eSchool News | Student Data Security Archives

How to maintain secure access and data privacy

Laura Ascione — Thu, 10 Nov 2022 10:00:00 +0000

Cybersecurity is a priority concern for most people accessing the internet. Unfortunately, students aren’t thinking about cyberattacks when they access sites for curriculum, research, and entertainment from their 1:1 devices–devices that are now so prevalent since the pandemic.

Schools’ exposure to cyberattacks has also greatly increased due to expanded remote and hyperflex learning.

Join eSchool News and a panel of experts to learn the latest strategies and tools schools are using to help keep student data safe and ensure students’ digital access is secure.

Key takeaways:

Learn the latest techniques to secure district systems
Discover best practices for educating students and families on proper digital etiquette
Ask cybersecurity experts about your data protection concerns

4 ways to improve your district’s data privacy

Charlie Sander, CEO, ManagedMethods — Wed, 06 Apr 2022 10:00:00 +0000

With K-12 school districts using cloud collaboration platforms more than ever before, the approach to data privacy in schools is looking a lot different than what administrators are used to.

Google Workspace and Microsoft 365 are keeping students and staff connected. These apps have forever impacted the way education is delivered in school.

School districts suffer from data leaks—when a student or staff member shares data outside of the school district’s domain. At the same time, school districts have become one of the most targeted organizations for cyberattacks. Regardless of whether these incidents are malicious or inadvertent, they should not be happening in the first place.

Millions of students and staff have had their sensitive personal information exposed due to the cloud security shortcomings of school districts. The cloud has changed the way districts need to handle the data they store and it’s clear that there is a lack of knowledge among administrators on how to do it.

If you’re a technology leader looking to improve data privacy in your schools, you first need to get more serious about making improvements to the way your district’s data is secured.

The Link Between Data Security and Data Privacy

Data security and privacy in schools are linked. If your school district doesn’t have strong security measures in place, you can’t expect to have great data privacy for your students and staff. Despite the number of incidents impacting school districts increasing, there doesn’t seem to be a rise in concern by administrators—yet.

3 ways to strengthen your student data privacy compliance strategy

Thu, 21 Oct 2021 09:42:00 +0000

Cyberattacks and data breaches are infiltrating K-12 communities. To proactively thwart these attempts to steal student data, states such as New York are passing legislation that requires school districts to adhere to stipulated student data privacy compliance regulations.

With so much on their plates already, creating, implementing, and monitoring an effective data privacy compliance strategy is a time-consuming and stress-filled task for most school district leaders.

As the Director of Instructional Technology at a New York school district, I have been leading our data compliance efforts, and I very much understand the significant challenges schools are facing. To help other districts navigate this unpredictable landscape, I have put together the following recommendations:

1. Continuously monitor what your students and teachers are using on their school devices.

With so many free apps and web-based learning tools available, it is extremely difficult for school leaders to track what their students are using if they do not have direct visibility into their students’ and staff’s application usage data. In some instances, teachers are providing their students’ names and dates of birth to access these free resources without realizing the ramifications sharing that information could have on their students’ data privacy.

At my own district, Fayetteville-Manlius School District, we have a rule in place that teachers are not supposed to begin any new software program until they vet it with a member of our instructional technology staff. Despite this policy, I have discovered through CatchOn, a data analytics and data privacy monitoring solution we use, that some educators are continuing to introduce new online tools without notifying our instructional technology team. Even though my team reminds our staff of this policy during our yearly trainings, and the teachers agree to abide by it, I can see through CatchOn that there are products being used that have not been approved and/or vetted.

3 keys to protecting student data and privacy

Ben Pierce, Director of Data Services, Xello — Thu, 29 Apr 2021 09:15:00 +0000

When the sixth-largest school district in the United States announced in early April that hackers were holding its data ransom for $40 million, administrators everywhere paid attention.

The Fort Lauderdale-area district has 232 schools and a budget of $2.6 billion for the 2020-21 school year—seemingly, the district has plenty of resources to protect against cyberattacks. It also has thousands of students and staff who use hundreds of applications and technologies each day.

How do educators ensure that they keep students’ data, records, and personal information private and secure? And, on the flip side, how do they ensure that the integration with other systems remains seamless, so student data is always up to date, accurate, and accessible to teachers, students, parents, and district officials?

3 considerations for securing student data

1. Security

State and federal data privacy laws apply to school districts along with the vendors who supply hardware and software to them. But as educators, you need to ensure that their systems go beyond being legally compliant. You must work with companies to prepare for vulnerabilities and threats long before they occur.

Are you protecting health data amid COVID-19 testing and tracking?

Ryan Cloutier, Principal Security Consultant, SecurityStudio — Tue, 08 Dec 2020 09:50:30 +0000

There’s no point mincing words: School districts and administrators have had a heck of a year. Not only have you been under immense pressure from parents and state officials to reopen schools safely, but your teachers are also understandably concerned about virus transmission. What’s more, your plans keep changing and you’re being forced to adapt. It’s an uphill battle, and there’s no doubt you’re doing your best. In all the chaos, you’re now responsible for taking temperatures and doing daily COVID-19 screenings, but you may not have had enough time to research screening devices and do sufficient due diligence before welcoming students back through your doors. Unfortunately, making a purchase like this can open you up to risk. Here’s why, and how to mitigate these risks moving forward. Untested tech, unproven vendors COVID-19 took the world by surprise, and people have taken a waterfall of reactionary measures ever since. Consumers have bought household goods out of panic, and schools have bought screening devices in much the same way - because they needed to. You need to reopen your doors, so you need to perform health checks, as well as COVID-19 testing and tracking. It’s understandable that you may have either purchased a device for your school or been given one to install from your district without first undergoing a complete risk assessment. But these screening devices are largely unproven. Many of them have emerged very recently from vendors that are neither widely known nor trusted. Furthermore, many of them use facial recognition so the technology can connect the dots between the temperatures they’ve taken and whose temperature it is. Do you know how, where, or if that data then gets stored? Whether you have a handheld screening device that looks like a modified cell phone or one that looks like a tablet, you need to understand the associated risks and configure the technology securely. You’re now handling health data You’ve always had to manage and protect student data, but as soon as you pull the trigger on a temperature scanner, you’re dealing with sensitive health information. Some people dismiss temperature data as “just a temperature,” but the reality is that this is health data - and it needs to be treated differently than general student records. When you’re handling health data, the complexity and sensitivity is increased significantly. A lot of COVID-19 testing and tracking devices have a server component to them, so the device sends data to a centralized server system where it’s captured and used for reporting. If someone scans hot, a notification may go out. That notification is then sharing health data. Additionally, many technologies are working to help record contact tracing. This, of course, is another layer of sensitive data, this time about the comings and goings of individuals. So, consider where the personal information captured by these devices goes. Is it being used by the vendor for purposes aside from COVID-19 testing and tracking? Odds are good that it is (or eventually will be). Also, is it part of your network? If so, there’s a possibility that a cybercriminal could access the network - and all the data. There has been an increase in attacks on COVID-19 testing centers, vaccine development facilities, etc. so it’s not a stretch to imagine this type of data being a target within your own walls. Assess risk & make plans If your data, school, or district does get compromised and your screening technology is taken offline, what’s your backup plan? Do you have one? If not, take the time to think through all possible outcomes and what your next moves will be. Whether it’s because of cybercriminals or simply because the technology fails (as all tech does eventually), having contingency processes in place will increase your speed of response and level of security.

Best practices for protecting data and keeping online learning secure

Dean Coclin — Wed, 21 Oct 2020 09:55:11 +0000

As the global pandemic extends into the fall, it’s clear that most schools and universities will continue to rely on online instruction in the near term. However, although online instruction can help minimize health risks, it also introduces heightened security risks and highlights the importance of protecting data. This was certainly true in corporate environments, where more than 80 percent of companies saw “slightly to considerably more” cyberattack attempts in the first half of 2020. As the threat landscape continues to evolve, higher education will continue to become an increasingly target-rich environment. Related content: COVID-19 ushers in a new era of cybersecurity To keep their courses and students safe, it’s up to institutions to make cybersecurity top of mind. Robust access control, authentication, data integrity, and content protection are all essential to safeguarding sensitive data and communications. Educators must not only protect sensitive data but take proactive steps to safeguard online communications. Safeguarding a wealth of personal data School systems have long been a ripe target for hackers and other bad actors. Many are especially vulnerable to attacks because they lack the security systems and IT resources that corporations and large enterprises utilize. In 2019, ransomware infections impacted more than 500 schools in the U.S. alone. As schools spend more of their limited IT resources building digital classrooms, the threat is likely to grow. Just this past June, hackers took Columbia College student data hostage and threatened to sell it on the dark web. Most schools host huge volumes of data related to their students, tracking everything from test scores to demographic data, behavior records, financial information and more. To keep this sensitive personal data from falling into the wrong hands, institutions must restrict access and encrypt data, regardless of where it resides. Protecting data in transit When it comes to protecting data that’s in transit, you need to secure your website with a TLS/SSL certificate to encrypt information and maximize trust. Three key types of TLS certificates can provide protection, including Organization Validation (OV), Domain Validation (DV) and Extended Validation (EV). EV certificates, the worldwide standard for protecting extremely sensitive data, offer the highest level of authentication. To enable organizations to manage these certificates, certificate authorities (CAs), like DigiCert validate each type of certificate to a specific level of user trust. Protecting data at rest With so much personal and financial information residing on-premises at education institutions, protecting data onsite is critical to prohibit hackers from harvesting it. The best way to protect data onsite is to encrypt it at rest. If a hacker were to infiltrate a system that contains encrypted data, it would be worthless. Safeguarding third-party platforms Learning management systems (LMS) like Blackboard or Canvas also host a vast array of personal data that is vulnerable to attack. To protect these systems from unauthorized access, two-factor authentication should be mandatory for these systems. Securing online communications and classrooms Classroom and online communications like videoconferencing and email platforms are also vulnerable to hackers and other attacks. We’ve all heard the stories of disruptive “Zoombombing” episodes in education and at private enterprises. Although some of these pranks may seem lighthearted, they disrupt and waste valuable classroom time. Establishing role-based accounts, robust access control and frequent re-authentication can help minimize these issues. Securing school devices Maintaining control over the devices students use to access learning is a powerful way to enforce security for video collaboration and classwork. However, it also requires mechanisms like Mobile Device Management (MDM). MDM lets you control your devices, security profile and level of access for users from anywhere in the world. When combined with PKI for identity management, it offers a formidable security combination.

One district’s approach to student data privacy

Katie Onstad — Mon, 17 Aug 2020 09:55:32 +0000

Every school district is faced with a choice about how to protect student data. As districts have implemented more technology to support digital learning, student data privacy in schools has become a critical issue. It can be a huge undertaking to vet and manage the privacy policies of all of the online resources used in a district. Even with good intentions, most districts do not have adequate protection and are vulnerable to a data breach. These breaches are becoming more common as districts struggle to keep up with technology. Related content: 5 ways IT directors handle student data privacy Here is the story of one district that is doing it right by effectively supporting its student data privacy policy with a comprehensive privacy management tool. Forsyth County Schools District administrators and school board members in Georgia’s Forsyth County Schools were committed to data privacy—and with nearly 50,000 students, the district knew protection was of the utmost importance. District tech leaders actively searched for an enterprise data privacy solution that would allow their teachers and schools to be autonomous in finding and selecting safe applications for use in the classroom. They also knew they wanted a tool that would give local school personnel the ability to independently find online resources that are FERPA and COPPA compliant. These requirements led the district team to EdPrivacy by Education Framework. Like many districts, Forsyth County Schools does not have a large enough IT staff to conduct the labor-intensive evaluation of every digital tool and learning resource used in classrooms throughout the district. District leaders and school board members needed a comprehensive, cost-effective solution to automate this process, and also needed EdPrivacy to integrate with their SSO solution—Classlink. Education Framework worked with the district and developed the integration needed for Classlink. Forsyth educators now have access to more than 10,000 digital resources in the EdPrivacy database, and can order a privacy evaluation for new digital tools and programs at any time. New evaluations are provided within 24-48 weekday hours of each request. Because the EdPrivacy database has an extensive library of approved educational resources, the district has been able to give teachers guidelines and greater latitude in choosing tools and learning resources to support their curriculum, all while protecting student data privacy. Also, the district’s professional development program has spurred adoption and implementation of EdPrivacy throughout the district. Highlights after EdPrivacy’s first year in Forsyth County Schools include: • 1,112 teachers are using the system • 8,356 searches have been completed in the EdPrivacy database • Users are advocates as they help teachers and administrators use the system • Vendor privacy policies are vetted and continuously monitored for changes • Quick turnaround on new edtech privacy vetting requests • 80 percent ROI on Forsyth’s student data privacy efforts

5 truths for building a successful data culture

Content provided by Instructure — Tue, 17 Dec 2019 10:00:44 +0000

Whichever assessment practice model you use—be it Response to Intervention (RTI), multi-tiered systems of support (MTSS), or any other—building a positive culture of assessment is the key to success for both students and teachers. Tech tools alone cannot transform your data culture, but the right knowledge and strong leadership can. We’ve found that schools and districts are most successful if they possess these five common traits. The school or district has a broad definition of assessment. The word ‘assessment’ should not be a substitute for the word ‘test’ or ‘grade.’ When teachers, schools, and districts broaden their overall definition of what an assessment can be, teachers are able to get a more complete sense of what a student has learned and where there is still room for improvement. These don’t need to be limited to benchmarking, check-points, or end-of-level tests, and not all assessments factor into a student’s gradebook. Whether it be performance-based evaluations, rubrics, or even a one-on-one conversation about frustrations and successes, think of an assessment as any time you allow a student to demonstrate what they know and don’t know. Teachers and students do not fear assessments. When the statistics come back and the data doesn’t show perfect scores or off-the-charts comprehension, many instinctively assume the data is “bad” and shy away from acknowledging what it can illuminate. All data is good data. Even numbers that reflect a less-than-ideal outcome offer an opportunity to improve and address specific student needs. Just as we tell students, take every opportunity to apply what you’ve learned. Students shouldn’t be afraid to take assessments either. Often, students fall into the trap of seeing every evaluation as a grade that tells them how well they’ve prepared or how “smart” they are. Instead of seeing low scores or numbers and thinking “I can’t do that,” teachers work with students to identify additional learning opportunities and help them reframe the way they see assessments to say, “I can’t do that yet! But I will learn.” Evaluations are opportunities for growth and challenge, rather than a harbinger of doom and gloom. Teachers should have an understanding that no matter where students are in their learning process, the results of assessments are tools to guide further instruction and evaluate the efficacy of their own teaching. The ultimate goal is to refine programs to best benefit the students and meet them where they are. When students see assessments as ways to show off what they know rather than exposing where they fall short, they’ll be more likely to approach them with a positive outlook geared toward learning and addressing their own knowledge gaps. Teachers are engaged in conversations and analysis centered on data. Professional Learning Communities (PLCs) empower teachers with the knowledge and tools to best evaluate student data as a team. From sharing experiences to exchanging resources for growth, teachers making use of PLCs to broaden their own perspectives and create a culture of collaboration. Joining forces with other experienced professionals often paves the way for a more robust program of evaluation (rather than creating competition as some may worry). No educator is an island. Sharing resources and delivering common assessments on a school- or district-wide scale forms a solid foundation of consistent data and allows teachers to get new eyes on data. Working together, teachers and administrators can collaborate on instructional strategies to create a space for conversations that have a real impact on student learning.

How one district handles student data privacy

Katie Onstad — Mon, 07 Oct 2019 10:00:09 +0000