Tag:

security

Protecting Student Data Privacy at School

by Susan Meyer April 13, 2018

written by Susan Meyer

With all that has come to light about Facebook in recent weeks, it has many people considering the privacy of the data we share online. The information we share can reveal a lot about us. It can also be a tool to better advertise to us and even to shape the type of news we see.

As adults, we can read about privacy and make informed decisions on how much or how little we share. But what resources can we give our students to help them understand the power of their personal information? Equally important: how can we make sure our students’ data is safe when they use ed tech apps and tools at school?

Safeguarding Student Data

Technology can open up the classroom walls and provide incredible, expansive opportunities for students. However, opening the classroom walls shouldn’t mean eliminating safeguards for students. Protecting students’ data is extremely important for both ethical and legal reasons. Apps, websites, and tools that students use every day may collect information about their users. It is important to vet the tools you use and their privacy policies to make sure they adhere to school policies and federal and state laws.

Understanding the Law

The Children’s Online Privacy Protection Act (COPPA) limits what information companies can collect from children under the age of 13. It requires companies to provide clear privacy notices and to obtain parental consent before collecting information. School officials can provide this consent in lieu of a parent if the product is used purely for educational purposes. The company can then collect information only for educational, not for commercial, reasons.

Learn more about COPPA and how it can affect students and educators.

Modeling Good Privacy Practices

In addition to vetting products your school uses, you can also help guard student privacy both in and outside of school by encouraging them to be canny digital citizens. For example, if a student recommends an app or program or uses one for a project, ask them to tell you about what data they have shared. Here are some questions to have them consider:

What data did you have to provide when you created an account?
Did you read the privacy policy for the product?
Do you know if your information is shared with a third party?

Encouraging students to be curious and to seek out new tech tools is important, but so too is making them think carefully about what they choose to share about themselves and with whom. Empower your students to vet the tools they find and to make good choices for themselves about who can access their information.

Resources to Help Develop a Student Data Privacy Policy

Common Sense Media has a Privacy Evaluation Initiative that works with software developers to bring greater transparency in privacy policies and the evaluating of ed tech tools.
Connect Safely has an Educator’s Guide to Student Data Privacy with a great list of questions to quickly evaluate whether an app, website, or product will protect student information.
iKeepSafe provides a list of resources that have achieved the COPPA Safe Harbor certification.
The US Department of Education provides Student Privacy 101 to help navigate this important issue.

You can also read more about student data privacy on the TechNotes blog here.

We live in an age of information. Short of going off the grid, it’s impossible not to have at least some of our data online somewhere. But by staying vigilant and being knowledgeable, we can make sure our students’ privacy is protected.

April 13, 2018 0 comment

CTO/CIO Cybersecurity Technical Support

TCEA Responds: Securing Data in Cloud Storage

by Miguel Guhlin July 19, 2017

written by Miguel Guhlin

Welcome to TCEA Responds #9. Submit your own question(s) online. Today’s topic is securing sensitive data. This includes data stored in cloud storage solutions like Microsoft OneDrive and/or Forms and Excel Online or Google Drive or Forms and Sheets.

Dear TCEA Responds:

My district uses Google Forms to collect parent and student data. This includes names, birth dates, phone numbers, and emails. Should I be worried? I know Google says it’s the school’s responsibility. Do you see any issues with security regarding sensitive data?

Thanks, Christi

Dear Christi:

A district-level administrator has a Google Sheet with 500 Social Security numbers for students on it. He accidentally drags it into a publicly-shared Google Drive folder. Is this a data breach or not? It depends on several factors.

While this isn’t technically a data breach since the data has yet to be stolen, a data breach could occur. If the person in question (or anyone else who has access) falls for a phishing scam and bad people get access, then the district will have a problem. If the data is not encrypted, then a data breach has occurred and the district could be liable for identity theft protection. Let’s review possible options for avoiding this situation.

Option 1 – Encrypting Data

The easiest solution (which isn’t that easy) is to avoid placing sensitive, personally-identifiable information online in a public folder where it is unknown who has access to it. If you must place sensitive data in the cloud, encrypt the file first. Once the person has obtained the file, remove the file. At no time should a decrypted file be placed online in cloud storage or emailed as an attachment. Two commercial solutions districts can use for encrypting data stored in the cloud include Cryptomator and Boxcryptor. A free solution is Secure Space Encryptor (SSE) from Paranoia Works. It’s free, open source, and works on Mac/Win/Linux/Android. It also features text encryption for iPad. You could use this because it allows you to encrypt files/folders. If the files/folders you are encrypting save to a “sync to cloud” folder (e.g. Dropbox, Drive, OneDrive), then that data is encrypted.

Option 2 – Invest in a Solution that Scans Your G Suite Domain

securing

Several solutions exist that will scan your district’s Google Suites for Education domain seeking any possible sensitive data that may have been shared with intent or not. Two solutions that I am aware of include the following (in alpha order):

Both solutions offer a variety of features, essentially scanning your cloud storage provider (e.g. Google Suites for Education or Office 365) for sensitive data. What’s more, additional rules can be set up to restrict placement of sensitive data online to prevent or quickly catch rule violations. You will want to explore these solutions through an official request for proposals (RFP) process aligned to your particular district’s processes and procedures.

Did you knowb4? A big part of protecting data involves avoiding situations, like phishing expeditions, that attempt to capture your username and password. Some school districts are turning to solutions like KnowB4, which provides security probing and awareness training. For example, a false spear phishing attack is launched against employees with the organization’s permission. This simulated attack is done without notifying the employees first. One district, for example, “sent out a baseline test to 4,390 staff and 924 clicked on it.” The district later reported that they suffered an actual attack, not simulated by KnowB4. Only one person was compromised. From 924 to one is quite an improvement.

Safeguarding Sensitive Data is Everyone’s Responsibility

Digital citizenship is often cited as an important set of habits to develop. Safeguarding sensitive data is everyone’s responsibility. Make sure district staff understand the consequences of convenient uses of cloud storage.

July 19, 2017 0 comment

CTO/CIO Technical Support

TCEA Responds: Video Surveillance Solutions

by Miguel Guhlin May 11, 2017

written by Miguel Guhlin

Welcome to TCEA Responds #10. Submit your own question(s) online. Today’s topic offers tips on video surveillance cameras in schools.

Dear TCEA Responds:

I’m new to the technology coordinator role and have to set up video surveillance cameras across my district. Could you give me some pointers on what to keep in mind as I roll video cameras out to schools?

-Tim

Dear Tim:

Thank you for your question! Video surveillance is a big part of any school district technology program. Although video surveillance typically falls under the purview of the school district police department, deploying video cameras can be challenging. Often, district leadership perceives video cameras as an appliance that can be placed anywhere. Little consideration is given to the maintenance of video cameras or the expertise needed to configure and connect them to the network. Here are some tips as you consider launching video surveillance in your district or at your campus.

Tip #1 – Consider what vendor solutions are available

The answer many Texas districts will give is Video Insight. This vendor provides excellent, almost turn-key solutions to video camera setup and deployment. This solution also allows integration into Active Directory so that groups can be created to give users access to only their campus cameras. Not only do they provide onsite support, they also provide remote support using their software. Having experienced a video camera failure at a high school, I can attest to their customer service. They resolved the issue, working after hours into the early evening to get video surveillance back up and working before a busy weekend. Another solution that is more do-it-yourself is Guardian Security (video cameras in use are from GeoVision). Both vendors feature no recurring annual costs unless you need more support.

I’m often asked, should we be using IP or analog cameras? To optimize management, you will need to get an IP camera. Video Insight provides IP cameras, and you can replace your analog cameras as they fail. Although Video Insight will sell you cameras, you can also get Advidia video cameras. The Advidia cameras are compatible with the Video Insight management software.

Left to right: Woodrow Thomas (Mt. Vernon ISD), Miguel Guhlin (TCEA)

Meet Woodrow Thomas of Mt. Vernon ISD. Rather than server-based storage, Woodrow is using video camera based storage. Listen to a conversation I had with him at the TCEA Technology Leadership Summit.

Tip #2 – Remote management and viewing of video cameras

If taking advantage of Video Insight, then it comes with a solution that’s available and ready to go. For the price you pay, you get camera and the software it comes with.

Be aware that a hidden cost of video surveillance often involves providing key personnel at each campus, as well as at the district level, with the ability to view video from any video camera on their campus (or elsewhere, if they are district staff). Unfortunately, clerical staff tasked with watching video feeds during the day usually lack the computers with the necessary processors and upgraded video card needed. For that reason, some districts purchase a second machine with dedicated components. This second computer enjoys enhanced features and is placed in close proximity to the receptionist’s location. Some data you need to collect includes:

How many internal video cameras are in place?
How many external video cameras are in place?
What is the age of the receptionist’s desktop computer?
How much RAM does the computer have?
Are dual monitors in use?
Is a dual monitor card needed?

Finally, you can issue tablets to police and administrators, enabling them to monitor activities via video feed to that device while on the go.

Tip #3 – Placement of video camera server(s)

Depending on how much video you want to retain (two to three days isn’t unusual), you will need a Windows desktop computer (with terabytes of storage space) to serve as your campus video server. The cost of these machines is fairly low, although you can get a low-end server instead to house content. Again, your storage capacity on this machine should allow you to retain several days of footage, especially for long weekends or vacations. For high traffic areas, a more robust server may be needed with ample storage. As you might imagine, since you can access servers remotely, having a server on campus may be more convenient, but you can centralize your server. Avoid using a virtualized server due to performance hits that a virtual machine will endure.

As to where to place the servers, it is typically recommended that the server be placed onsite to minimize bandwidth used through the transfer of video over the wide area network. This may be less of a concern in districts who own their fiber network.

Tip #4 – In-district support of equipment

“Should we TCEA Responds send the network engineer up that big ladder to clean the video camera lens?” That’s the question that comes up when a fuzzy picture appears or there’s a network connectivity problem. Providing in-district support can lower costs, depending on the total number of cameras you have in your district. You may want to either hire a media technician or re-task a portion of an existing technician’s time. Here is a description of what they need to be able to do, along with a chart to use as a starting point.

The primary purpose of a media technician involves installing and maintaining computer equipment and multi-site video cameras throughout the district. This person will need to respond promptly to work order requests and work collaboratively with multiple departments (e.g. police department, technology, and administration) to ensure minimal disruption of service. Some additional duties include the following:

Install/upgrade video surveillance cameras, as well as perform monthly inspection of surveillance cameras to retrieve and record backup video logs as needed
Assist district staff with video monitoring, troubleshooting, and repairs
Install/maintain cables, terminals, and connectors for all video equipment
Compile and maintain accurate inventory of tools, video equipment, servers, and equipment as directed by supervisor
Keep records of repairs, maintenance, and other service costs
Serve as a liaison with the vendor
Schedule backups of SQL server used for video surveillance camera

Additional questions to consider when deciding on placement of camera servers include: a) What will be the impact of video traffic?; b) Will you be storing video from special education cameras (that’s a completely different blog post) and for how long?

Tip #5 – Several miscellaneous points

Do you have special locations where there might not be a network drop? Some examples of remote locations include the bus barn, press box, or barn where livestock are kept. To take care of this, you can rely on long range wireless access bridges.

Another point to keep in mind is to turn off the skip video setting. The problem with the skip video recording setting is that you may inadvertently miss recording during a hallway situation. While turning off this setting will consume more space, you will at least have video recording of events.

May 11, 2017 0 comment

art aprons hanging on hooks in classroom

Cybersecurity Leadership

Safeguarding Student and School Privacy

by Miguel Guhlin January 28, 2017

written by Miguel Guhlin

Safeguarding student privacy and the security of networks remains a key priority for education leaders. In December, 2016, school leaders came together to match answers to tough questions as they heard from industry experts on ways to protect what is most important to them. In this blog entry, learn how to get access to the powerful presentations and conversations that took place.

How Do I Get the Summit Resources?

You can access the audio, presentation slides, and more of the sessions online now for a nominal fee ($49). You will need to have a TCEA log in.

What Exactly Will I Get?

Presentation slides, pictures, and audio recordings of the high-level speakers will be yours to explore and reflect on. In addition to Bill Fitzgerald’s (of Common Sense Media) keynote, critical areas addressed include:

Understanding DDoS Attacks,
Securing Single-Sign-On (SSO)
Security/Privacy Legislative Panel

TCEA’s Commitment

TCEA is committed to creating professional learning and networking opportunities that address the needs of Chief Technology Officers (CTOs) and Directors/Coordinators of Technology in K-16 education institutions. Be sure to join your colleagues at the Friday, May 12, 2017 event.

January 28, 2017 0 comment

Fence with padlocks affixed to individual strands

Cybersecurity Leadership

Process Check: Safeguarding Student Privacy

by Miguel Guhlin January 23, 2017

written by Miguel Guhlin

“What approaches do you have in place to safeguard student data and privacy?” From student assessment data to personally identifiable information to counting how many times students visit the restroom, administrators are working to put tracking systems in place. These systems (such as Google Sheets/Form where students submit data about themselves without parental knowledge) make it easier for schools to record and track information on students, but they may also put sensitive data at risk. What is your organization’s process for safeguarding student privacy?

What’s Your District’s Process?

“There’s no right or wrong answer,” says Bill Fitzgerald of Common Sense Media, “except to not have a process to evaluate how data will be maintained over time.” Whatever the original positive intent, each campus and/or district should evaluate how it intends to use and share collected student data BEFORE any program to gather that data is implemented. The process may include something as simple as the following:

Prepare the program for a pilot implementation.
Invite stakeholders, including students, parents, and educators, to meet and discuss the proposed program. Some points to ponder:

What are the positive and negative aspects of the program?
Who will access the digital data and for what purpose?

What does the Committee think about objections by the Electronic Frontier Foundation (EFF) and other organizations that make these assertions (Source)?

While there is an expectation of supervision and guidance in schools, monitoring the detailed behaviors of individuals can be demeaning.
Tracking and monitoring young people in their development may condition them to accept constant monitoring and tracking of their whereabouts and behaviors. (Source: Chip Free Schools as cited by Slate)

Conclusion

Before you purchase and implement a system that tracks students’ movements or data, give serious thought to the process steps you may have overlooked. Doing so can save time and trouble later, resulting in a safer environment.

January 23, 2017 0 comment

Cybersecurity Digital Literacy Good Teaching

Safety, Security, and Ed Tech

by Guest Blogger November 2, 2016

written by Guest Blogger

This is a guest post by Anthony Mason (@edtechmason), a Digital Instructional Coach at Naaman Forest High School in Garland ISD.

If you talk to any parent, teacher, or principal, there is nothing more important than the safety and security of our students at home and at school. It’s our number one concern as educators.

However, even as we protect students from the analog world, we sometimes forget to teach them the skills they need to be safe in the complex, ever-changing digital world. These discussions need to happen every day in conversations, lessons, and interactions in order to encourage good digital citizenship and online safety. A good framework for students, parents, and teachers to follow is the Nine Elements of Digital Citizenship.

Below are five practical ways to encourage good digital citizenship habits into students’ everyday device use and keep students thinking and talking about their online experiences and interactions with the trusted adults in their lives.

Set restrictions on where and when technology can and should be used. Don’t allow devices to be used at the dinner table. Don’t allow devices to be used right before bedtime. Limit the number of hours devices can be used during leisure time.
Talk to your kids daily about how they are using their devices. Whenever possible, have them use devices in a common area with appropriate supervision.
“Never talk to strangers” is one of the most common ways parents and teachers teach students to protect themselves. Protect students’ privacy and keep them safe by teaching them not to share personally identifiable information of any kind online, including location information (via metadata in photos) and full name.
Be a positive example and role model for students to emulate. Students will not do what you say; they will do what you do.
So never, ever drive distracted. Model appropriate use of technology in the home, classroom, and other public settings.
Always remind students to T.H.I.N.K. before they post any text, videos, and/or photographs online. Is it True? Is it Hurtful? Is it Illegal? Is it Necessary? Is it Kind? Kids might not fully understand that their digital footprint is traceable and un-erasable. Recently, students have lost out on jobs and scholarships and even been kicked out of school because of negative posting online and bad digital footprints.

This is not an exhaustive list. Visit www.digitalcitizenship.net and www.commonsensemedia.org for more information on keeping our children safe and secure in a digital world and to learn more about digital citizenship. As education technology integration continues to grow and expand, parents and teachers can help students navigate the murky waters of the digital landscape with ease.

To Learn More About Digital Safety

The November 2016 TechEdge takes up Safety, Security, and Support, offering you stories and ideas about keeping our students and their data safe online. Watch your snail mail and email boxes for this upcoming issue.
On December 9, 2016, the TCEA Technology Leadership Summit: Security will be held at the TCEA Conference Center in Austin.

November 2, 2016 0 comment

network cables plugged into an network hub

Cybersecurity

Safeguarding Sensitive Data: Part 2

by Miguel Guhlin September 15, 2016

written by Miguel Guhlin

Ready to find out more about safeguarding sensitive data? In this second part of our cybersecurity series, we will continue exploring the different aspects of safeguarding your data. (In case you missed it, you can still read the first part of this series.) Here are some steps you can take immediately to protect sensitive data at work and home:

Encrypt ALL confidential data and personally-identifiable information (PII) at rest and in transit. (View this free tutorial). Assume that anyone can bypass district network security and that the computer on your desk, whether laptop, Chromebook, or desktop, can be worked on as if someone was sitting in front of it. Want to send an email or store data in the cloud? Encrypt the files and the message itself if it deals with confidential data or PII.
Use a password tool to generate uncrackable passwords and change them regularly. There are many password managers, like 1Password and LastPass that are online, while others can be saved on your computer or device (e.g. Keepass). You can always use a Secure Password Generator to come up with tough ones. This sure beats writing them on a post-it note and sticking them to your computer or desk (I actually saw a desk covered in these once).
Avoid sharing confidential data or PII with students and staff. That information can be used to create bank accounts, etc. This can also include leaving confidential data or PII on your desk at work or in your paper notebook in the car. Whether it’s digital or paper, you still have to pay for identity theft protection!
Shred paper copies. It doesn’t matter if you are all digital if a paper copy ends up being stolen from your desk, car, or home. Shred paper as soon as possible.
If it’s confidential or sensitive data, the website you are connecting to should have https:// as part of the URL. If not, refuse to enter the information in.
Back up your data frequently. It’s obvious, but this is something you can easily do using tools like Dropbox and GoogleDrive. Encrypt your data first before backing it up. And back it up to different places. Maybe you back it up to Dropbox on Mondays, Wednesdays, and Fridays. On Tuesdays and Thursdays, you back it up to Google Drive. If you don’t like the cloud, get a USB external drive. Just make sure to encrypt your data, one file/folder at a time or a whole drive at a time. Just do it.

Steps to Stop Infiltration

Help protect the school district against infiltrations caused by virus/malware attacks that could begin with your computer.

Avoid using obsolete, insecure computer operating systems. If your school district is too cheap to upgrade the computers you use, then make sure you don’t do anything personal on them. File a written request citing the need for a more secure operating system. And ask for a newer computer model with up-to-date operating system (e.g. Windows 7 or Mac OS 10.7 or greater).
Be careful with email attachments. Don’t just automatically double-click on the attachment someone has sent you. First ask yourself, “Is it reasonable that this person sent me an email attachment? Is the email abrupt or doesn’t make sense? Does the file attachment have an EXE extension or the filename doesn’t make sense?” If the answer to any of these questions is YES, stop and scan the file attachment with your antivirus/anti-malware program (e.g. AVG, Avast are two free ones).
Avoid phishing attacks. Just this year, I received an email from a lawyer that purported to be a GoogleDoc, but was a phishing scam (Find out more).
Make sure your home computer is protected from viruses and malware. Anti-virus/malware software is available at no cost for personal, home use. Your district should have an enterprise anti-virus/malware solution for your work equipment.
Add a password or WiFi key to secure and encrypt your home wireless access. It’s so easy to “sniff data packets” these days (I tried it with free tools and was shocked how easy it was) that you need to prevent unauthorized access to your wireless. (In some cases, this means upgrading your wireless router’s firmware.)
Avoid “dodgy” sources of software or apps. These days, you can get your software/apps from approved creators/developers or somewhere else. Most of us should stick to only approved outlets for software because “somewhere else” sources sometimes result in “bonus” malware.

It’s no longer enough to rely on the benevolent protection of your school district to safeguard digital data. There are too many ways that hackers and dishonest people can access confidential information. Part of good digital citizenship involves learning how to safeguard sensitive data. Start now because the challenges will only grow the more you learn and as time progresses.

September 15, 2016 0 comment

Cybersecurity

Safeguarding Sensitive Data: Part 1

by Miguel Guhlin September 9, 2016

written by Miguel Guhlin

“People are living in an unprecedented condition,” shares the 2014 Pew Research Report on The Future of Privacy, “of ubiquitous surveillance.” And, although we are now in 2016, did you know that 2014 was known as the Year of the Hack, according to CNet?

“The tone was set in January as we learned details about the Target credit card breach, along with a Snapchat hack that revealed millions of user phone numbers,” shared CNet. Safeguarding sensitive data has grown even more important. Since then, there have been many more hacks, including the Sony Pictures Entertainment hack, which stopped the release of “The Interview;” perhaps we should be grateful for that. Of greater concern, though, is the loss of student and staff personally-identifiable data (PII).

The loss of PII is signaled by facts like the following:

97% of stolen computers are NEVER recovered.
Direct costs are incurred by school districts for having to notify individuals whose confidential data has been compromised, as well as notify credit agencies.
The cost of paying for credit protection for individuals is affected.
The school district may suffer damage to reputation.
Staff may be disciplined or terminated, depending on the severity of the data breach.

The failure to understand how to safeguard sensitive data means that districts who suffer a data breach have no recourse; they must pay to protect against identity theft. Yet, if every staff member practiced the following tips, data could be easily safeguarded.

Lock or log out of your computer when you leave it alone. Going to lunch? Going down the hall to the restroom? Make sure to secure your computer or device. Don’t leave it logged in, even if you’re just on your web browser checking out the lunch menu.
Never use work email for personal purchases and/or items. Aside from being “discoverable” during public records or legal proceeding (which you may not even know is happening), you should use a different email for finances. Move your financial management to another email system.
Use two-factor authentication for emails and other services. “Two-factor authentication is a simple feature that asks for more than just your password. It requires both “something you know” (like a password) and “something you have” (like your phone)” (source: LifeHacker). Two-factor works on sites like Google, LastPass, Apple, Facebook, Twitter, Dropbox, Evernote, Paypal, Steam,Microsoft, Yahoo (avoid them), Amazon, LinkedIn, and Wordpress. This will help prevent unauthorized use of your account unless they have your username, password, AND your smartphone.
Don’t read spam messages; delete them un-opened. Most email providers (like Gmail) have a way of marking messages as spam. But sometimes, spam slips through those filters they’ve set up to catch unwanted email. That means it’s up to you. Some spam is obvious; others are more clever.
Access confidential data on your work device ONLY. If you work from home, make sure that you encrypt confidential data on your mobile device (e.g. laptop) for travel (yes, even for that short trip from work to the grocery store to home). If you decrypt confidential data, make sure to shred it off your computer (it’s easy to recover deleted files). Apple Macs come with “Secure Empty Trash,” and on Windows, you can use the free File Shredder program.
Do not put unencrypted confidential data on a USB flash drive or external hard drive or CD-ROM. This is the source of many a confidential data breach!
Secure your smartphone and remove confidential/sensitive data from your personal mobile phone after each use. Lots of folks use their smartphones to access work details. Make sure you protect that by a.) Putting a passcode on your phone, or better yet, encrypting your phone’s storage with a password; b.) Shredding data on your Android phone (get SSE app for free), or, if on iOS, useReaddle Documents (free) with a passcode and encryption, which adds another layer of protection. And finally, AVOID saving confidential data on your smartphone from your email (and any emailed confidential data should be encrypted. See Part 2 for more tips.).

Read Part 2 now!

September 9, 2016 0 comment

Digital Literacy Educational Trends

Four Tips for Keeping Your Data Secure in the Cloud

by Diana Benner March 4, 2016

written by Diana Benner

While presenting on social media in the classroom at the TCEA Convention, I ran into a former colleague who had attended the Campus Leadership Academy the day before. She mentioned a fantastic presentation she attended at the academy on cybersecurity. Our conversation soon drifted to a discussion about passwords and how secure our passwords really are, especially with the amount of data we are storing in the cloud.

When you think about it, the amount of information all of us are storing in the cloud is growing every day. Most of us no longer use USB flash drives to carry our docs because it so easy just to store our information in the cloud. However, we hear about data breaches happening all the time; so how can we be sure our information is safe and secure out there?

Below are a few tips to put into practice to help secure your data in the cloud.

1. Get serious about your passwords.

Strong passwords are a critical component of good security. Passwords should be unique and complex to ensure that others can’t guess them or reuse them to access your other accounts. If you set up your password the Snowden way, you will “shift your thinking from passwords to passphrases.” A strong passphrase could include anywhere from 20-30 characters and a combination of numbers, symbols, and capital letters. An example of this type of password would be, “I enjoyed learning at TCEA 2016,” which would equate to “!enj0yedLearning@TCE&2o!6.” In addition, don’t forget to change your passphrase regularly and don’t use the same passphrase for all your accounts.

On the other hand, you might find that some of your cloud services use two-step verification on top of your login credentials as an added layer of security. In the case of Google Apps for Education, your console administrator can enable two-step verification so that a verification code can be sent to your mobile phone in addition to just your password. President Obama recently weighed in about password security being so bad.

2. Encrypt your data.

Encryption is one of the most effective ways to secure your data. Encryption works as follows:

You have a file you want to store in the cloud.
You use certain software which will allow you to create a password for that file.
You move the password-protected file to the cloud and no one is ever able to see the content of the file without knowing the password.

By encrypting data, you are adding an extra layer of protection and ensuring that your information is readable only by intended parties. Some ways to encrypt your data include using tools like Secret Space Encryptor (SSE) or the Chrome app MiniLock.

3. Read the small print.

Along with storing your data, some cloud services allow you to share your data through them with others. Some cloud service providers don’t advertise that they might have the right to use the content you share on the cloud. Make sure to read the provider’s terms and conditions. There’s no doubt that it isn’t the most exciting thing to read, but it may contain crucial information you need to know.

4. Think before you click.

Sometimes, the security of your cloud data depends on what you do online and what you click on. When using a public computer, do not save your password, and be sure that you log out of your account after you are done. And always avoid clicking on email links and attachments from people you don’t know.

Be sure to keep these few tips in mind when choosing the best way to protect your data. Always remember, your information is valuable; therefore, you need to protect it.

March 4, 2016 0 comment

Data Security Questions infographic created by author

Cybersecurity Technical Support

Data Security: Questions to Ponder

by Miguel Guhlin January 2, 2016

written by Miguel Guhlin

Technology department staff often ask how they can better secure confidential data, especially in these days of hackers and leaks. One approach involves improving the data processes themselves. Another is to coach other staff before they choose a new instructional platform. Start with Georgetown ISD’s template to get the conversation started. For technology departments, reflect on your responses to these four questions.

1) Does the solution provider support automated uploads?

“The classroom teacher can create the student roster, right?” says the math curriculum director. Classroom teachers should not be expected to create login credentials for each student they serve. High mobility rates make data consistency difficult. Without the ability to submit required information (via Active Directory sync or comma-delimited CSV files), schools will find themselves in a GIGO scenario (e.g. garbage in, garbage out) when updating rapidly changing data.

2) Do you have an information sherpa?

Your school district may have a standard single sign-on solution (SSO) provider, such as ClassLink, Clever, Enboard, or Identity Automation. However, a database manager will need to create the files those solutions require, including necessary login credentials. How multiple data sets intersect via courses and classes remains critical. You need a data sherpa who has the right set of skills to put the data in the correct file formats.

3) Have you clarified data file format, contents, and encryption protocols?

Some school districts lack trained staff to make the files. When that is the case, districts often turn to the SIS (Student Information System) provider. Some tips on this include:

Communicating the name of the project contact;
The frequency of the data refresh (i.e. both data files are to be placed on the district secure FTP server nightly;
Encryption protocols for transfer via secure file transfer protocol and file encryption such as PGP/GPG;
A clear delineation of data elements (e.g. student ID, first name, last name, location);
A brief description;
Sample data;
Desired filename format (students.csv); and
A text delimiter (comma, tab, or pipe). View sample form.

4) Have you identified a data exit strategy?

New projects may start with superintendent support, but then end in obscurity. At that point, the district requires an exit strategy. Before beginning work with a solution provider, both parties should sign a memo of understanding. This memo articulates the bounds of the partnership and how secure information will be stored. A data breach policy (get ebook) must also be formulated. Here is a sample memo of understanding.

Conclusion

Ensuring these questions are addressed eliminates a host of issues that result when working to setup a secure environment. So do yourself a favor and develop the answers before you embark on a new project.

January 2, 2016 0 comment

Newer Posts

Older Posts