district support team (dst)...• the plan for building a trusted learning environment (tle)...

District Support Team (DST) Meeting – February 8, 2018

District Support Team (DST)

Meeting: February 8, 2018

Student Data Privacy and Security

Building a Trusted Learning Environment (TLE)


Student Data Privacy and Security Building a Trusted Learning Environment (TLE)

What are we going to talk about?• The risk of managing student data privacy and cybersecurity

• How we are addressing the problem

• The plan for building a Trusted Learning Environment (TLE)

Presented by Frankie Jackson, Jennifer Miller, and Eric Pena


School System Leaders Are Concerned

• According to the results of the 2017 Consortium of School Networking (CoSN) Leadership Survey, 61% of technology leaders identified privacy and security as a primary concern.

The Risk of Managing Student Data Privacy and Cybersecurity

www.cosn.org

http://www.cosn.org/


Parents Are Concerned

• In the 2016 Future of Privacy Forum survey results, 84% of parents are concerned that their child’s electronic education records could be hacked or stolen.


www.pf.org

http://www.pf.org/


Incidents Are On The Rise by 100%



Incidents Are On The Rise by 100%


• Since 2016, hundreds of K–12 schools and

districts experienced one or more publicly

disclosed cyber incidents.

• Incidents are reported every week.

• Many incidents aren’t reported.

• If the pace continues that will represent a more

than 100% increase compared to last year.

Sources:

DataBreaches.net

Privacy Rights Clearinghouse.

https://www.edtechstrategies.com/

https://www.databreaches.net/

https://www.privacyrights.org/



Cybersecurity Incidents Are On The Rise



• More awareness of cyber activities

• More schools using hackable technologies

• More schools going 1:1 and relying on digital

tools

• Schools are a vulnerable target

• Student data is extremely valuable


Northside ISD Phishing Incident


• August 2016 Northside ISD experienced a

sophisticated phishing incident.

• Over 30,000 notification letters were sent to

staff and students as a result

• Cyber insurance covered the bill, but without

insurance the cost would have been over

$525,000.

https://thejournal.com/articles/2017/03/31/ed-tech-strategies-publishes-k12-cyber-incident-map.aspx

https://thejournal.com/articles/2017/03/31/ed-tech-strategies-publishes-k12-cyber-incident-map.aspx


The Cost is SIGNIFICANT


• Even when these penalties and costs are not imposed, the loss of credibility, embarrassment to the community, and compromising student privacy is detrimental.


Aldine

Austin

Cleburne

Cypress-Fairbanks

Houston

Killeen

Klein

Lamar

Leander

Lewisville

McKinney

Northside

Round Rock

How Are We Addressing the Problem?

Formed a Focus Group


Aldine

Austin

Cleburne

Cypress-Fairbanks

Houston

Killeen

Klein

Lamar

Leander

Lewisville

McKinney

Northside

Round Rock

What Are Texas CTO Leaders Doing to Address the Problem?

Formed a Focus Group

• Meet in a web conference every

other Friday

• Share best practices

• Do a “weigh in” to report status

• Cheer each other on

• Talk about issues


• Initiative of CoSN (the Consortium for School

Networking), in partnership with AASA, the School

Superintendents Association, the Association of

School Business Officials International (ASBO), and

ASCD.

• In 2015, developed in collaboration with a diverse

group of 28 school system leaders from across the

country.

Using the TLE

Seal Program

What Are Texas CTO Leaders Doing to Address the Problem?


• The Trusted Learning Environment

(TLE) Seal is a Mark of Distinction

for School Systems, signaling that

they have taken measurable steps to

implement practices to help ensure

the privacy of student



http://trustedlearning.org/


http://trustedlearning.org/


What is the TLE Seal Framework?

• School systems commit to high compliance standards and continuous examination and evolution of privacy practices.

• The TLE is the only data privacy seal for school systems. It signals adherence to high standards around protection of student data.

• The TLE Seal is a comprehensive approach for establishing frameworks around the protection of educational data.

• It’s available to any school system!



• Requires schools to

have implemented

student data privacy

protections that meet a

set of high standards

around 5 core practice

areas.

How Do You Get Started?



1. Leadership Practice: manage and collaborate with

stakeholders regarding the use and governance of student data

to inform instruction

2. Classroom Practice: implement educational procedures and

processes to ensure transparency while advancing curricular

goals

3. Data Security Practice: perform regular audits of data privacy

and security practices and publicly detail these measures

4. Business Practice: establish acquisition vetting processes and

contracts that, at minimum, address applicable compliance laws

while supporting innovation

5. Professional Development Practice: requires school staff to

conduct privacy and security training and offer the instruction to

all stakeholders

TLE Seal Practice Areas



PLAN OF ACTION

• Using special software or hardware to protect data

• Training staff, particularly about phishing and

downloading of unfamiliar files

• Hiring staff with IT security expertise

• Seeking outside help

• Making data privacy a top district priority

• Working through a TLE action plan

• Submitting a TLE application to apply for

the seal of approval

Plans for Building a Trusted Learning Environment (TLE)



James Costello

• KnowBe4

Implementation

• Security POC


• Working at the state level with the Texas Student Data Privacy

Alliance

• Joined Infragard and MS-ISAC Cyber Security

• Leading the TLE project implementation

• Working with Steve Smith, Cambridge Public Schools, leader in

the data security and privacy education focus

• Working with district subject matter experts to gather data

• Setting up an organizational structure through the Performance

Excellence department to support a Trusted Learning Environment


TLE Leadership


Tools for Building a Trusted Learning Environment (TLE)

Student Data Privacy Alliance• Participating in the Texas Student Data Privacy Alliance webinars

and meetings

• Met Saturday, January 27, 2018 with the state subgroup

• Reviewed state agreements in effect for California and

Massachusetts

• Worked with districts and legal representatives to examine

HB2087 and edit the proposed Data Privacy Agreement for

the state

• Presented at TASA regarding the work the Texas CTO Council has

completed regarding the Data Privacy Alliance

• Working to identify our vendors and agreements already in

effect with our district and partner districts.

Data Security 1 - The school system website includes its data privacy and security policies and practices which

are updated as-needed, but at least on an annual basis.



Student Data Privacy Agreement(In Work)



PROJECT TIMELINE



2017-2018 Implementations• Purchased Cyber Security Training and

Phishing Software – KnowBe4

• Testing Vulnerability Scanning -

eLock360, SpyCloud



KnowBe4

Security platform that enables users to make smart security decisions.

• Provides Cyber Security Awareness Training modules and videos

• Customizable automated Phishing attacks for training purposes

Professional Development 2 - The school system provides employees with up-to-date, easily accessible resources

and documented processes, including exemplars and templates that facilitate student data privacy and security.



KnowBe4 Initial Phishing Campaign

• Began September 20, 2017

• Distributed to 19,832 email accounts

• 1,101 “Clickers” during the first 8 days

829

Clickers in the First 8 Hours Clickers in the First 8 Days



KnowBe4 Training

• Different modes of training for all types of end users based on phishing results

• Videos and modules

• Multiple levels of cyber awareness information designed for staff



KnowBe4 Training Certification



CypherSecurity eLock360 Testing

• System scans the dark web to identify instances of @cfisd.net

• Provides information to the district for research and review



eLock360 Testing


Training for Building a Trusted Learning Environment (TLE)

Trusted Learning Environment Training – February 19, 2018

Business 1 - The school system has implemented a process for vetting online services for data

privacy and security.


Training for Building a Trusted Learning Environment (TLE)

Business 2 - The school system regularly educates its employees about the importance of, and expectations for,

the use of the established vetting process for online services.

Business 3 – The School system implements contract language and data sharing agreements addressing student

data privacy and data security.

Trusted Learning Environment Training – February 19, 2018


Leadership Practices

CFISD Current Status Trusted Learning Environment (TLE)


Business Practices



Data Security Practices



Professional Development Practices



Classroom Practices



Submitting TLE application March 30

Receive results

Review suggested

improvements

Implement action items

Continuous improvement


district support team (dst)...• the plan for building a trusted learning environment (tle)...

Documents