Keep vigilant in the face of Cyber threats!

It appears impossible to read the news at the moment without hearing about another IT security breach. In the fortnight leading up to the time of writing, there have been reports of hacks at Uber, Imgur and a private members club whose clientele includes Stephen Fry.

Some reports suggest that cyber-attacks more than doubled in 2017. These include well publicised attacks such as the WannaCry ransomware attack that affected the NHS earlier in the year. Ransomware (a form of malware which locks files on your computer and will only unlock them in exchange for money) is a particular area of growth in cyber-attacks. In fact, more than 4,000 ransomware attacks have occurred every day since the beginning of 2016 (a 300% increase over 2015) and the proportion of phishing emails that contain a form of ransomware grew to 97.25% in 2016.

With so many attacks making the news, you may be concerned about the of cyber security threat to your Independent School. As a school with a duty of care to hundreds of pupils, it is extremely important that cyber security is tight. With so many schools keeping personal data on staff, pupils and parents as part of day-to-day operations, the consequences of losing sensitive material do not bear thinking about – particularly with the danger of steep fines under the GDPR legislation coming into force next May.

Although some Independent Schools have a dedicated ICT team, with engineers that protect and improve their networks, many don’t. For those that don’t, what practical steps can staff take to ensure that your school is as protected as possible

Patch Tuesday

Have you ever heard of Patch Tuesday? If you are not familiar with ICT, then chances are you have not. Patch Tuesday is an unofficial term referring to when Microsoft regularly releases patches for its software products. This is the second (and sometimes fourth) Tuesday of each month.

Every Patch Tuesday Microsoft releases a large number of updates for its Windows desktop and server software. These updates make UI (user interface) tweaks, performance improvements and security patches to Windows software.

If you are unfamiliar with Patch Tuesday, then chances are your desktops and servers aren’t getting the patches they need. By keeping on top of the updates, you can ensure that your hardware and software is up to date, and therefore protected from cyber security vulnerabilities

Education and Acceptable Use Policies

Whilst it is true that most Independent Schools have an ICT ‘Acceptable Use Policy’, it is also true that many pupils and staff have limited knowledge of it and limited knowledge of how they can stay on the correct side of it. In order for cyber security to work in a school environment, staff and pupils alike must understand why it is important to be safe online.

This must not just be in the context of the school, but also of the individual. Pupils are unlikely to be moved to stay safe online if they feel the only consequence of their actions is the school getting fined. By educating pupils of the dangers to them of poor judgement online, such as ransomware locking their valuable files or phishing emails stealing bank details, they are far more likely to take cyber security seriously.

By agreeing a fair ICT Acceptable Use Policy, educating pupils and staff on the details and rigorously enforcing it, you can make great progress in your school towards a safer cyber environment.

Contingency planning

Even if you feel that your cyber defences are relatively strong, a determined intruder is difficult to keep out. Schools have vast stores of personal data and Independent Schools in particular have data on high income individuals – this makes them targets for cyber-crime.

Therefore, it is important to have a plan in place should a cyber-attack occur. Under the GDPR legislation, all organisations experiencing a cyber-breach must notify the Information Commissioner’s Office (ICO) within 72-hours of the nature of the breach, what was stolen, and the measures you are taking to reduce the damage. To comply with this requirement, your school will need an individual that has at least a basic understanding of cyber security to liaise with the ICO directly.

You will also need a strong backup approach in place. It is preferable that you backup every day to a cloud server or an external drive. Once the backup is completed, removing the external drive from your servers and storing it securely will prevent the backups from also being infected. Furthermore, perform tests of your backups to ensure that they work and to give you a rough idea of how quickly you can restore your infrastructure from a backup. If your tests indicate that your backups take too long to restore, you may wish to look for better options.

Removable Media Controls

Many people still use USB thumb drives or external hard drives to store and transport files. However, removable storage media is an extremely unsafe way to manage file transfers. Thumb drives in particular are easy to lose and when pupils and staff can use personal thumb drives to move files around, you have little control over what files they are removing from the school premises, or indeed what files they are bringing in to the school network.

If a pupil or staff member were to bring in a thumb drive from home that had a malicious file on it, that file would have the potential to infect the whole school network.

Ensure that removable media is encrypted and scanned for malware before importing files onto the school network. Many businesses have even banned removable media entirely. A cloud option, particularly one that is built from the ground up with security in mind, such as Citrix ShareFile, is in my opinion by far the safest way to store and share documents.

Be Vigilant

It is not easy to keep on top of cyber security. However, it is so important to understand and to mitigate the risks. By putting the advice listed above into action you will not be completely protected from cyber threats, but you will have a strong foundation of security.

If any school would like further information or consultancy on ways in which they can protect themselves, or ways in which they can reach GDPR compliance next May, please do not hesitate to get in touch with me at schools@entrustit.co.uk or 0330 002 0045.

GDPR - top tips to get compliant

It’s that time of year again, the summer break is over and it is back into the routine for another academic year. Any bursar will tell you that September is an extremely busy time of the year with a seemingly endless list of things requiring attention. In the hubbub of the new academic year, it is easy for tasks to be put on hold, which is why I am taking an opportunity in this edition of ‘educateIT’ to gently remind headteachers and bursars of a deadline that is now two months closer – the GDPR regulation.

I’ve spoken so much with bursars about GDPR recently that I am starting to feel like a broken record, but the reality is that it is so important that it will be on the agenda right through until the 25^th May 2018 deadline and beyond.

After a well-deserved 2-month break, you may be racking your brains to remember exactly what GDPR entails. The General Data Protection Regulation (GDPR) is a piece of EU legislation designed to provide a common data protection policy amongst EU member states. When it comes into effect next May, it will supersede all existing data protection regulations (in the case of the UK, that is the Data Protection Act 1998). Because current data protection legislation differs across member states and was introduced before the cloud and social media, it was clear that modern legislation was required.

No doubt that if you have heard about GDPR, you will have heard the scare stories about fines of up to €20 million for non-compliance. As an independent school, it is unlikely that you could ever face such an astronomical fine for non-compliance, these fines are reserved for the worst offenders. However, it is a safe assumption that under GDPR fines for non-compliance will move up the value chain. For more on GDPR, read my blog from March 2017 entitled “GDPR – What’s it all about and how does it affect Independent Schools?”

During my visits to Independent Schools at the tail end of last term, I was frequently asked when would be a good time to start tackling the issue of GDPR compliance. At that time, I urged schools to begin work as soon as possible – since compliance is not something that can be attained overnight. In the new academic year, with the deadline less than 9 months away, my message is that if your Independent School hasn’t begun the process of GDPR compliance, it should be as near to the top of your agenda as possible.

With that in mind, what are some key considerations an Independent School should make as it progresses towards GDPR compliance?

Firstly, it is a good idea to get acquainted with the Information Commissioners Office. This is the Data Protection Regulator in the UK. Under GDPR, an organisation that experiences a data breach of any kind is obligated to inform the ICO of the breach, exactly what was exposed and what measures are being taken to mitigate damage, within 72 hours of discovery. Failure to do so is an offence and will result in a fine. Furthermore, GDPR requires certain businesses to appoint a dedicated ‘Data Protection Officer’ who is an expert on GDPR. The details are a little cloudy on this at present, but it is quite possible that schools will fall into this category.

The next consideration involves processing of personal data and consent. GDPR gives individuals more control over the use of their personal data. At a recent visit to an Independent School, this topic came up when the bursar mentioned that they perform wealth screening on prospective parents. Whilst this is a savvy business practice, under GDPR withholding personal information for the purposes of wealth screening can only be legally performed with the explicit consent of the individuals in question. Furthermore, the school must keep a record of exactly when consent was given and must make it clear to the individual the basis for which the school requires this information. The individual may also withdraw consent at any time, at which point withholding personal information becomes illegal.

In certain instances, passive consent is allowed. For example, when a pupil enrols at a school, it is implied that the individual gives consent for personal information to be stored by the school for the purpose of providing them with an education and pastoral care.

Once you have collected that data, the question of where that data is stored arises. Whilst many Independent Schools still store all their important data in servers on-site, cloud adoption is accelerating. Popular cloud services such as OneDrive or Dropbox are provided by U.S. based companies and are powered, for the most part, by U.S. based datacentres. U.S. data protection law is not as stringent as EU legislation and reliance on U.S. based storage could lead to compliance issues.

That doesn’t mean that storing data on-site is a preferred option. In almost all cases I have dealt with in my long career in the IT industry, on-site storage options are less secure than their cloud counterparts. The only exception is for organisations that make their cyber-security a top priority, throwing vast amounts of cash at servers, monitoring software and antivirus. A cloud storage option such as ShareFile is a strong offering if security is mission critical.

A final important consideration is that of Social Media and pupil internet usage. This links back to my earlier paragraph on consent. Because most school pupils are under 16, they can never legally give consent online. An Independent School, particularly one that has boarding pupils, acts as a legal guardian for those pupils while they are on school grounds. The school is therefore legally responsible for the information they share online, and the websites and social media accounts they sign up for while on school grounds. Having a stringent acceptable use policy in place for pupils’ internet use is a good first step, but educating the pupils on the dangers of posting personal information online would go a positive step further.

As the GDPR deadline looms, I cannot stress enough the importance of taking action now. In the business sector, GDPR is getting increasing air time and most parents will be aware of the regulation by now. To show that your Independent School is on top of the changes, I recommend a letter to inform parents that your staff are aware of the changes, and that your school is making the necessary steps to reach GDPR compliance by the May 2018 deadline. Proactively reassuring parents that the personal information of themselves and their children is safe will put minds at ease.

Towards the end of the last academic year, I received a number of requests for assistance with GDPR. To Independent Schools with a genuine need and interest, I met with bursars to discuss further. I am continuing to offer this service at the beginning of this academic year. If you would like advice on GDPR compliance, please do not hesitate to get in contact with me on 0330 002 0045 or email schools@entrustit.co.uk

Why Independent Schools must Prepare Pupils for Jobs that Haven't been Invented

Whether we like or loathe technology, there is no doubt that every facet of our lives is being changed by digital transformation.

Technology is changing businesses - we only have to see the impact of Uber on traditional taxis, Purple Bricks on traditional estate agents or Airbnb on traditional holiday accommodation, to understand that the world around us is changing because of the use of technology.

The way our young people socialise and interact with each other has also totally changed in recent years with the use of Snapchat, Instagram, Facebook and a plethora of other social media sites, not to mention the streaming of music and films/TV and the advent of e-readers and the subsequent digitisation of books - so different from my day where we went to a shop to buy a CD or borrowed a book from the library!

Technology has also made the world a much smaller place, with the cloud, virtual learning environments, and virtual meeting environments enabling remote working and real-time communication wherever we are. And - for better or worse - this "permanently connected" status of our smartphones and tablets has also meant for many of us that much of our work lives and our personal lives have become 24x7.

And the pace of change continues to increase. Already Artificial Intelligence (AI) is starting to change the world around us, dispensing with the need for some jobs, while creating the need for different, digitally savvy skills to create and manage the technology. This is a trend that can only be set to continue and extend in coming years. Meanwhile the Internet of Things (IoT) is continuing to evolve, with everything from our building management systems, to our CCTV systems being connected to the Internet. Perhaps soon the fridges in our school kitchens will be monitoring their own stock levels and automatically re-ordering items that are running short.

Embracing technology, and equipping pupils with the skills to thrive in the new digital economy, forms a vital part of preparing pupils for life beyond school. Already there are so many jobs that just didn't exist 10 years ago, and there is no doubt that some of our pupils today will be undertaking jobs in the future that haven't even yet been invented.

This is why it is so vital for schools to embrace technology and build it into every element of school life. Of course, embedding technology into school life does rightly raise concerns amongst the Senior Leadership Team as to how to safeguard pupils in this environment, as well as preventing all the distractions that come with things like social media. However with the right controls, processes and technologies in place, this is very much achievable, as has been shown by many independent schools, such as Stroud School, whom I featured in a recent piece on my blog

If you would like to know more about EntrustIT's ICT strategy and project services, which enable schools to embrace digital technology and embed it into school life, please do not hesitate to contact me on 0330-002-0045 or email schools@entrustIT.co.uk

Getting Best Value from ICT Budgets in Independent Schools

With ever increasing demands for new and improved technology in independent schools, it is easy for ICT to become a bottomless money pit. Naturally, every school wants to use technology to enhance the learning environment, equip pupils for the digital world that they will be living and working in, as well as ensure that the school is keeping up with its competitors and using technology in a way that will serve to attract further pupils to the school.

The bursar however, has the unenviable job of trying to balance all these laudable ambitions against a limited budget!

This is where I often get called in to help bursars review current ICT budgets and look at strategic ways next academic year's ICT budget can be most effectively utilised. Because we work with numerous schools, and have a good handle on the technology marketplace, we are able to give bursars a steer on whether they are paying about the right amount for ICT services and staffing both commercially and in relation to other schools. We also look at whether there may be ways they can "flip" their budget to achieve their technological aspirations in a different way.

Every school is different, but with ICT forming a significant part of the school’s overall budget, it is well worth taking a little time to review how best to deliver maximum possible value from a limited pot of resources. Whilst time and space don't allow me to cover every scenario here, I thought it would be useful to jot down a few of the common areas that I find are worth reviewing:-

1. ICT Invoice review. This is often a very revealing exercise, as many schools receive a plethora of invoices from different providers each term or year, relating to services, maintenance contracts, software subscriptions and the like. The descriptions on such invoices are often vague or use technical jargon, which make it hard to know what they relate to, whether they are still actually relevant and whether they are offering good value for money. We have spent time with many schools unravelling their invoices to understand just these factors and frequently this exercise alone has yielded many thousands of pounds in ongoing cost savings.

2. Software review. Most independent schools have an array of software applications that have grown over time. Reviewing (or indeed making!) a list of all applications and asking questions such as "Who uses it?", "What for?", "Do we still need it?" and "Is there a cheaper way to licence it?" normally reveals another nice chunk of money that can be used for more exciting ICT projects.

3. Internet connectivity. With technological advances, prices for Internet connectivity are constantly falling, but many schools are not aware of this and so are oblivious of the opportunities to re-negotiate their contract, or perhaps add a back-up Internet line for the same cost they are currently paying for their main line alone.

4. ICT staffing costs. In some cases, independent schools find a better skills mix and a cost saving can be achieved by part or fully outsourcing their ICT function, or by changing provider.

5. The Cloud. Strategic use of the right public and private cloud solutions can potentially save schools a fortune in hardware and support costs, whilst also offering remote working capability and the ability to securely access the school system from pupil and staff owned devices.

6. "Closed" cloud. For those schools not yet comfortable with the idea of their data residing off-site, closed cloud solutions can offer similar benefits to private cloud solutions, as well as significant cost savings over a traditional network, whilst still keeping all data in school.

7. Leveraging your ICT systems commercially. From utilising digital technology to market your school more effectively, through to renting out your shiny new music technology suite over the holidays, remember you can use your technology to boost your bank balance too, not just deplete it!

If you would like more information on any of the topics raised or if you'd like to book a budget review, please do not hesitate to contact me on 0330 002 0045 or email schools@entrustit.co.uk.

Embedding Technology into Prep School Life

It never ceases to amaze me how much the use of technology in Independent Schools has changed over just a few years.

Only recently, ICT was confined to a suite of school-owned computers in one or two classrooms, specific to the teaching of ICT. Nowadays though, ICT is embedded in everything that we do, and provides part of the learning framework for every lesson, not just ICT.

I was recently visiting Fiona Price, head of ICT at Stroud Prep School in Romsey. Fiona is also the ICT subject advisor for IAPS, and it's great to see how Stroud have embraced and embedded the use of technology throughout the whole of school life.

Every pupil at Stroud from year 5 upwards has an allocated iPad, as do the teachers and teaching assistants, with all other students having access to a banked iPad - so about 400 in all.

To facilitate the use of technology in any part of the school, there is a centrally managed wireless solution that provides coverage across all the various buildings. These types of Wi-Fi systems have moved on light years since the early days of wireless technology, where coverage was sketchy, only a limited number of devices could be connected at any one time in any given area and security was something that had to be set individually on each wireless access point.

Stroud's Internet connectivity is provided by a 50Mbps leased line; again such circuits were cost prohibitive to many schools not so long ago, but have tumbled in price as the market has opened up, allowing many more Independent Schools to obtain high quality, fast Internet connectivity at a reasonable price.

The Internet line at Stroud also provides a secure Virtual Private Network (VPN) connection to Stroud's parent school, King Edward VI School in Southampton, allowing for the sharing of resources between the 2 schools.

By providing pupils with tablets which are routed via the school network, and not allowing smartphones or other tablets in school, Stroud have done much to prevent pupils circumnavigating the school's web access controls.

Stroud's use of ICT demonstrates how a well-designed system can do much to help pupils use technology as an effective learning tool, without the safeguarding risks or distractions that can come with less controlled access.

Should any bursar like my advice on embedding technology in their school, or the associated issues around managed Wi-Fi, internet connectivity and systems security, please feel free to contact me on 0330 002 0045 or email schools@entrustit.co.uk