A guide for ICT Team Leaders

Cloud Storage - is it safe to use?

Cloud based storage and online synchronisation offers individuals many benefits, one of which is removing the need to carry flash pens and portable disks around. The question that needs to be asked is what issues are raised by this increasingly popular and free service.

Google Apps and Live@Edu have storage space available as part of their email offering. An increasingly popular trend is synchronising online storage. Dropbox and SugarSync are currently two of the more popular. The services mentioned are all available at no charge but with limits be it limited storage, non-existent Service level agreements or limited control over the functionality or how it changes.

The main concern with Dropbox is the significant risk of breaching the Data Protection Act. Staff wishing to store personal information should not use a service that does not comply with the EU Safe Harbor agreement. The EU Safe Harbor agreement requires that personal data is stored in the EU or in other countries where we have set agreements. Dropbox is hosted in the US is non-compliant!

There are also security issues with free services, in June 2011 Dropbox confirmed that a programmer’s error caused a temporary security breach that allowed any password to be used to access any user account. If you decide to use this service it’s highly recommended you encrypt your files prior to synchronisation.

Web Browsers – Upgrade to Internet Explorer 9

IE9 is the most secure and best performing Microsoft browser it therefore is recommended that schools upgrade. Websites designed for earlier versions may not display correctly to resolve use a feature called Compatibility View.

To ensure IE9 can view all webpages correctly an icon titled compatibility view has been added. The icon normally looks like  and can be found to the right of the URL address bar. When selected, the icon changes to a solid colour , and from now on this website will be displayed in compatibility mode.

IE9 has simplified its design, most command bar functions, like print and zoom can be found by selecting the Tools button . Favourites and feeds appear in the Favourite Centre by selecting Favourites button . IE9 has added improved security and privacy options these include; ActiveX Filtering, Smartscreen Filtering, 128 bit Secure Socket Layer (SSL), Tracking Protection and Private Browsing.

Use ICT to improve efficiently and save money

ICT can be the catalyst for change, developing new working practices, automating existing procedures and facilitating innovation and creativity. Used correctly it can also save your school money. How can ICT reduce costs for the school?

Virtualisation

The concept of running multiple operating systems off the same hardware platform is not new but it is now mature and low cost. The virtualisation software allows the operating system and installed applications to share physical resources. On average one virtualised server can do the work of four conventional servers. Substantial savings can be accrued in reducing energy costs, hardware maintenance and software licensing. It is estimated a secondary school can save £10,000 - £20,000 a year.

Print Management

Schools are generally poor at managing print services. Vanilla Microsoft Server 2003 and 2008 deployments have limited print management capabilities, additional services are often required. Schools may not be aware of how many sheets of paper they use annually but it may well be over a million. Paper costs are only a small proportion of the actual cost, you need to consider energy charges, hardware purchase and toner replacement. Most large secondary schools can save £50K per year if they deploy effective print management. The Learning Platform is an ideal vehicle to reduce paper, improve communications, store documents and resources and has the additional benefit that document review can be audited.

Desktop Computers

Older desktop PC’s are very inefficient, replacing hardware can actually save the school money as well as improve user experience and system reliability. Whether you use old or new hardware configuration of the power settings makes a considerable difference to daily running costs. Windows 7 and OSX Lion have improved power saving features that allow you to switch off the display after period of inactivity or switch the desktop into sleep or hibernation mode after a set time has elapsed. All of the power configurations can be centrally managed from the domain controller using Group Policies.

Remote Access to School Network

Staff should not have copies of sensitive data on their own laptop on or off-site. Secure remote access provides on demand access to centrally managed services. The most suitable type of remote access solution is a SSL-VPN with two factor authentication. An alternative solution is Direct Access using Windows 7 and Server 2008 R2. A word of caution, many portal gateways deployed by schools have limited security and should not be used to allow staff access to the MIS system or any confidential data.

Securing Wireless – distinguishing myth from fact

A lot of expert advice on wireless security provides limited practical improvements in security and some cases the advice is simply dumb. Some prime examples of where general advice and good practice diverge are shown below.

Hiding the SSID

The SSID beacon is only one of five broadcasts sent by the wireless access point so disabling one of five makes the solution less user friendly and has no significant impact on security. Rather than hide the SSID make sure you change the default name as default SSID otherwise you are broadcasting to the world with a poorly configured device which makes it an easy target.

Disable DHCP

An attacker can find the IP range of a wireless access point in 10-15 seconds if DHCP is disabled. Using static IP addresses has negligible security impact and complicates wireless use. Leave DHCP switched on and use the security mechanisms that are available.

Antenna Placement & Signal Strength

It is often suggested that the wireless access point should be positioned to improve security and that signal strength should be lowered to ensure the signal is weakened and cannot be detected externally. This technique is the road to ruin for wireless solutions, antenna placement and signal strength adjustment changes need to be set for maximum coverage and minimum interference, never for improving security.

Use 802.11a instead of 802.11bg

The 802.11a protocol is not any more secure than 802.11bg; the protocol is simply a transport mechanism for wireless that works in the 5GHz band. Changing the frequency and transport protocol is equivalent to changing the colour of your front door to improve security

Enable MAC Filtering on the Wireless Access Point

MAC addresses are 12 digit HEX numbers which can be viewed by others in clear text with a sniffer application. An attacker simply reads the MAC address of connected device and replicates the MAC on their wireless card. Restricting access based on MAC addresses is management intensive and has limited ROI in terms of security gain.

Allow staff and students to bring their own ICT devices into school

The problem is that non domain devices cannot be checked to ensure they are virus free, have adequate security patches installed and have suitable software. The use of Network Access Protection and/or Network Access Control solutions can resolve this issue. Some schools deploy a thin client architecture which allows guest devices to securely connect but with limited functionality.

On 1st March 2011 Microsoft introduced a new licensing scheme for schools called Enrolment for Education or EES for short. This agreement is a low cost alternative to School Agreement Subscription service and ideal for a school that are looking at a technology refresh i.e. upgrading their workstation and server operating systems and Microsoft applications.

• EES single annual payment based on FTE staff count and the products you select.
• Choice of software include MS Office, Windows Upgrade and Client Access License (CAL) suites
• License additional software on all or selected computers e.g. MS Visio

A school that is not planning to upgrade their software in the next two years is better off retaining the Schools Agreement Subscription Service. The MS Select Agreement is a perpetual license that offers schools low cost prices for Microsoft software. The EES annual subscription model allows decisions on upgrading the operating system and applications to be made on the basis of Teaching and Learning need rather than on cost grounds.

Green Technology & Cutting ICT Spend

Saving energy, conserving resources and looking after the environment are everyone’s responsibility. Schools can contribute by considering many of the measures previously discussed; saving money and going green are usually one and the same. Some schools address many of the green issues by using technology efficiently and effectively some of the ways they delivered include:

• Replacing desktop computers with thin client PC’s and/or laptops
• Reducing the use of data projectors and high power equipment
• Liaising with the Network Manager as they have operational responsibility for ICT
• Increasing staff and pupil awareness using practical example of energy use and power consumption
• Moving selected ICT services, when appropriate, to the cloud
• Maintaining server room temperature at a steady 20°c

If schools require further technical advice or assistance with ICT contact Mark Vinnicombe on 01914611844 or email This e-mail address is being protected from spambots. You need JavaScript enabled to view it