|
Article by Clare Sisisky, Global Education Benchmark Group
From the September/October 2019 NetAssets magazine
Whether it’s students traveling as part of an academic program or staff members recruiting prospective students, many independent schools are sending stakeholders to China on a regular basis. When they do so, students and staff will need to keep their data safe — be it personal, health or financial data; their own or that of families. Travel security experts from International SOS, the world’s largest international security services firm, have reported that unauthorized broad-based data collection from international visitors is becoming increasingly widespread.
Self-Assessment for Schools
Schools should examine their communication and data access needs during travel abroad as well as reflect on the school’s risk tolerance around cybersecurity. Global Education Benchmark Group interviews with cybersecurity experts, school technology leaders and local Chinese partners affirmed the risk is real and helped shape the following questions schools can use to better understand their risk exposure and develop a strategy for risk mitigation.
- Who is traveling? What technology and communication needs (not wants) will they have while away, and what device and connectivity options will meet those needs?
- What data access needs will the travelers have while away (e.g., student medical information, alumni contact information)? How can they can access this data without using technology?
- Who will make decisions about risk mitigation and how will they be made?
- What steps do we need to take to implement any decisions with all relevant stakeholders, including students?
Policies in Practice
How do schools conduct discussions, make decisions and address challenges around implementation? Jamie Britto, chief information officer at the Collegiate School in Virginia and a nationally recognized expert on cybersecurity, provides one example. Before a school trip to China this spring, Britto brought together faculty, students and the director of global education, led the group through several scenarios and outlined a communications strategy. Collaboration among risk managers, technology leaders and global program leaders when developing strategy and implementing a plan was critical.
After reassessing risk, the team modified the previous policy, which allowed employees to use a school-based VPN, to a much more restrictive policy for students and school employees. Many schools that travel to China with students eliminate concerns by banning all technology, but most schools that plan a homestay component, such as Collegiate School, allow students phones during the homestay. Collegiate asked students to use limited technology and apps, and to wipe and restore all devices before reconnecting to networks in the U.S. upon return. Collegiate faculty were given old iPhones and computers that were wiped and loaded with the few features they would need as well as global phone service.
Schools will have varying thresholds for data protection, but when stakeholders travel to countries with increased risk factors, administrators would do well to assess their cybersecurity policies.
After implementing these policies during its latest trip, Collegiate administrators have decided that going forward the school will likely require students as well as faculty to use old iPhones, and trip planners will work with Chinese partners to acquire local SIM cards. This second iteration should eliminate students’ and families’ need to undertake inconvenient risk management steps and result in lower costs for the program.
Collaborative Engagement
Schools will have varying thresholds for data protection, but when stakeholders travel to countries with increased risk factors, administrators would do well to assess their cybersecurity policies. A collaborative approach should include the business office, technology department and department overseeing travel to help streamline implementation and communication. Policies will continue to evolve along with risk factors and management strategies, but schools that are up to speed and have a strong working relationship across departments will be much better equipped to manage their risk and avoid a significant data breach.
