Schools’ cyber security needs improvement

School districts are improving their physical security, but they might be neglecting the security of their computer infrastructure, if the results of an annual survey are any indication.

The average physical safety rating of K-12 school districts improved by 39 percent over 2007, while the average cyber safety rating declined by 25 percent during the same time period, according to CDW-G’s "2008 School Safety Index," which is designed to mark the current state of K-12 school safety. 

"School districts both large and small are embracing advanced technology tools and techniques to make school a safer place for our children," said Bob Kirby, senior director of K-12 business for CDW-G. "Cyber and physical security tools–from network access control to security cameras–are allowing administrators to see into and lock down their networks and school buildings, but schools continue to be frustrated by budget and staff constraints, particularly in their IT security programs."

Asked to grade their school district’s physical and cyber security, about a third of survey respondents say these "need improvement." Districts also reported increases in physical and cyber security breaches in the last 12 months.

A nationwide survey of public school district IT and security directors, the School Safety Index gives a first-hand view of school safety issues and allows schools to measure themselves against a national benchmark with current questions and data. The index is based on eight indicators and four contra-indicators, or challenges. 

Evaluating schools’ cyber and physical safety, the 2008 index finds that districts nationwide are more successful in their approach to physical safety, and that IT safety might need a refresher course before schools see improvement. 

The study also reveals that districts are actively engaged in using new tools and techniques to try to improve cyber safety. Districts are struggling with budget constraints and with how best to use limited staff resources to improve security, the researchers found. And the implementation of mass-notification systems, coupled with increased use of security cameras, is giving physical safety an edge over cyber security this year.

Here are some other key findings:

• More than half of K-12 school districts are using network access control (NAC) technology to protect data and ensure that only authorized users and approved applications can access their networks. However, budget constraints, lack of staff resources, and the need for more IT tools cancelled out districts’ efforts to improve cyber safety.
• Nearly half of all districts are using mass-notification systems, and 70 percent are using security cameras; 29 percent of districts report that security cameras have had a positive impact on district safety.
• Districts should consider the instant access that IP security cameras can give their local police. Although more schools are using security cameras, only a small number of districts give their local police force the ability to access digital footage in real-time during an emergency.

Measured on a scale from zero to 100, the average district score for cyber safety this year was 38.6, the researchers reported, down from 51.3 in 2007. This year’s index finds that NAC technology is emerging as an essential IT tool for K-12 school districts, with 57 percent using this to view and control who and what is on the network. Rural districts lead in NAC adoption at 60 percent, the study found, followed by suburban districts at 54 percent, and urban districts at 45 percent.

Although 89 percent of districts authenticate users to their networks, there is room for improvement, because 16 percent (mainly urban and rural districts) still use general logins rather than unique names or passwords–exposing themselves to a potential security breach.

Despite increased use of cyber security tools and dedicated attention to IT security, reported cyber security breaches are up in every segment except urban school districts. Overall, 14 percent of districts reported at least one IT security breach in the last 12 months, up from 9 percent in 2007. Districts with enrollments of 1,000 to 4,999 had the largest increase in breaches, from 8 percent in 2007 to 18 percent in 2008.

In terms of physical safety, the average district score was 44.7 on a scale of zero to 100–up from 27.5 in last year’s survey. Districts reported employing multiple tools to secure and monitor their buildings, with security cameras topping the list at 70 percent, an increase of seven percentage points from 2007. Other tools seeing increased use this year include sex-offender databases and security teams.

New this year to the School Safety Index is a tally of systems to inform large groups of people quickly in an emergency. A modern mass-notification or emergency-alert system enables a district to notify the community about emergencies such as the approach of severe weather, on-campus incidents, or other disruptions.

Of the 45 percent of respondents who said their districts use a mass-notification system, 70 percent alert the community through automated phone messages and 61 percent use eMail alerts–but only 32 percent take advantage of new technologies such as text messages. Most systems target faculty and staff, but they often do not reach all community members, such as police and other emergency responders. 

As with cyber safety, the index recorded a rise in reported physical security breaches, with 31 percent of districts experiencing a breach in the last 12 months, up from 21 percent in 2007.  Although urban districts continued to experience the most physical security breaches overall, rural districts saw the biggest increase, with 26 percent reporting at least one breach in the last year–up from 12 percent in 2007. 

Information technology is blurring the lines between cyber and physical security tools, yet the School Safety Index indicates that districts are not taking full advantage of this IT convergence.

Districts adopting tools that streamline processes and use limited staff resources more effectively–from IP-based security cameras to network access control–not only will improve their visibility into physical and network facilities but also will free IT and facilities staff for other critical activities, CDW-G says. Mass-notification systems ensure that critical information is both delivered and received by community members during an emergency via multiple communication channels, but many districts are not using all available channels or including all community members.

"The barriers noted by the 403 respondents to the School Safety Index–limited budgets, limited staff, and limited tools–are all linked," said Kirby. "The index gives schools the ability to see trends, understand the newest safety and security tools, and measure themselves against a national average in order to affect real change for their communities. With advance planning and creativity, districts can overcome the barriers to better security, enabling security staffs to work smarter, rather than harder."

The 2008 School Safety Index is based on a telephone survey of 403 public school district IT and security directors conducted by Quality Education Data in April 2008.  The survey has an error margin of plus or minus five percentage points and a 95-percent confidence level, researchers said.


2008 CDW-G School Safety Index

Want to share a great resource? Let us know at