A School Security Outlook for 2009

• By Dian Schaffhauser
• 12/09/08

It has been six months since technology product and service supplier CDW-G and marketing services firm Quality Education Data issued their second-annual school security index, which measures how K-12 IT and facilities professionals rate their districts' cyber security and physical safety measures. In the last round of results, which were published in May, the quality of cyber security had dropped, while the state of physical security had improved.

THE Journal spoke recently with Bob Kirby, senior director of K-12 at CDW-G, to find out how schools are currently prioritizing their security spending. As the following interview shows, opportunities for improvement in the area of security are ample. On the positive side, the technology to accomplish those advances is becoming more accessible and affordable, and the need for particular forms of security is more readily apparent to district administrators. What's still unknown is how shrinking budgets will impair IT's ability to keep security at the top of the school shopping list.

THE Journal: It has been six months since the school safety index was released. What has happened regarding cyber and physical security in K-12 overall in that time?

Bob Kirby: We're seeing a continuation of trends. We identified the fact that schools needed to improve, and schools are getting better. They're starting to leverage the infrastructure they had in place to integrate new security technology--digital cameras, IP-based video cameras, or other infrastructure like voice over IP, which runs on an IP network within a school.

Assuming that infrastructure is in place, what we're going to see more of is putting greater demand on the basic infrastructure within a school. As they start to add technology in schools and put demands on the network, a lot of our customers start to find they need to upgrade their network. They can't handle all of the traffic they're starting to put on it. Or maybe they can't manage it as well as they want. The infrastructure is the enabler. But once you start to enable it, they find out it becomes a bottleneck.

THE Journal: Where's the focus regarding security in schools and districts right now--on the physical side or the cyber side?

Kirby: It's both. The things we've learned are consistent with what we've seen in the past. The security focus on the cyber side is because they have to. They have laws or responsibilities to protect data, to protect access, to protect students. Whereas on the physical security side, it's more, technology enables them to adopt new solutions, so they're taking advantage of it. An IP-based camera is a good example. Now you can put cost-effective solutions in place that run on the infrastructure in place that's typically less expensive to buy and run than the traditional analog cameras.

THE Journal: Are those security initiatives--cyber v. physical--being led by different people in the organization?

Kirby: In a couple of cases, with more progressive schools, we'll see where the CIO has reached out to the facilities management, which typically has responsibility for security, and they do it in collaboration. The more progressive schools are doing a better job of collaborating across those silos. What's interesting is that because the technology is beginning to run on the IP network, that's being thrust into the laps of the IT staff.

THE Journal: Are they prepared for that?

Kirby: My experience with IT people is, they'll only tell you the things they know they can do for sure. They tend to be a little bit conservative about signing up for stuff. It's one more technology they have to manage. We're real good at throwing things on the plates of our IT teams. We don't' understand why you can't put a couple of things together and it works. It's never that simple.

THE Journal: On the physical side, where are schools investing right now?

Kirby: Where we've seen a lot of success on the physical side is mass notification and unified communications.

For unified communications that's voice over IP systems that run on the network, putting phones in every classroom. But it's more than a phone. The phone is just another network device on a VoIP system. You get the capability for broadcast messages out to all classrooms. You have things like IP-based speakers. We're starting to see schools investing in systems that will help with unified communication. It might be a phone, it might be broadcast messages over speakers. It might be tied into clocks. Anytime there's a time change, how much time and resources are spent by schools changing the clocks? Now you can do it from a central console.

There are advantages to things like VoIP. What if there's an emergency in a classroom and 911 was pushed from the classroom? You can program the system to not only get through to the 911 center, but it also notifies the front office if there's a problem. There's more to it than putting phones in classrooms. If there's a problem in a classroom, you have to make sure the front office is notified, so that when the ambulance pulls up to the front door, they know what it's for.

For mass notification systems, that's about leveraging the infrastructure to reach out to the community if there's a message that needs to go out, whether it's weather related, school closings, general broadcast messages, or something more severe like an incident at a school.

But there, that's still an area of improvement. Schools could be using new technology like texting or e-mails, rather than doing the phone system. We're a mobile culture. Where my kids go to school, we have a mass notification system. A parent has to go in and register and say how you want to be communicated to--e-mail, texting, phone calls. In the year that I've been signed up, I haven't received a single [text or e-mail] message. These things are placed, but I don't think people are really using them yet. When there's a snow emergency, I still get a phone call. My kids still come home with crumpled pieces of paper that we were supposed to read two days ago. Schools have some of the technology, but I don't think they have been adopted as well as they could be.

THE Journal: Network access control surfaced in the index. Why is that so important?

Kirby: There are many points of entry into the network that are probably not so secure. You have some very private information. I don't think that schools are doing everything they can to secure the total access to the network.

Network access control is more of a discipline than a product. You've got to look at layering different types of security on top of each other to secure the network. One good example is the USB ports in PCs. In a lot of cases, the PC is underneath a teacher's desk. There's a keyboard and monitor on top. There are programs you can run on a USB drive. So a student could conceivably put tracking software on a USB key. When the teacher logs on to network with the user name and password, the USB key would record it and the teacher would never know it. When the teacher leaves the room, the student pulls the key out of the USB and has the teacher's user name and password.

So network access control is something that needs a lot more attention. It needs more than just having a secure logon or more than having firewalls. It's an entire practice. Are you layering all the security measures in place so that you're fully securing your network?

THE Journal: What about security cameras. Anything new there?

Kirby: The cost of cameras has come down significantly. There are a number of different options now. You can start pretty cost effectively; then, depending on how much monitoring and control you want, the solutions become more sophisticated.

THE Journal: The report also talks about how districts should be using security to give real-time access of video to local law enforcement. What's the importance of that, and what's the holdup in getting it implemented?

Kirby: If there was an incident within a school, you can imagine how helpful it would be to be able to pipe the video right into the squad car. Then [law enforcement] would know exactly what they were getting into before they pulled into the parking lot. The hold up is the local agencies need to be working closer together than they are. Each local police and public safety agency--they're learning what technologies can help them, just as schools are. But they're not necessarily looking at, how can I extend that to schools, libraries, or other public buildings? They're more in the process of getting their own technology in place before they're thinking about how to have a cohesive solution across the entire municipality.

THE Journal: Are there other technologies coming to the forefront in the area of security that we might start hearing more about in the coming year?

Kirby: There are still not a lot of K-12 schools that provide e-mail to students. But it's common in higher education. Once you start to do things like that, e-mail filtering starts to become more important because of monitoring for things like bullying. These are things we've see in other parts of the world, things that are a little more advanced but we haven't started adopting [in K-12] yet. My kids are in primary school. I wish they could use electronic means a lot more than they use today. But with that comes more responsibilities on the school.

THE Journal: Obviously, there are budgetary cutbacks happening. States and counties don't' have the funds to feed to schools. How will that impact security plans?

Kirby: That's the question of the hour. How is funding going to get impacted? We're hearing from schools that they're waiting on funding that they've been promised from the states and they haven't gotten yet. There's more money to come next year. They're worried maybe they won't get that. And it varies state by state because every state has a different funding formula.

In my conversations with people, it's not so much a funding issue as an allocation issue--what things get funded and what things don't.

I guess the one good thing is, in a lot of cases, facilities management has a say in security. They'll always have a budget because they have to maintain the building. So it's very difficult to take money away from security if it's presented as a priority.

Also, it's been a little quiet over the last year. There have been smaller incidents here and there. But I think the last major incident we had was probably Northern Illinois [University]. As soon as you have another incident, all of a sudden, security becomes more important.

THE Journal: You see a large variety of schools and districts implementing security. What's the biggest difference between those who absolutely get it right and those who just don't seem to get it at all? In the index you label them scholar-athletes and remedial schools.

Kirby: The ones who get it right are the progressive thinkers. They have IT experience outside of education. A lot of them came from industry. So they're bringing best practices with them. They understand the importance of collaborating across an administration, getting the school board on board, understanding the impact of public opinion, and having a positive opinion of the things they're trying to accomplish.... The ones who are more challenged, maybe they've never worked anywhere else but in a school or district. As schools have had to catch up to technology, they don't have the experience of seeing how it's done in other parts of our society.

THE Journal: Any advice you can offer in regards to security?

Kirby: Reach out to your peers and partners. Understand your options. What are other institutions doing to address security? Get ideas. Don't be shy to reach out. Educators are typically very good about doing that. It's one of the best ways to learn best practices.