Is Your Network Safe? Why Educators Should Care about Cybersecurity-And What They Should Do about It
Cheryl Scott Williams, Keith R. Krueger · T.H.E. Journal Technological Horizons in Education · 2005
Assume that you are the superintendent of the Above-Average School District. Today in the news you spy a devastating story about a neighboring school district whose education network was attacked by hackers. Confidential information was breached, and the district's data warehouse, e-mail communications, and Web site are all down. You think about how increasingly dependent your own district has grown on its educational network. You wonder, How do I know that our educational network is safe from cyber attacks? Now assume that you are the district technology leader--the chief technology officer (CTO)--and you have just been told the superintendent wants to talk to you about cybersecurity. You enter his office and he grimly shows you the press clips he is reading. He turns to you and asks, Is our network safe? How do you respond? Most educators have little experience or expertise in cybersecurity. Yet, it is one of the most pressing vulnerabilities in today's society. But beyond simply being aware of this vulnerability, educational leaders must ask themselves: What is an effective strategy for managing cybersecurity concerns? Whom do you trust to give you the best information? What should you do first? To answer these questions, administrators need to think more strategically about the vulnerability of educational networks to cybersecurity threats. A Critical Partnership Ensuring security in your school district's information systems is both a set of processes and a frame of mind that recognizes cybersecurity as the attentive day-to-day management of network systems in tandem with active involvement of committed users on the system. Your district's most powerful network security tool is its users, whether administrative staff, teachers, or students. To the extent that a network truly serves the needs of educators, a district's invested ownership depends on a healthy partnership between you, the technology leader, and your supportive colleagues. Users of an educational network can serve as your eyes and ears for the system, as well as alert you to policies and practices that have the potential to impair their use of its resources. This type of systemic approach to network and information security is particularly important for ensuring student safety, protecting student and staff privacy, supporting a district's teaching and learning mission, and maintaining strong community support and trust. Enthusiastic support for the district IT system from students, teachers, and administrators also guarantees that an active learning community is built and maintained, and that student recordkeeping and reporting are timely and accurate. At-Risk Educational Networks School districts can be especially vulnerable to IT security breaches because many districts have developed systems in an ad hoc fashion over time, with mixed environments that are harder to manage and secure. What's more, many district IT departments are understaffed and poorly trained. Added to these two realities is the increased use of school network systems for both administrative recordkeeping and reporting, and teaching and learning activities. If not thoughtfully managed, the increase in appropriate and long-advocated uses of network systems has, in fact, the potential to augment the security risks. Finally, current trends in IT system development add to the security risk. These trends (all of which increase ease of access for users) include always-on broadband, Wi-Fi and other wireless network options, outsourcing data management, peer-to-peer (P2P) file sharing, and the growing number and types of portable devices used by teachers and students. Limiting Vulnerability With all this in mind, an effective technology leader can take concrete steps to ensure that day-to-day management and user engagement is deliberate, attentive, and user-focused, so that security is maintained and potential risks are identified before a breach occurs. …