Cybersecurity, safeguarding and schools: What every school needs to know about threats online
From recording and reporting detailed performance data, to staff sharing content and collaborating with students, schools are increasingly reliant on computers and connectivity.
In recent times, the already sizeable task of managing data security has increased considerably for schools. When teachers and other school staff work from home and pupils take part in online learning, the risk of sensitive data leaving the school’s network grows. Our research has shown a doubling in cyber crime over the past five years, and we know that cyber criminals are quick to take advantage of an evolving situation.
Cybersecurity and online safety risks
The Information Commissioner has previously advised schools to be particularly vigilant around information security. It has warned that unauthorised access to personal information would be particularly harmful to pupils; parents and staff; people with a right to seek compensation if the loss of their personal data caused them damage.
Educators need to think about the agility of their systems. If necessary, how quickly could they switch to a model where staff and students work from home without compromising on school cyber security policies? It’s a serious consideration: If school resources were to be made inaccessible by a ransomware attack, learning could grind to a halt.
While the risks of malware and data theft are relevant to any organisation with personal data and computers, schools are particularly exposed to several other risks relating to online safety, including:
- Exposure to sexually explicit, racist, violent and extremist content
- Inappropriate contact from people who may wish to abuse, exploit or bully them
- Students themselves engaging in harmful online behaviour
Prioritising the physical and online safety of children continues to be a focus for schools’ leadership teams and it’s important that IT teams are able to review and implement changes to ensure their online safety.
An effective approach
Guidance published by the Department for Education requires that school governors and managers put in place “an effective approach to online safety” to “protect and educate the whole school or college community in their use of technology and establishes mechanisms to identify, intervene in and escalate any incident where appropriate.”
What an “effective approach” looks like is somewhat subjective and can differ from organisation to organisation. In Beaming’s experience, the most secure organisations use technology where appropriate, supported with clear policies and, most importantly, extensive user education. With the changes we’ve seen in the way education is delivered in the wake of the Coronavirus, it’s a good time to review school cyber security procedures and update policies.
- Education
- Fibre
- Data Security
Folkestone St Mary's C of E Primary Academy
A fast and reliable internet connection is a necessity in the modern classroom, but this must be balanced with the very important matter of safeguarding students.
12 steps to better cybersecurity and safeguarding for schools
Schools should consider the following twelve pieces of advice when developing their own cyber security and online safety approaches
1. Take ownership at senior level
The Government’s statutory guidance requires that a member of the senior leadership team is made responsible for safeguarding in schools. Cybersecurity and online safety should be taken just as seriously. They should be discussed regularly with school governors and at leadership team meetings. Appropriate policies should be implemented and enforced by the senior leadership team itself.
2. Establish a strong online perimeter
Schools should establish strong boundary firewalls and internet gateways to protect school networks from cyber attacks, unauthorised access and malicious content. Cyber security controls should be monitored constantly and tested on a regular basis.
3. Update content filters, constantly
People are usually the weakest link in organisations. In schools there are many young internet users with curious minds that need extra protection. Content filtering systems need to be updated constantly as tech-savvy students are capable of creating new ways to circumnavigate filters with incredible speed.
4. Establish solid access control policies
Schools should establish effective processes for managing user privileges to their systems to minimise the risk of deliberate and accidental attacks. Users should be provided with the minimum level of access they need to do their job. When staff members leave the school, their access should be revoked promptly. All records should be kept up to date to prevent exploitation of old accounts.
5. Check third party providers thoroughly
Schools should ensure they vet thoroughly all third party platform providers used for to ensure their approaches to security and safety are at least as stringent as their own. Access to students, parents and guardians should be granted by teachers themselves using email addresses provided in person.
6. Ensure secure configuration and patch management
Schools should know precisely what hardware and software is being used on their networks and ensure configuration changes are authorised, documented and implemented appropriately. Devices should be set up so that only approved users can make changes. Software updates and security patches should be implemented quickly when released by manufacturers.
7. Monitoring and incident management
Schools must monitor all of their systems continuously and analyse them for unusual activity that could indicate an attack. Criminal incidents should be reported to the police and other relevant authorities.
8. Invest in cybersecurity and online safety education
The Department for Education requires that students are taught about online safety as part of safeguarding for schools. They should ensure that members of staff understand the risks and their own security policies covering acceptable and secure use of systems. There should be regular sessions to ensure staff and students are aware of new phishing or spoof email attacks.
9. Don’t forget about physical security
Schools should maintain cybersecurity defences that are appropriate to the importance and sensitivity of the systems and data requiring protection. Planning for these should include the physical security of hard drives, internet routers, servers and other devices on which data can be stored. School equipment is targeted by thieves, especially in the school holidays, so any device holding sensitive data should be encrypted.
10. Consider personal devices
Schools should have clear policies around mobile technology and how it is used on their premises. Students should be taught about acceptable use of their personal devices, how they interact with each other on social media and where to turn for help.
When staff are working from home, they should be provided with IT equipment that’s for work use only and is not to be shared with other household members.
11. Use of VPN
When staff are working from home, VPNs should be used to ensure that data being sent back and forth to the school’s network is encrypted, meaning that even if it were to be intercepted it would be indecipherable.
12. Staying in touch
Pupil safeguarding issues need to be dealt with sensitively, which often means that a voice conversation is more suitable than speaking via email. However, staff calling pupils and their family members from their personal phones creates another safeguarding issue in itself. Putting in place a cloud hosted telephone system can mitigate this problem as phone calls can be made from diverse locations and devices whilst presenting the school’s telephone number. Call recording can also be a useful feature here, but call recordings must be treated with the same sensitivity as other personal data.
Beaming’s Guide to Cyber Security for Schools
We’ve created this free downloadable guide to cyber security for schools to help all employees – from admin staff to senior management – play their part in protecting against cyber attacks and other online harms.
In the guide you’ll find:
- 7 simple steps to better cyber security for teaching and admin staff
- A focus on phishing
- Picking the right password(s)
- Working from home securely
- IT & management teams: What’s your responsibility?
- 12 steps to better safeguarding and cybersecurity
- How do young people get into cyber crime?
Enter your details below and we’ll send this free guide straight to your inbox.
Schools we’ve supported
Our happy education sector customers share the results they’ve achieved with the help of Beaming’s products and services.
- Education
- Fibre
- Data Security
Folkestone St Mary's C of E Primary Academy
A fast and reliable internet connection is a necessity in the modern classroom, but this must be balanced with the very important matter of safeguarding students.
- Education
- Leased Lines
The Sabden Multi Academy Trust
Bringing much-needed synergy to some very special schools
- BeamRing
- Telephony
- Broadband
- Education
- Not For Profit
Sandown School
Sandown School aims to form close relationships with families & the community. Until recently, the school’s telephone system was not providing the support the school needed.
- Education
- Leased Lines
- Digital Transformation
St Mary's School
The students at St Mary’s are already facing their own communication struggles. Our solution has genuinely improved the lives of the young people, their parents and staff alike.
- Education
- Fibre
- Data Security
Folkestone St Mary's C of E Primary Academy
A fast and reliable internet connection is a necessity in the modern classroom, but this must be balanced with the very important matter of safeguarding students.
- Education
- Leased Lines
The Sabden Multi Academy Trust
Bringing much-needed synergy to some very special schools
- BeamRing
- Telephony
- Broadband
- Education
- Not For Profit
Sandown School
Sandown School aims to form close relationships with families & the community. Until recently, the school’s telephone system was not providing the support the school needed.
- Education
- Leased Lines
- Digital Transformation
St Mary's School
The students at St Mary’s are already facing their own communication struggles. Our solution has genuinely improved the lives of the young people, their parents and staff alike.