doing

What is Known:

  • Hackers, phishers, and scammers want our personally-identifiable information. They can sell it for $10 or more on the darknet, where illegal transactions happen (think “Silk Road“).
  • Bad people send out emails to educators. These emails appear legitimate. They invite district staff to surrender their username and password and then send decrypted sensitive data and/or ransomware that use staff’s machines as a beachhead to infect the rest of the network.
  • Staff know NOT to fall for these traps, but do so anyways.

What is Done:

In spite of knowing these things, staff continue to click on phishing links where they happily share their username and password via an insecure website, send copies of confidential documents to complete strangers, or click on ransomware that encrypts their computer, then spreads to everyone else’s. These actions by a few individual wreak havoc on the whole network, and small districts especially are overwhelmed.

The Traditional Response

The traditional response involves disciplining staff, even terminating them in severe data breaches. They should have known better, right? Oh, but wait, your district does not have a safeguarding sensitive data policy in place! (Many districts do not, which is why I offer this one as a start). It involves buying and issuing hardware (e.g. Chromebooks, iPads, Macbooks) that malware (e.g. ransomware) can’t work its dark magic on (YET…you just know hackers subscribe to growth mindset, right?).

problem

It means locking down Windows computers with Active Directory policies: Deep Freeze so that technicians don’t have to spend a lot of time fixing user errors. This has been standard practice for years. Here’s a roundup of advice that should help districts who want to keep closing the gate after the livestock has made its getaway. That is, mopping up the mess after someone has been hacked, phished, or taken.

TCEA’s Roundup of Ideas for Safeguarding Sensitive Data

CTOs and superintendents should also register to attend the upcoming May, 2017 TCEA Technology Leadership Summit, as well as pay a small fee to access the audio and notes from the 2016 Technology Leadership Summit.

But what if there was another approach, employing motivation, influence, and authority?

A Fresh Approach: Influence

In their book, Influencer: The New Science of Leading Change, the authors suggest identifying vital action(s) that can be taken. These vital actions start with the desired behavior(s) that must change. Rather than try to change twelve or more behaviors staff exhibit, focus on one or two that will have the greatest results. For example, try to encourage adoption of this behavior:

Assume emails with attachments are suspect, so verify the source of the email. This can be as easy as sending a new email to the person who contacted you and asking, “Did you send me a file attachment that says, “burnbabyburn.exe?” Wait, you can even get more done. Walk over to the person who sent you the email attachment and ask them “Did you send me a file I didn’t ask for?” Or just call them or text them on your mobile phone. This ONE behavior change would stop 99% of the issues technology departments complain about (e.g. ransomware, viruses, malware as attachments, AND sending sensitive data to complete strangers).

Changing behavior

When seeking to change behavior, the authors of Influencer recommend recognizing that there are six sources of influence. Often, we take into account only the first two when trying to bring about change:

Source 1 – Personal Motivation

Make the undesirable, desirable.
Example – Do you really care if your computers gets infected with malware and you lose data? It’s not that big a deal, after all. A technician will come fix it eventually and most of your work is done on paper anyways. Instead, you must passionately care about protecting your data and that of your students. If someone tried to take one of your students hostage, you wouldn’t be so passive.

Source 2 – Personal Ability

Surpass your limits.
Example – Do you have the skills and knowledge to know when you’ve encountered an email that is intended to do you and yours harm? You probably have an idea that you shouldn’t click on bad emails. Learn what you need to be better on guard.

Source 3 – Social Motivation

Harness peer pressure.
Example – Do others on your team or your department really care about email and email attachments? Maybe they go through their spam folder looking for problematic emails because they need a break? What if everyone on your team was motivated to help each other NOT open spam emails with attachments or to practice the desired behavior?

Source 4 – Social Ability

Find strength in numbers.
Example – Who could you speak to in the district who could help you obtain the knowledge or resources you need? Maybe there’s a SafeSchools or EduHero eCourse you can take or a free ebook you can read.

Source 5 – Structural Motivation

Design rewards and accountability.
Example – When you check your email, are there a ton of emails waiting for you, so that you despair about getting through all of them and just click on anything? Maybe you can adopt Inbox Zero strategies so that email isn’t so overwhelming. Avoid sharing your confidential data (username and password) anywhere online since it can be so easily taken.

Source 6 – Structural Ability

Change the environment.
Example – Maybe your district could adopt a different communications medium that isn’t susceptible to malware email attachments, like Slack or Microsoft Yammer or Teams.

Conclusion

While this has been a lighthearted attempt to address the challenges end users face every day, it is important to realize that changing ONE behavior can result in significant change. When you go about changing it, realize that asking people to do the right thing and training them is not going to get it done. Unleash all sources of influence to bring about the change you want.

 

0 comment
0 FacebookTwitterPinterestLinkedinEmail
art aprons hanging on hooks in classroom
CybersecurityLeadership

Safeguarding Student and School Privacy

by Miguel Guhlin
written by Miguel Guhlin

Safeguarding student privacy and the security of networks remains a key priority for education leaders. In December, 2016, school leaders came together to match answers to tough questions as they heard from industry experts on ways to protect what is most important to them. In this blog entry, learn how to get access to the powerful presentations and conversations that took place.

How Do I Get the Summit Resources?

You can access the audio, presentation slides, and more of the sessions online now for a nominal fee ($49). You will need to have a TCEA log in.

What Exactly Will I Get?

Presentation slides, pictures, and  audio recordings of the high-level speakers will be yours to explore and reflect on. In addition to Bill Fitzgerald’s (of Common Sense Media) keynote, critical areas addressed include:

  • Understanding DDoS Attacks,
  • Securing Single-Sign-On (SSO)
  • Security/Privacy Legislative Panel

TCEA’s Commitment

TCEA is committed to creating professional learning and networking opportunities that address the needs of Chief Technology Officers (CTOs) and Directors/Coordinators of Technology in K-16 education institutions. Be sure to join your colleagues at the Friday, May 12, 2017 event.

0 comment
0 FacebookTwitterPinterestLinkedinEmail
Fence with padlocks affixed to individual strands
CybersecurityLeadership

Process Check: Safeguarding Student Privacy

by Miguel Guhlin
written by Miguel Guhlin

“What approaches do you have in place to safeguard student data and privacy?” From student assessment data to personally identifiable information to counting how many times students visit the restroom, administrators are working to put tracking systems in place. These systems (such as Google Sheets/Form where students submit data about themselves without parental knowledge) make it easier for schools to record and track information on students, but they may also put sensitive data at risk. What is your organization’s process for safeguarding student privacy?

What’s Your District’s Process?

“There’s no right or wrong answer,” says Bill Fitzgerald of Common Sense Media, “except to not have a process to evaluate how data will be maintained over time.” Whatever the original positive intent, each campus and/or district should evaluate how it intends to use and share collected student data BEFORE any program to gather that data is implemented. The process may include something as simple as the following:

  1. Prepare the program for a pilot implementation.
  2. Invite stakeholders, including students, parents, and educators, to meet and discuss the proposed program. Some points to ponder:
  • What are the positive and negative aspects of the program?
  • Who will access the digital data and for what purpose?
  1. What does the Committee think about objections by the Electronic Frontier Foundation (EFF) and other organizations that make these assertions (Source)?
  • While there is an expectation of supervision and guidance in schools, monitoring the detailed behaviors of individuals can be demeaning.
  • Tracking and monitoring young people in their development may condition them to accept constant monitoring and tracking of their whereabouts and behaviors.  (Source: Chip Free Schools as cited by Slate)

Conclusion

Before you purchase and implement a system that tracks students’ movements or data, give serious thought to the process steps you may have overlooked. Doing so can save time and trouble later, resulting in a safer environment.

0 comment
0 FacebookTwitterPinterestLinkedinEmail
safety
CybersecurityDigital LiteracyGood Teaching

Safety, Security, and Ed Tech

by Guest Blogger
written by Guest Blogger

This is a guest post by Anthony Mason (@edtechmason), a Digital Instructional Coach at Naaman Forest High School in Garland ISD.

If you talk to any parent, teacher, or principal, there is nothing more important than the safety and security of our students at home and at school. It’s our number one concern as educators.

However, even as we protect students from the analog world, we sometimes forget to teach them the skills they need to be safe in the complex, ever-changing digital world. These discussions need to happen every day in conversations, lessons, and interactions in order to encourage good digital citizenship and online safety. A good framework for students, parents, and teachers to follow is the Nine Elements of Digital Citizenship.

Below are five practical ways to encourage good digital citizenship habits into students’ everyday device use and keep students thinking and talking about their online experiences and interactions with the trusted adults in their lives.

  1. Set restrictions on where and when technology can and should be used. Don’t allow devices to be used at the dinner table. Don’t allow devices to be used right before bedtime. Limit the number of hours devices can be used during leisure time.
  2. Talk to your kids daily about how they are using their devices. Whenever possible, have them use devices in a common area with appropriate supervision.
  3. “Never talk to strangers” is one of the most common ways parents and teachers teach students to protect themselves. Protect students’ privacy and keep them safe by teaching them not to share personally identifiable information of any kind online, including location information (via metadata in photos) and full name.
  4. Be a positive example and role model for students to emulate. Students will not do what you say; they will do what you do.
    So never, ever drive distracted. Model appropriate use of technology in the home, classroom, and other public settings.
  5. Always remind students to T.H.I.N.K. before they post any text, videos, and/or photographs online. Is it True? Is it Hurtful? Is it Illegal? Is it Necessary? Is it Kind? Kids might not fully understand that their digital footprint is traceable and un-erasable. Recently, students have lost out on jobs and scholarships and even been kicked out of school because of negative posting online and bad digital footprints.

This is not an exhaustive list. Visit www.digitalcitizenship.net and www.commonsensemedia.org for more information on keeping our children safe and secure in a digital world and to learn more about digital citizenship. As education technology integration continues to grow and expand, parents and teachers can help students navigate the murky waters of the digital landscape with ease.

To Learn More About Digital Safety

  • The November 2016 TechEdge takes up Safety, Security, and Support, offering you stories and ideas about keeping our students and their data safe online. Watch your snail mail and email boxes for this upcoming issue.
  • On December 9, 2016, the TCEA Technology Leadership Summit: Security will be held at the TCEA Conference Center in Austin.

 

0 comment
1 FacebookTwitterPinterestLinkedinEmail
online safety
CybersecurityDigital LiteracyLeadership

Symposium on Student Online Safety Coming to Austin

by Guest Blogger
written by Guest Blogger

This is a guest blog post by Rob Yoegel for Gaggle.

The Symposium on Student Online Safety, offered by Gaggle at no cost to educators, is coming to Austin on Tuesday, October 11, at the TCEA Conference Center.

Products like Google Apps for Education and Office 365 are powerful learning tools, but they’re also like digital playgrounds without fences or recess monitors. As educators, we have a legal and moral responsibility to protect our students and help them become responsible digital citizens. The Symposium on Student Online Safety is a great start.

The symposium will bring together school and district administrators responsible for student online safety. Attendees will engage in strategic and tactical discussions with a roster of incredible presenters. You’ll leave the half-day symposium ready to have ongoing discussions regarding the role to be played in keeping students safe, especially when they’re using school-issued technology and devices.

View the full agenda and register here.

In addition to a keynote from Common Sense Education, scheduled presenters include Luann Hughes, Director of Technology at Temple ISD; Meghan Zuraw, North Texas Outreach Manager for the National Center for Missing & Exploited Children; and Sarah Orman, Senior Attorney, Legal Services, Texas Association of School Boards.

Gaggle, which has been providing safe online learning products and solutions to the K-12 market since 1999, will provide morning coffee and lunch. And in the spirit of a typical Gaggle event, they will also be giving away some cool prizes at the end of the symposium.

Here’s what attendees are saying about the Symposiums on Student Online Safety:

“I was worried this would be a vendor-dominated event–more like a sales pitch than anything helpful–but the symposium was great!”

“The symposium was all about the exchange of ideas and information to make sure we’re doing everything possible to keep our children safe.”

“Very informative and helpful. Kudos for making this much more than a sales pitch!”

“Fantastic speakers and a lot of relevant and useful information. Thank you!”

Don’t delay. Space is limited, so register today.

 

0 comment
0 FacebookTwitterPinterestLinkedinEmail
network cables plugged into an network hub
Cybersecurity

Safeguarding Sensitive Data: Part 2

by Miguel Guhlin
written by Miguel Guhlin

Ready to find out more about safeguarding sensitive data? In this second part of our cybersecurity series, we will continue exploring the different aspects of safeguarding your data. (In case you missed it, you can still read the first part of this series.) Here are some steps you can take immediately to protect sensitive data at work and home:

  • Encrypt ALL confidential data and personally-identifiable information (PII) at rest and in transit. (View this free tutorial). Assume that anyone can bypass district network security and that the computer on your desk, whether laptop, Chromebook, or desktop, can be worked on as if someone was sitting in front of it. Want to send an email or store data in the cloud? Encrypt the files and the message itself if it deals with confidential data or PII.
  • Use a password tool to generate uncrackable passwords and change them regularly. There are many password managers, like 1Password and LastPass that are online, while others can be saved on your computer or device (e.g. Keepass). You can always use a Secure Password Generator to come up with tough ones. This sure beats writing them on a post-it note and sticking them to your computer or desk (I actually saw a desk covered in these once).
  • Avoid sharing confidential data or PII with students and staff. That information can be used to create bank accounts, etc. This can also include leaving confidential data or PII on your desk at work or in your paper notebook in the car. Whether it’s digital or paper, you still have to pay for identity theft protection!
  • Shred paper copies. It doesn’t matter if you are all digital if a paper copy ends up being stolen from your desk, car, or home. Shred paper as soon as possible.
  • If it’s confidential or sensitive data, the website you are connecting to should have https:// as part of the URL. If not, refuse to enter the information in.
  • Back up your data frequently. It’s obvious, but this is something you can easily do using tools like Dropbox and GoogleDrive. Encrypt your data first before backing it up. And back it up to different places. Maybe you back it up to Dropbox on Mondays, Wednesdays, and Fridays. On Tuesdays and Thursdays, you back it up to Google Drive. If you don’t like the cloud, get a USB external drive. Just make sure to encrypt your data, one file/folder at a time or a whole drive at a time. Just do it.

Steps to Stop Infiltration

Help protect the school district against infiltrations caused by virus/malware attacks that could begin with your computer.

  • Avoid using obsolete, insecure computer operating systems. If your school district is too cheap to upgrade the computers you use, then make sure you don’t do anything personal on them. File a written request citing the need for a more secure operating system. And ask for a newer computer model with up-to-date operating system (e.g. Windows 7 or Mac OS 10.7 or greater).
  • Be careful with email attachments. Don’t just automatically double-click on the attachment someone has sent you. First ask yourself, “Is it reasonable that this person sent me an email attachment? Is the email abrupt or doesn’t make sense? Does the file attachment have an EXE extension or the filename doesn’t make sense?” If the answer to any of these questions is YES, stop and scan the file attachment with your antivirus/anti-malware program (e.g. AVG, Avast are two free ones).
  • Avoid phishing attacks. Just this year, I received an email from a lawyer that purported to be a GoogleDoc, but was a phishing scam (Find out more).
  • Make sure your home computer is protected from viruses and malware. Anti-virus/malware software is available at no cost for personal, home use. Your district should have an enterprise anti-virus/malware solution for your work equipment.
  • Add a password or WiFi key to secure and encrypt your home wireless access. It’s so easy to “sniff data packets” these days (I tried it with free tools and was shocked how easy it was) that you need to prevent unauthorized access to your wireless. (In some cases, this means upgrading your wireless router’s firmware.)
  • Avoid “dodgy” sources of software or apps. These days, you can get your software/apps from approved creators/developers or somewhere else. Most of us should stick to only approved outlets for software because “somewhere else” sources sometimes result in “bonus” malware.

It’s no longer enough to rely on the benevolent protection of your school district to safeguard digital data. There are too many ways that hackers and dishonest people can access confidential information. Part of good digital citizenship involves learning how to safeguard sensitive data. Start now because the challenges will only grow the more you learn and as time progresses.

 

0 comment
0 FacebookTwitterPinterestLinkedinEmail
cybersecurity
Cybersecurity

Safeguarding Sensitive Data: Part 1

by Miguel Guhlin
written by Miguel Guhlin

“People are living in an unprecedented condition,” shares the 2014 Pew Research Report on The Future of Privacy, “of ubiquitous surveillance.” And, although we are now in 2016, did you know that 2014 was known as the Year of the Hack, according to CNet?

“The tone was set in January as we learned details about the Target credit card breach, along with a Snapchat hack that revealed millions of user phone numbers,” shared CNet. Safeguarding sensitive data has grown even more important. Since then, there have been many more hacks, including the Sony Pictures Entertainment hack, which stopped the release of “The Interview;” perhaps we should be grateful for that. Of greater concern, though, is the loss of student and staff personally-identifiable data (PII).

The loss of PII is signaled by facts like the following:

  • 97% of stolen computers are NEVER recovered.
  • Direct costs are incurred by school districts for having to notify individuals whose confidential data has been compromised, as well as notify credit agencies.
  • The cost of paying for credit protection for individuals is affected.
  • The school district may suffer damage to reputation.
  • Staff may be disciplined or terminated, depending on the severity of the data breach.

The failure to understand how to safeguard sensitive data means that districts who suffer a data breach have no recourse; they must pay to protect against identity theft. Yet, if every staff member practiced the following tips, data could be easily safeguarded.

  • Lock or log out of your computer when you leave it alone. Going to lunch? Going down the hall to the restroom? Make sure to secure your computer or device. Don’t leave it logged in, even if you’re just on your web browser checking out the lunch menu.
  • Never use work email for personal purchases and/or items. Aside from being “discoverable” during public records or legal proceeding (which you may not even know is happening), you should use a different email for finances. Move your financial management to another email system.
  • Use two-factor authentication for emails and other services. “Two-factor authentication is a simple feature that asks for more than just your password. It requires both “something you know” (like a password) and “something you have” (like your phone)” (source: LifeHacker). Two-factor works on sites like Google, LastPass, Apple, Facebook, Twitter, Dropbox, Evernote, Paypal, Steam,Microsoft, Yahoo (avoid them), Amazon, LinkedIn, and Wordpress. This will help prevent unauthorized use of your account unless they have your username, password, AND your smartphone.
  • Don’t read spam messages; delete them un-opened. Most email providers (like Gmail) have a way of marking messages as spam. But sometimes, spam slips through those filters they’ve set up to catch unwanted email. That means it’s up to you. Some spam is obvious; others are more clever.
  • Access confidential data on your work device ONLY. If you work from home, make sure that you encrypt confidential data on your mobile device (e.g. laptop) for travel (yes, even for that short trip from work to the grocery store to home). If you decrypt confidential data, make sure to shred it off your computer (it’s easy to recover deleted files). Apple Macs come with “Secure Empty Trash,” and on Windows, you can use the free File Shredder program.
  • Do not put unencrypted confidential data on a USB flash drive or external hard drive or CD-ROM. This is the source of many a confidential data breach!
  • Secure your smartphone and remove confidential/sensitive data from your personal mobile phone after each use. Lots of folks use their smartphones to access work details. Make sure you protect that by a.) Putting a passcode on your phone, or better yet, encrypting your phone’s storage with a password; b.) Shredding data on your Android phone (get SSE app for free), or, if on iOS, useReaddle Documents (free) with a passcode and encryption, which adds another layer of protection. And finally, AVOID saving confidential data on your smartphone from your email (and any emailed confidential data should be encrypted. See Part 2 for more tips.).

Read Part 2 now!

 

0 comment
0 FacebookTwitterPinterestLinkedinEmail
Pirate flag on a red background screen on laptop
Cybersecurity

Five Anti-Malware Tips for Schools to Share with Staff

by Miguel Guhlin
written by Miguel Guhlin

Every other week, I read or hear about  a school district that has suffered a phishing attack, an approach distributed by email designed to trick you into giving your email username and password to criminals. Dealing with ransomware (a form of software that infects your machine when you double-click on it and encrypts your files, then demands you pay them for decrypting them) can be embarrassing, since it may result in the district having to pay to get its data. Or you could lose the data and tell only the federal auditors coming to evaluate your records for the last five years.

In addition, ransomware may also be distributed to district users via email. Several districts and Texas education service centers have allegedly faced some of these challenges (allegedly because ransomware infestations travel through word of mouth):

It’s…thrown a kink in the school district’s scheduled…exams…The crypto-ransomware “has affected the district’s entire operations from internal and external communications to its point-of-sale for school lunches. It also has prevented any students from taking the scheduled…exams, which are entirely computerized.” Source: Network World

Follow these tips to safeguard your hard work in computer documents and files on your computer:
  1. Look before you click. Avoid clicking on email attachments that come from people you do not know. Email attachments with “exe” and “zip” are suspicious. Also, do NOT go into your SPAM folder and click on the email attachments.
  2. Connect before opening. Ask yourself, “Was I expecting a file from this person?” If yes, connect with them via phone, social media, or email and ask, “Did you send me this file?” If the answer is “no,” then delete it.
  3. Avoid clicking on email attachments via your personal email on a work computer, especially if it’s a Yahoo email account. Multiple types of malware spread ads via that one service alone.
  4. Scan files before opening them. You can right-click a file, save it to your computer, and then choose to virus scan it before opening it.
  5. Backup your data to a cloud drive storage provider (e.g. OneDrive, Google Drive, Dropbox). Ransomware can spread via cloud storage where your files are automatically backed up when you place them in a certain folder (e.g. Dropbox), so be aware that ransomware WILL encrypt those files and the encrypted files will be backed up. Back up manually to the cloud and/or to external USB drives. Avoid leaving the latter connected to your computer.

Staff that succumb to phishing attacks open the organization’s virtual doors to a ransomware infestation. For example, in my inbox, I received an email purporting to be from a colleague sharing some files with me via Dropbox, but this looked like a phishing attack. Let’s go through the process I went through together. malware

Knowing that my colleague did not send this email, I opened up a fresh browser where I’m not logged into anything and tried the link: It didn’t work. That’s good! But if it had been a phishing scam, something like this would have popped up: When you examine the “Click here to view” link, you will find as I did that the link is to a non-Dropbox web site in the UK. That suggested to me that this link did NOT originate with Dropbox. As a result, I contacted my colleague via Twitter and asked, “Did you send me something via email that originated on Dropbox?” He responded after a short delay, “No, I didn’t.”

malware

Notice how the screen to the left offers you the opportunity to compromise your login and password for multiple email providers. This suggests that the goal is to steal ANY email account credentials you have. This can be potentially catastrophic since school district personnel often save student/staff confidential content in the cloud.

Actual Example: One principal was shocked when her Google Apps for Education account started sending out phishing attacks to all the email lists she was a member of, including the district-wide principals’ list, her campus staff list, and district-wide news list. And her shock turned into horror as colleagues clicked and were infected themselves. Horror shifted to shame as her colleagues grew angry, inquiring why she had inflicted them with this plague of phishing. And all the principal had done was fall prey to a phishing attack from a dear friend.

Fortunately, this can be avoided with the five tips above. Raise expectations for staff to take responsibility for their email communications and their technologies.
Bonus Tips for Home Users 
While many of us have district-purchased software to protect us at work (although even that will not help you if you deliberately ignore the warnings), our home computers may not be so protected. Below are a few software tools that I use on my Windows and/or Mac computer(s) to protect against infestation. Note that this does not constitute a purchase recommendation since these tools are available for free, personal home use:
I have all of the following on my personal Windows computer and wouldn’t dream of using it without having them installed. In spite of the fact that Windows Defender comes standard on Windows 10 computers, it’s important to have anti-malware and antivirus software loaded and working.
Anti-Malware/AntiVirus
  • List of Mac AntiVirus Solutions
  • Windows Solutions:
    • Anti-Malware
      • Malware Bytes* – Great to use when you think your computer has been infected with malware/spyware and you need your computer “cleaned out.”
      • AntiRansomware – Although still in beta, Malware Bytes’ solution to ransomware offers real-time protection against ransomware, catching it before it can encrypt your files.
      • Spyware Blaster*– An easy to use “inoculation” program against spyware/malware.
      • Spybot Search and Destroy* – The best part of Spybot is the TeaTimer which protects your computer’s registry against contamination and immunizes your browsers (IE, Firefox) against malware.
    • AntiVirus
      • BitDefender Free – This free for home use antivirus works great and does not drive you crazy with advertisements.
      • Sophos Home Antivirus – This is another protection free for home use.
0 comment
0 FacebookTwitterPinterestLinkedinEmail
Data Security Questions infographic created by author
CybersecurityTechnical Support

Data Security: Questions to Ponder

by Miguel Guhlin
written by Miguel Guhlin

Technology department staff often ask how they can better secure confidential data, especially in these days of hackers and leaks. One approach involves improving the data processes themselves. Another is to coach other staff before they choose a new instructional platform. Start with Georgetown ISD’s template to get the conversation started. For technology departments, reflect on your responses to these four questions.

Data Security Questions infographic created by author
Data Security Questions infographic created by author

1) Does the solution provider support automated uploads?

“The classroom teacher can create the student roster, right?” says the math curriculum director. Classroom teachers should not be expected to create login credentials for each student they serve. High mobility rates make data consistency difficult. Without the ability to submit required information (via Active Directory sync or comma-delimited CSV files), schools will find themselves in a GIGO scenario (e.g. garbage in, garbage out) when updating rapidly changing data.

2) Do you have an information sherpa?

Your school district may have a standard single sign-on solution (SSO) provider, such as ClassLink, Clever, Enboard, or Identity Automation. However, a database manager will need to create the files those solutions require, including necessary login credentials. How multiple data sets intersect via courses and classes remains critical. You need a data sherpa who has the right set of skills to put the data in the correct file formats.

3) Have you clarified data file format, contents, and encryption protocols?

Some school districts lack trained staff  to make the files. When that is the case, districts often turn to the SIS (Student Information System) provider. Some tips on this include:

  • Communicating the name of the project contact;
  • The frequency of the data refresh (i.e. both data files are to be placed on the district secure FTP server nightly;
  • Encryption protocols for transfer via secure file transfer protocol and file encryption such as PGP/GPG;
  • A clear delineation of data elements (e.g. student ID, first name, last name, location);
  • A brief description;
  • Sample data;
  • Desired filename format (students.csv); and
  • A text delimiter (comma, tab, or pipe). View sample form.

4) Have you identified a data exit strategy?

New projects may start with superintendent support, but then end in obscurity. At that point, the district requires an exit strategy. Before beginning work with a solution provider, both parties should sign a memo of understanding. This memo articulates the bounds of the partnership and how secure information will be stored. A data breach policy (get ebook) must also be formulated. Here is a sample memo of understanding.

Conclusion

Ensuring these questions are addressed eliminates a host of issues that result when working to setup a secure environment. So do yourself a favor and develop the answers before you embark on a new project.

0 comment
0 FacebookTwitterPinterestLinkedinEmail
Newer Posts
Older Posts