I’ve blogged about this before and it’s not going away anytime soon. Today Clarence “twitted” this:
That excites me and worries our IT guys. Our IT department is great to work with unlike many of the experiences I hear about. I challenge our IT manager and he challenges me. So upon seeing the twit of Clarence, I immediately teased him with the news. He responded quickly as usual,
Unless they have two completely separate networks they had access to the network. Any number of easily downloadable hacking tools and/or virus’ could easily compromise they entire network. It would be interesting to find out what they have in place to ensure that mission-critical applications could not be compromised? It also brings to light a number of other questions:
- Did the students and parents have to sign an AUP? If so it would be great to get a copy of it. ·
- Are the notebooks required to pass minimum safety/compliance standards? ·
- Who is ultimately responsible when a security breach/attack occurs? Note I said when because it WILL happen. This is exactly why a siem service is essential. ·
- How are they connected to the internet? Is it a provincial system similar to ours? If so, what are the AUP policies currently in place?
Currently we are bound by CNET(Community Net which provides high speed access to all schools in Saskatchewan) AUP which forbids access to network resources by rougue systems. I agree that it is coming however, without a strategic vision/plan not only at the school, the division and indeed provincial level it would be premature to allow rougue network devices on a system. Many questions/leadership issues that our province needs to address.
These are valid questions and issues that I’m sure aren’t easily dismissed. When I posted a similar article a year ago, Lorne (I think he’s from Manitoba as is Clarence) wrote:
Our division not only allows but encourages staff to use their own laptops at school. These computers are given the same access to the school network that that teacher would have on a school owned machine. The same goes for PDA’s etc. This has been the policy for some years now. There is now a very significant percentage of division staff doing this. The same basic policy is in place for students. They are given the same rights with their own machines that they would have with a school owned computer. Obviously, there is a smaller percentage of students doing this.
I’m going to start by lobbying our province to start changing their policies but in the mean time, one year later, how do you respond to this in your neck of the woods and are we missing something or overstating something?
Powered by ScribeFire.
What we are missing is that this is going to happen with or without our permission and guidance. What we are overestimating is how much control we have. What we are underestimating is how fast it’s goinf to happen.
Here in South Central Pennsylvania, we did allow the kids to access the school network with personal laptops prior to this school year. When connected, the kids were bound by the district’s AUP. However, the network was locked down at both high schools this year. I’m not sure of the exact reason why, but I get some sense there was concern about the quantity of traffic over the network. Another concern was not being bale to track these “rogue” computers back to a student should he have figured out how to bypass the Internet filters.
Dean,
This is a timely post, as we are just installing a brand new network that, for the first time is allowing student and teacher wireless access through a secure network and an open wireless network. We are hoping, at least this is the rhetoric I hear, that the open wireless network will satisfy student needs.
However, I have to concur with Sylvia here; it is not a question of when, but how and can we recover? What strength do AUP’s have unless there has been significant teaching in ethics and literacy for the students as they arrive in our schools? I engaged in a discussion with a history teacher today who wants me to come into his classroom and spend a class period going over effective searching and going “beyond wikipedia.” The conversation eventually snaked around to the fact that this teaching of “online ethics” will be the responsibility of every teacher, not just the computer applications teacher.
As a fellow employee in Dean’s school district I can attest to the relevance of this post! In the first two weeks of school we’ve had many requests to allow students and staff to connect their personal laptops to the network. We will have an open wireless network soon that will allow net access and meet some of their needs. However, it is really just a short term fix. In a few years many (likely most) of our particular students will have laptops of their own. Why invest thousands in pc’s when many can bring their own? Good luck with your lobbying Dean!
When I read Clarence’s post today, my jaw dropped and then I did the happy dance. As a middle school teacher, I understand the dangers of brining in personal computers. I know why the IT guys freak out. But then there is my parent side. I have a son who is a senior this year. He has his own laptop and does all his homework on it. When he is at school, he would like to have it for even the simple tasks of taking notes during class. He is faster on the keyboard than with a pen and it is FAR more legible. Our district policy is very strict about no personal laptops at school. We don’t have enough computers to satisfy the needs of our students. Why should they be denied when they have their own? I hope this means change is coming – in MY lifetime!
Yes… I am Dean’s nemesis LOL… like the evil Catbert from Dilbert I am sometimes seen as “The Preventer of Information Technology”. I am NOT an educator by trade (although my first year of university was in education) but I have been in the education sector for over 9 years and an IT professional for nearly 25 years in many different sectors… public, medical and private. I am also in the fortunate (although I question that at times LOL) position of having a wife that is a teacher… actually a consultant in the same division as Dean and myself. The thing that my wife brings to the table is she loves to play devil’s advocate and challenges me and some of my perceptions… Dean’s not the only one 🙂 She is actually one of the best assets I have when it comes to understanding the needs of our students and staff. So, enough background and onto the subject at hand… “rogue” devices on the network. I think everyone realizes that the network and ultimately the internet, is a resource shared among a number of stakeholders… staff, students, parents, support staff, accounting, payroll, HR, etc. As a shared resource I don’t think anyone would argue that no single stakeholder should be able to monopolize the resource… at least to the point of denying others access. So, for arguments sake I’ll throw the following scenario out… a student brings a rogue notebook and is allowed access to the network (the school board has made this a policy)… wired or wireless, it doesn’t matter. The notebook contains a virus which the student did not realize was even on his/her system. The virus has been lying dormant for weeks and on a particular date/time starts a DOS (Denial of Service) attack which quickly saturates the network and uses up all available bandwidth. The DOS attack stops the payroll run… it stops the building control system from communicating with the school boiler and it’s minus 35 degrees Celsius out, the school administrator lost a mornings worth of scheduling, students cannot save their video editing work, etc. The questions this poses are:
Is this acceptable? Who is ultimately responsible… the student… the parents… the person or group that developed the policy allowing students to connect to the network, etc., etc. An even worse scenario would be that the student’s notebook launches a remote attack on a business and causes loss of revenue. Who is responsible for the potential lawsuit? The student… the parents, the school board, trustees? I don’t have the answers but everyone needs to be aware of the potential for disruption of service and/or even the very real potential of lawsuits. It becomes a question of responsibilities and an understanding of the potential issues. Having given the dooms-day scenarios above there are technologies that can mitigate (but NEVER eliminate) the potential for these types of issues. The technology and more importantly the technical expertise required to run these types of systems is VERY expensive at this point in time. Security experts are some of the highest paid people in the IT industry right now… it’s an expensive proposition. Policies, technology, technical expertise and a clear understanding of roles and responsibilities are all part of what it is going to take to make the pervasive use of technology a reality in our schools.
My 2 cents 🙂
I am an IT support person as well. Bary has made many good points. Without the proper infrastructure, process, support and monitoring it would be disastrous to allow personal devices into our network. I agree we should take steps to allow this to happen, but the funding issue needs to be addressed first.
Great discussion. You all have answered many of the questions I have had around this issue.
I am wondering how our situation compares to that of the University. How can they offer access to so many without incurring the same problems that are feared in our younger schools? They have been able to create an environment that gives users freedom and access.
I work in a upper secondary school in Norway. We have laptop classes. Actually – all of our first year students have to bring their own private laptop. We have to networks – a WIFI for the private laptops – with the possibilty to use the printers, and the another network for the school’s computers.
They are students here for 3 years – they get books and teaching material free from school – but has – as mentioned by or lease a laptop for these 3 years.
Coming from north of Dean, I know how frustrating it is for students, parents, teachers and me because we cannot access the system without school computers. Now, I understand the reason and am aware of the whole protection thing. I just thought that, with all the tools available, we be doing different things not just doing the same thing in different ways. Right now, with the system we have, that’s what happening. We aren’t really doing anything different, we’re just doing the same thing in different ways. I understand what all the IT people are saying and how costly it would be and …. The cynic in me keeps thinking – well we now have a glorified typewriter, dictionary and encyclopedia. WooHoo. Btw, the virus will launch from somewhere and cause untold damage to untold millions, it just won’t be from the school network.
Kelly,
I’ve been involved in a number of discussion over the past week that we hope will devise such a system. There is a cost involved both in time and hardware but it’s certainly doable and as has been stated over and over…much needed.
Absolutley it’s doable. I once again point out that it all starts out with policy decisions by senior admin and a clear understanding by EVERYONE of who is liable when (NOT “if”) something goes wrong and what we can do to mitigate those situations. It would be irresponsible to implement a solution without senior admin fist having the discussion and understanding the implications for their division. Here is a link to a recent article from the Gartner Group regarding “The six consumer technologies that are destroying traditional IT”. I’ll preface the article by saying it obviously comes from an IT Department centric site and that I don’t agree/like the title. I think the just of the article is that IT Departments are facing challenges for a number of reasons… both good and bad. In many cases IT Departments need to change and evolve but it needs to be done in a managed way.
http://blogs.techrepublic.com.com/hiner/?p=548&tag=nl.e138
Thanks to the article, Now there is more reason to comment than ever before! Good post… I found it via Google. They most love you!