Multi-Factor-Authentication: The Key to Stopping Ransomware, Malware, and Viruses

Digital safety, security, and data privacy are key topics that the Boulder Valley School District Information Technology team continues to focus on and invest resources to prevent attacks. Although we do apply numerous security measures to protect our networks and data, the human element is the most vulnerable to be exploited through phishing attacks or social engineering. 

It seems there is not a week that goes by without a new story of a business or government agency being exploited. K-12 education is now being targeted, and several school districts delayed the start of school this year because of ransomware attacks. The State of Louisiana even declared a state of emergency due to "severe, intentional security breaches" targeted at school districts. 

The focus of the last decade was implementing strong passwords at BVSD. We require staff and student passwords to conform to industry best practices and be changed every 90 days. This requirement helps ensure that if a password is compromised, access will expire within 3 months unless the hacker resets the password. So what can be done to increase password security? 

In recent years more companies have required Multi-Factor-Authentication (MFA), which protects accounts even if an account’s password has been compromised. This has been true with most financial institutions, businesses, and the State of Colorado who has shifted to require multiple forms of identification as proof when logging in. An example would be a password AND a code texted to you. Or a password AND a code from an “authentication” app such as Google Authenticator, LastPass Authenticator, or Microsoft Authenticator. 

A few years ago, BVSD began requiring MFA in IT and encouraged all other employees to use it voluntarily. Recently, district leadership turned on MFA. As an incentive for BVSD staff and students to transition to MFA, IT has changed the password requirements. Instead of requiring passwords to be changed every 90 days, if MFA is enabled, the user’s password will be valid for one year.

To enable MFA, staff and students may go to my.bvsd.org, scroll to the bottom of the page and click on the Multi-Factor Dashboard icon and follow the instructions. 

Understanding that humans put our data at risk more than any other breach, or system exploitation, we need your help to ensure BVSD student and staff data remains secure. Please support BVSD in keeping sensitive data secure by turning on MFA. 

Please chime in below with your questions, comments, and concerns. 

Andrew Moore, CIO Boulder Valley School District

Single Sign On (SSO)

The security of your identity and BVSD data are two areas of top concern to me, especially in light of the recent virus attack. With that in mind, I’m excited about the rollout of the next generation of password management and application access at BVSD. 

The BVSD Single Sign-On Portal, my.bvsd.org, is a tool for students and staff to access district and instructional technology resources with one login and from one location. Upon signing in at my.bvsd.org, you will see tiles that will take you to many web-based applications. Rather than needing to type in the URL for each of these applications and sign in, clicking on the tiles will take you directly to them, and in many cases, automatically log you in.

Another key benefit of my.bvsd.org is the ability to reset your password more easily and securely. Should you forget your password and need to reset it, you can do so by clicking “Forgot Password”. You will be prompted to enter your BVSD username. From there you will use the pull down menu to select your recovery option method. You can choose from one of three options:

• Answer three security questions
• Enter your PIN
• Have a new password link sent to your personal email address.

Any of these options will then give you the opportunity to enter a new password.

The first time you log in, you will be prompted to set four security questions, a four-digit PIN, and a personal email address. These all can be used to verify your identity to allow you to change your BVSD password on computers both inside and outside the district. If you do enter a personal email address, please be sure to check your personal email for a message with a verification link to activate this email in the system. If at any time you need to reset your security questions, PIN, or personal email address, you can do so while logged in to the portal.

The new portal, my.bvsd.org, will be available to all students and staff beginning on February 16, 2018. We appreciate your support in proactively managing the security of your identity and BVSD data!

Andrew

Student Data Security & Privacy Law in Colorado

In the last few months, I’ve heard from parents and community members regarding student data security and privacy in BVSD. With the passing of HB 16-1423 last summer, I wanted to take a moment to share how we’re implementing the requirements of this law and improving on measures we’ve already started in protecting our student data.

First, we have dedicated resources for the security of our network. These include a security engineer whose responsibility it is to keep our data secure. We’ve added a vendor manager to work directly with our negotiated contracts in making sure that they maintain their level of security and support. Also, we’ve moved our data into a more secure location.

In addition, our legal department has created a Data Protection Addendum (DPA). This is a required document that must be signed and followed by every vendor that we contract with that uses and collects personally identifiable information of our students. The DPA provides guidelines and expectations for how the vendor is able to use, store and dispose of our student data. You can find the BVSD standard DPA here. If a vendor is unable or refuses to sign the DPA, then we do not purchase the software.

The new law also requires that school districts provide a list of “on-demand” or non-contracted resources that teachers use with students. These generally free online tools are available for our students to use, and it is up to the teacher to determine if the tool a student is using online meets appropriate requirements for age and privacy.

Finally, we’ve created a professional learning course that helps teachers learn how to find and understand the privacy policy and terms of use for the online tools that they are using in class. If a teacher determines that a tool meets these standards and plans on implementing the tool with students, he or she submits the name of that tool to an online form so that we can collect and maintain this list as a district. You can view the list on our website.

As our district continues to implement these measures, I invite you to follow our website as it will be kept up-to-date with the changes to help you and your family understand how data is secure in BVSD. And please let me know what you think by commenting below. Andrew
 

Streaming Audio and iBoss

By now, many of you have encountered our new web filter, iBoss, which I introduced in the May Technology Blog. If you are frustrated because your favorite site is newly blocked, please read on.

BVSD uses a web filter to comply with the federal Child Internet Protection Act (CIPA). While our previous filter was marginally adequate, it didn’t provide the level of service that we required. 
Our filtering is most restrictive at the elementary level and more open in grades 6-12. Staff members have the option to temporarily override iBoss using their BVSD credentials. If you feel that a website should be permanently unblocked for all staff and students, please submit an IT Service Request and the site will be reviewed. To date, approximately 25 websites have been unblocked. It is important that you submit IT Service Requests so we can tailor iBoss for our district’s needs while meeting the requirements of CIPA.

The elephant in the room - why did we block streaming audio such as Spotify, Pandora, and iTunes radio?

The district has limited resources to procure Internet services. During the last school year we paid to increase district bandwidth from 750 MB to a maximum of 1 GB. At the end of last school year, roughly one-third of our Internet bandwidth was being used by streaming audio services. Now that many of our educational tools and assessments are online, it is critical that our bandwidth is available for these services.

I realize that many of you use streaming audio sites throughout the day, and while it is inconvenient to find work-arounds, doing so benefits everyone. Staff members can override the block on streaming audio sites for two hours at a time. This prevents “runaway streaming”. If you need uninterrupted streaming for longer than two hours, you can use your personal data plan or download music to an mp3 player and connect it to your classroom’s audio-visual (projector) system.

The long-term solution to our streaming audio issue is to upgrade the equipment, thereby allowing us to increase our bandwidth. The barrier is a 6-figure price tag. Funding to make this improvement is included in the facilities masterplan that will go to the voters in November. Once we can upgrade our equipment and increase the bandwidth, we will revisit the streaming audio block.

I hope this sheds some light on the current state of the iBoss web filter, its challenges, and our expectations for the future. Please log in to chime in with your comments below.

Andrew

Wireless Names @ BVSD

What’s in a name? Quite a bit, it turns out, when it comes to choosing your BVSD wireless network.

The next time you use a wireless device at school, check out the networks available to you. Some may look familiar, some are new, and some of the old networks are gone. Each network has its own features. Here’s a short guide to choosing a network.

BVSD - This is the secure network that you can join using your BVSD username and password. It allows you to access district resources, such as your network folders.

BVSD Guest - This network is for guests. It does not require a username and password, and it does not allow access to secure district resources.

BVSD Guest Fast - This network is just like BVSD Guest except that (you guessed it) it’s faster. Only devices that are compatible with BVSD Guest Fast will see it.

Public Wi-Fi Networks

Stay safe when you use the free Wi-Fi offered by many restaurants, hotels, and retailers. Make sure you know and trust the name of their wireless network. A malicious person can set up their own network with a similar-sounding name in hopes that you will join it. Once you join a bogus network your data is compromised. When in doubt, ask someone who works there to verify the network name. Also, use appropriate privacy and sharing settings whenever you join a public Wi-Fi network. Read more about staying safe online on our Information Security @ BVSD website and in the most recent BVSD CIO blog.

Please chime in about wireless networks after logging in above. I want to hear your thoughts on this topic.

Andrew

Information Security @ BVSD Campaign

Why is Information Security important?

As our lives move increasingly into the digital realm, we must expand what we think of as security.

Security is no longer just installing a home alarm system or locking the car door. An incredible amount of data about us is stored digitally, on a variety of devices and on servers both locally and around the world. Someone who breaches your digital security can cause just as much damage as a burglar: they can get into your bank account, your email, and other personal data.

And because data is interconnected, especially in a networked environment like ours, hackers can enter our network through one person’s account and cause problems for everyone.

Information security is not just an “IT thing”. We all play a role in maintaining the information security of the BVSD community.

Information Security is more than just passwords

Strong passwords are very important, but they are just one piece of a larger information security strategy. Our new Information Security @ BVSD website outlines each of these areas in greater detail. Here are some highlights from the website, which I encourage you to visit.

Protect Your Data

• Backup the data you need
• Review permissions for documents, email, and websites
• Comply with FERPA and Board Policies about technology use and student data

Secure Your Devices

• Protect against viruses and malware
• Control access to your devices using the Three Ls: Log out and Lock it up when you Leave
• Update your Windows laptop regularly
• Secure remote access to your device when you are on public wi-fi

Guard Your Privacy

• Avoid phishing scams and identity theft
• Use strong passwords
• Protect your account security

Get Help

• Know your information security resources
• Know how to report a suspected security breach or a stolen BVSD device

Information Security @ BVSD: The Campaign Begins

Information security has become a necessary part of our lives as digital citizens. Our Information Security @ BVSD campaign is designed to give you strategies for staying safe online, whether you are at work or at home.

Look for more campaign communications over the next few months, including a poster that you can post in your breakroom.

Chime in below with your thoughts about Information Security @ BVSD.