Information technology

Restricting access to least privilege necessary is a concept where users are provided access to only the resources and data required to perform their jobs, but restricted from resources that are not necessary to their job function. This concept can be applied across many aspects of managing a school district, from restricting the physical key access to buildings to tightening the controls over IT systems.

Restricting access helps ensure unauthorized employees cannot manipulate data and that only those who need access to perform their job function can view sensitive data. For example, payroll clerks do not need to create purchase orders as a part of their job function, so under the concept of least privilege, they would not have access to create purchase orders. 

Implementing least privilege necessary can be done through broad role-based access rights based on a particular job function for a group of employees, and through very specific rule-based access rights that restrict individual employee access to specific files and folders. A district should determine the most appropriate way to establish user access to help control IT systems and data. 

Typically, system managers are responsible for deciding and approving appropriate access, but it is IT’s role to actually set up the users’ access and ensure the system enforces the appropriate access levels. The system manager should not have the actual capability within the IT system to grant users access.

A district should develop IT policies and procedures to help protect its systems and data and to describe the appropriate use of its IT resources. These policies and procedures outline district processes and provide written guidance to employees to help ensure employee accountability when using the district’s IT resources. It is important to clearly communicate and disseminate all policies to district employees to ensure they understand and are aware of the district’s IT policies. 

System managers should work in conjunction with IT to develop policies as needed. Decision-makers should be informed of those policies and procedures and approve their implementation, as well as making any key decisions necessary to facilitate the creation of the policies.

There are a number of resources available that the IT industry uses to help shape policies. Some of these resources include, but are not limited to, Control Objectives for Information and Related Technology (COBIT), National Institute of Standards and Technology (NIST), Federal Information System Controls Audit Manual (FISCAM), and the International Organization for Standardization (ISO). 

Another resource available to districts is the set of policies and procedures set forth by the Arizona Strategic Enterprise Technology (ASET) Office within the Arizona Department of Administration. ASET established these policies for Arizona State agencies, but a district can easily adapt them for its own needs. It is important to note that a district should review these resources regularly because IT best practices can change rapidly. In addition, these IT resources should act as baselines for IT practices, but a district may need a higher level of control based on its specific circumstances.

Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) provides alerts, tips, and resources. For example, CISA’s Weak Security Controls and Practices Routinely Exploited for Initial Access alert discusses the weaknesses malicious cyber actors commonly exploit and best practices that entities can use to help strengthen their network security controls. CISA’s alert #StopRansomware: Vice Society, issued jointly with the Federal Bureau of Investigation and the Multi-State Information Sharing and Analysis Center (MS-ISAC), discusses ransomware attacks against the education sector and recommended mitigations techniques to reduce the risk of the cyber incidents.

IT should be responsible for knowledge and implementation of IT best practices within a school district.

As hardware and software are updated and personnel changes occur, the current DRP plan may not work as intended. By testing the DRP plan regularly, the district can expose any issues that may arise during an actual emergency and, thereby, develop new procedures to ensure the DRP plan will work as needed in an emergency.

Disaster recovery testing documentation should describe how the district performed the tests, what the test results were, and any lessons learned from the test. If the tests did not identify any problems or gaps in the DRP, the district should document details of how the tests conducted showed that the plan worked. If the tests identified problems or gaps in the DRP, the district should document details of how the tests conducted showed that the DRP failed, why it failed, and how the district can remedy the issue(s). Maintaining these test records allow the district to track the changes of the disaster recovery plan to ensure, throughout its lifetime, that the plan still meets the original design intention. 

It is typically IT’s responsibility to determine appropriate disaster recovery test documentation to illustrate the testing outcome and challenges; however, system managers and decision-makers should be informed of the test outcome.

Proper monitoring can help a district be proactive and address potential threats and other issues before harm occurs. Logging and monitoring are essential to ensuring the integrity of district data. Logging involves keeping a record of changes and actions related to the district’s network and computer systems. Monitoring involves timely reviewing of log activities that a district deems important to ensure actions being performed are appropriate. 

Most accounting and student information systems, as well as their databases, have logging functionality built in, often enabled by default. On the IT infrastructure side, operating systems and network devices, such as firewalls, web filters, and anti-malware products, can also be configured to log activities and events for review. IT staff often need to manually enable this type of logging, but it can add value to operations. 

Due to the nature of IT systems, logs can quickly become unmanageable in length. As a result, a district should determine the key activities or critical IT events and areas to log and monitor, such as those affecting security, availability, and appropriate use of its computer systems and other resources. Once the district has identified what data is sensitive and what actions it is most concerned about, such as unauthorized users accessing the network, it should log and monitor these events and follow up when something occurs that requires attention. The district should review these logs on a regular basis to ensure appropriate actions are taken to resolve issues identified. Some organizations find it useful to develop or acquire software to help them to correlate, monitor, alert, and report on the events they decide to log. 

IT should generally be responsible for logging and monitoring efforts; however, it is also important for system managers to be accountable for identifying those key activities that should be monitored, such as activities that do not have a compensating control elsewhere or that pose a segregation of duties issue. System managers should also monitor logged activity reports to help ensure that activities are appropriate and follow up and remediate any questionable activities if necessary.

Network directory services provide a shared infrastructure and often a central information repository that a district can use to help locate, manage, administer, and organize network resources, such as users, groups, devices, and storage volumes. These services also provide capabilities to set and manage policies that apply to these resources. For example, use of directory services would allow a district to set and manage policies that govern what district users and workstations can and cannot do and what resources they can and cannot access. Changes to the workstation policies would be automatically applied to all of the district’s workstations, instead of requiring IT personnel to make changes to each computer manually. Properly configured, this would help ensure that no computer on the network would be running outdated policies. 

IT is responsible for ensuring appropriate user account management on the network.

Decision-makers, system managers, HR, and IT should discuss the potential implications involved with social media, wireless and remote access, and personal devices. Following a district-wide determination of appropriate technologies, IT will typically develop the related policies and submit them to decision-makers for review. 

Like any change in practice, before a district adopts a new IT practice, it should consider the security risks that any related technology introduces, ways to help mitigate those risks, and what policies will be needed to guide the use of these technologies before adopting or permitting the use of any new technology. A few examples of risks to consider for BYOD, social media, and wireless and remote access are listed below. 

BYOD 

• A district should be aware of all devices that are on the network or using district resources to ensure it can monitor these devices. Monitoring can help detect malicious activity occurring on, and from, these devices. 
• A district should consider how the BYOD devices will access the Internet and how they will maintain compliance with federal regulations such as Health Information Portability and Accountability Act (HIPAA), Children’s Internet Protection Act (CIPA), and Family Education Rights and Privacy Act (FERPA). 
• A district should consider how to ensure adequate security of mobile devices to prevent the devices from potentially infecting district networks with malicious software. 
• A district should consider what data BYOD devices can store, view, and modify and how it should protect that data while on mobile devices. 

Social Media 

• A district should consider the goals and objectives for social media. A valid district purpose should exist to warrant social media use. 
• A district should consider what users can post to social media sites, who can post, and develop policies to guide staff on what is appropriate. 
• A district should consider what district-related information employees can post on their own personal social media outlets and develop policies to guide staff on what is appropriate.
• A district should consider how to manage feedback from nonemployees posting on the district’s social media sites. 

Wireless 

• Many districts have already implemented wireless technologies to support mobile devices such as laptops and tablets. However, a district should consider security features to ensure it is protecting sensitive and/or confidential data from outside users prior to implementing wireless technologies. 
• A district should consider how it is going to isolate the wireless devices from the network and whether they wish to allow the devices to access network resources. 
• A district should consider how to provide web content filtering to wireless devices so it ensures compliance with district policies and guidelines and federal regulations, such as Children’s Internet Protection Act (CIPA). 
• A district should consider how it is going to monitor the wireless network to determine if there is any unauthorized access or attempted attacks on the network. 

Remote access to systems and resources from locations outside the district 

• Remote access provides mobility to employees by allowing authorized users the ability to perform work away from their offices, such as working from home. Despite the benefits to end-users’ mobility, remote access does introduce security concerns to a district’s information technology that it should consider and address before permitting remote access. 
• A district should have authentication solutions in place to help ensure that users who are attempting to access systems remotely are authorized to have such access (See FAQ #17). 
• Since remote access may allow users to access some data from outside the district’s internal network, a district should consider what information it should restrict while remotely connected. Controls should be set up to ensure that it enforces these restrictions to prevent employees who are remotely connected from unauthorized viewing, modifying, or transferring of data outside the district’s network. 
• As remote access enables a district to send sensitive data off-site for employees to perform their duties, the district should consider how to secure the sensitive data. This includes securing data while it is in transit from the district to the remote users’ locations, as well as data at rest on both district machines and any personal machines. One potential solution for the district is to use full-disk encryption on all remote hard disks that will store district information. 
• A district should develop policies for connecting to district resources remotely, including the security requirements for remote-access users to minimize the potential damage from unauthorized use that may result in the loss or misuse of sensitive data. Policies should address data accessed remotely with district computers and with nondistrict machines, such as employee home computers that are allowed to log into district servers. 
• To address employee turnover, a district should have procedures to disable remote access quickly to help prevent former employees from unauthorized access to sensitive data.