Tips to Avoid Student Data Breaches

Posted by eschoolnews on April 27th, 2019

One of the ways education in technology news has not been good is the occasional report of student records being exposed to the public and other data breaches of public school records. At the heart of the issue is the fact that the educational organization is responsible for safeguarding personal data from any student they collect data from. Here are some suggestions to make sure that data is as safe as possible.

Practical, Immediate Steps

Much of student data protection is simple common sense and practical policy. This is because most data breaches are due to careless handling of the data, not actual hacking. It's far more likely a student’s data will be seen by someone unauthorized because a database was left open on a PC, laptop or unattended smart device than it is a hacker will work their way into the school’s central computer system and database.

One suggestion is to implement an immediate inventory of all IT assets available to teachers and students and verify that they are using the devices in compliance with IT security rules. For example, if a teacher is using a school laptop, they must not only sign out for it, but complete brief training in how to ensure it is always in their control. Another step is to insist that all databases with student info on them require a password every time it is accessed and that a user is logged out after five minutes of inactivity.

Policy

The next prong in attacking data breaches is to implement policy that promotes sound data management practices. These types of policies make it harder for someone not authorized to get access to school data and for those using school IT systems to have to prove their identity and need frequently. Additionally, a backup policy that records all actions taken on any given PC or laptop when on the school’s IT system is a good idea.

There are many different policy suggestions, but the key is to make sure the policy only allows those with authorization to get to where student data is stored. That can mean policies that require a physical move, such as mandating that unauthorized individuals not have access to administrative offices unless accompanied by someone who is authorized. It also can mean policies that require electronic verification, such as two-factor authentication be implemented on all school and school district database systems.

As with any data breach, the key to effective prevention is a mix of practical steps and policy that is geared towards preventing unauthorized access to student data. Done in tandem, data breaches, while probably not ever avoided altogether, can avoid being the next example of education in technology news.