Pearson AIMSweb 1.0 Data Breach – What You Should Know

All,

As you may have heard recently through your Principal or in the media, the Boulder Valley School District found out that it is one of more than 13,000 school districts and universities that have been impacted by a data breach at one of our key vendors – Pearson.

First, it is important to know that this breach impacted current and former Boulder Valley School District students. The breach, although significant, was contained in BVSD to name and date of birth.  No other personal information was breached through this event at Pearson.

This information is being shared so that you are aware of the situation and can better answer any parent or community member questions that may come up.

The Pearson AimsWeb 1.0 Data Breach
BVSD learned in August 2019 that an unauthorized third party gained access to Pearson’s AIMSweb 1.0 system in November 2018.  Pearson was made aware by the FBI in March 2019 but was restricted in communicating to BVSD sooner due to the ongoing investigation.

We have notified individuals directly impacted by the breach by mail. Families would have received a letter by August 30 if they were affected. Pearson is paying for the expense of notifying families and for identity or credit monitoring service through Experian.

It is important to note that at this time, Pearson has no evidence to suggest that the breached information has been misused.

Why was BVSD Using AimsWeb 1.0?
Pearson is best known as the publisher of print and digital textbooks but also develops education-related software. BVSD used AIMSweb 1.0 to track progress, inform instruction, and provide updates to parents. AIMSweb 1.0 was permanently taken out of service in July.

Our own internal investigation found no other Pearson products to be impacted by this breach.

Next Steps
I take the safety and security of our students, staff, and their data extremely seriously – as does our entire leadership team.  BVSD already has many proactive processes in place to help prevent student data breaches, and we continue to reevaluate our processes for improvements.

Additionally, BVSD continues to be in compliance with the Colorado Student Data and Transparency Act and remains vigilant in protecting student data. We will continue to work with Pearson and other vendors to ensure everything possible is done to protect the privacy of student data.

Working together, we can minimize threats, including phishing attacks, viruses, malware, and ransomware.   As always, please chime in below with your thoughts, comment, and ideas on this topic.

Andrew 

Data Visualized at BVSD

What is VizLab?

BVSD has been working for the last two years to create a data warehouse with a tool called Tableau to visualize the data. We call this effort VizLab which has empowered users by bringing together many different types of data to drive instruction in a quick, real-time and easily accessible way. When looked at in isolation, it can be hard to get the full picture of how students are doing, but combined, these data points give us a comprehensive picture of student progress allowing us better support students. Multiple data sets are directly and easily accessible in a new, visually engaging way to the people who can use data to take action and better serve students.

As with all of our data, security is very important, so teachers can only view data for the students they are working with.

Who is using VizLab?

All Administrators and ~60% of teachers have been trained so far! We have a goal of 100% of teachers trained by the end of the school year.

How are teachers using this data? Educators across the district are analyzing student data to reflect on and improve their practice (BVSD Teacher Effectiveness Standard 3, Element b). VizLab supports educators in using data more efficiently.

The data from VizLab has helped teachers target specific interventions to address the achievement gap. While it is powerful to see the data, the real power comes in taking action based on this evidence. Teachers have been using VizLab to get an overview of which students are in need of extra support, look at risk factors for particular students, plan reading groups, and use the data for student support meetings. They have also found it helpful for showing data to parents at conferences and to the students themselves so they can track their progress. Here is how some ELD Teachers from Angevine shared about how VizLab has worked for them:

At the beginning of the year, we really appreciated how thorough the class overview was. Easily being able to see “Years in ELL” for every student in each class in one quick look has been extremely helpful.

As the year progressed we have begun exploring the Early Warning System to target students we need to look at as an MTSS team that may not be drawing attention in class but need extra supports. As an MTSS team, we met to look at the students in red and systematically make sure they were receiving as many supports as possible, and create action plans to further wrap our arms around them.

It has also been extremely valuable to see and share trends for our Emerging Bilinguals ACCESS scores from year to year. VizLab’s easy to understand visual for the ACCESS scores helps us quickly set language goals in mini-conferences with our students, as well as set broader school-wide focuses.

How do you get started using this great data visualization tool?

Check out our website at vizlab.bvsd.org. Teachers can receive initial training through their school or on their own through an online Schoology course.

I’ve already taken the initial VizLab training, what do I do next?

We are currently developing opportunities for “Level 2” Training in the 2018-2019 school year. Additionally, we are putting together a teacher focus group to help shape what is developed next for teachers in VizLab and to better understand ongoing professional development needs. If you are interested, please reach out to Clare Sims at clare.sims@bvsd.org or leave a comment on this blog! Finally, keep an eye on the ISE blog for weekly VizLab tips & tricks.

Will there be data beyond student data in the data warehouse, available through Vizlab? Yes. As the data warehouse matures, additional operational data will likely be added. This may include data from transportation, finance, IT, maintenance, etc.

Andrew

Student Data Privacy v2.0

On December 12, 2017, the BVSD Board of Education adopted a Student Data Privacy Policy, as mandated by the state. In response to the rapid advance of technology, this is the first time our district has had a robust policy around data privacy. The wording was adapted from the Colorado Association of School Boards (CASB) model policy that was developed by district leaders from all around the state last year.

There were three placeholders put into the BVSD policy for us to continue to research: Chrome sync, data sharing for research purposes, & centralized vetting of apps. My team is currently working with the District Technology Advisory Committee (DTAC) and Tech Contacts to determine pros & cons for each item, which will be brought back to the board for further review. For more information on each topic, please see below:

1. Chrome Sync

When a user signs in using their Google account, Chrome will sync bookmarks, history, passwords, extensions, and other settings across devices. This allows the user to continue working in a consistent, personalized environment no matter what device they are using. This would affect all users, but specifically, BVSD students who use shared devices such as carts, computer labs, and library computers. For additional information, please see this video.

2. Data Sharing

BVSD has worked in collaboration with the Colorado Department of Education (CDE) and research organizations to participate in Data Sharing Agreements to gather anonymous student data for analysis for research purposes. For example, BVSD has shared anonymized student data with an organization studying the correlation between air quality and absences due to respiratory issues in our schools. Parties wishing to partner with BVSD for research must engage in the district’s Research Review Process. This process includes procedures that align with BVSD Board Policies regarding data privacy, requiring student anonymity, to ensure that research will benefit the district and/or education.

3. Centralized Vetting of Apps

Vetting applications means evaluating them for both their instructional use and student safety and data privacy. Vetting can be done by:

• IT personnel
• Curriculum specialists in Instructional Services & Equity
• Teachers & Teacher Librarians
• Students

Currently, we require a Data Privacy Addendum (DPA) from every vendor that we contract with to purchase software. Additionally, we soon will be asking teachers to watch this video, vet, and list free click-through applications that they are using in their classrooms. Centralized vetting would mean that this responsibility would shift to district personnel.

What's Next?
Teachers will soon get their biannual survey, required by law, to add any apps and/or websites, they use to this list. If you are a teacher, please be on the lookout for this required action early in 2018.

It is essential that we all stay compliant with the law and engage in transparent communication with our community around this important issue of keeping student data private!

Please chime in below with your comments.

Andrew

Insurance for your Google Data

It’s a terrible feeling to lose important emails or documents. We’ve all done it at some point, and the results can range from mildly inconvenient to truly devastating. I want to make sure that you are armed with the necessary information to keep your Google data safe. Here are some tips that you can start using immediately.

Protect your account

• Never share your password with anyone. Ever.
• Always log out or lock your computer if you need to step away. By keeping your account safe you help protect your data.

Delete + Empty Trash = Gone forever

In Google, it takes two steps to permanently delete a document or an email.

• First, you must click the Delete button or the trashcan icon. Your data is now in the trashcan, but you can still recover it for 30 days.
• The second step is to empty the trash. This action is permanent and cannot be reversed, even by IT.

It’s your choice whether to permanently delete emails and documents.

• Some users choose not to permanently delete because our Google Accounts have an incredible amount of storage—30 GB shared between Gmail and Drive. Most of us will only ever use a tiny fraction of that space.
• Other users like to keep things tidy by periodically clearing out the clutter. Remember that any documents or emails that go out with the trash are gone forever. IT cannot recover them.

Backup your Google data using the Takeout tool

Google Takeout lets you create a custom archive of of your Google data. The Takeout tool is very intuitive and easy to use, but if you need more information please visit Google’s support page.

Google Takeout is optional, but I encourage you to try it. The time it takes now may save you lots of anguish later on.

Do you have any thoughts on preventing data loss? Please chime in below.

Andrew

Information Security @ BVSD Campaign

Why is Information Security important?

As our lives move increasingly into the digital realm, we must expand what we think of as security.

Security is no longer just installing a home alarm system or locking the car door. An incredible amount of data about us is stored digitally, on a variety of devices and on servers both locally and around the world. Someone who breaches your digital security can cause just as much damage as a burglar: they can get into your bank account, your email, and other personal data.

And because data is interconnected, especially in a networked environment like ours, hackers can enter our network through one person’s account and cause problems for everyone.

Information security is not just an “IT thing”. We all play a role in maintaining the information security of the BVSD community.

Information Security is more than just passwords

Strong passwords are very important, but they are just one piece of a larger information security strategy. Our new Information Security @ BVSD website outlines each of these areas in greater detail. Here are some highlights from the website, which I encourage you to visit.

Protect Your Data

• Backup the data you need
• Review permissions for documents, email, and websites
• Comply with FERPA and Board Policies about technology use and student data

Secure Your Devices

• Protect against viruses and malware
• Control access to your devices using the Three Ls: Log out and Lock it up when you Leave
• Update your Windows laptop regularly
• Secure remote access to your device when you are on public wi-fi

Guard Your Privacy

• Avoid phishing scams and identity theft
• Use strong passwords
• Protect your account security

Get Help

• Know your information security resources
• Know how to report a suspected security breach or a stolen BVSD device

Information Security @ BVSD: The Campaign Begins

Information security has become a necessary part of our lives as digital citizens. Our Information Security @ BVSD campaign is designed to give you strategies for staying safe online, whether you are at work or at home.

Look for more campaign communications over the next few months, including a poster that you can post in your breakroom.

Chime in below with your thoughts about Information Security @ BVSD.