Stuclark Posted January 16, 2015 Posted January 16, 2015 Where would you rather files be stored on Google Drive or on a USB pen to be lost as staff do so no matter what you tell them. I would rather block access to USB devices for our staff as well as our students and thus force them to keep all data on our on-site controlled, secure, backed up and resilient storage rather than having it on some other service that I have no control over. As that's maybe not achievable (the blocking USB bit) what I am doing is providing them an on-site data storage / retrieval service that is available widely enough for their needs, while still retaining all the security and control that I want.
pcstru Posted January 16, 2015 Posted January 16, 2015 I think if the advice from the Government is that it is ok we can pretty much agree that it isn't just "lemming behaviour" It isn't *just* lemming behaviour, but what I have seen in a number of implementations (including ours) is senior management driving forward implementation before putting measures in place that adequately cover the risks and issues, and largely on the basis that "others are doing it, so it must be OK". I have my own little collection of back covering emails in which I am being instructed to go ahead in spite of concerns such as being able to properly respond to subject access requests. That issue is not just a matter of searching documents on a users account - when someone connects their nexus using a username which is associated with our school and selects to back up their settings for the device to google, that may involve data such as their home wi-fi passwords. Is that covered under our DPR or Googles DPR? What about data collection by apps on that device against that username? When we set up a google account for students, they are obliged to accept Google's T&C's when they first access the account,. How exactly does that work with a year 7 who can barely read or a primary age child? Google may not be mining gmail anymore but what about search terms used by students in school? What is happening to that information when the context shifts to a personal account at home but Google have a kind of pool association via IP and cookies on the device? It is less than a year ago since Google stopped scanning gmail content associated with google apps for education accounts, again this was something that many people (and a number of people here) said was not happening. Government was saying everything was tickety-boo long before google finally admitted that (and it took a court order to get them to fess up). That really doesn't suggest to me that I should consider government advice on this as being terribly high quality. That's not to say people should not use the service, but where they do they need to be assessing and managing the actual risks (even if that is accepting them) rather than pretending there are no risks. 2
SHimmer45 Posted January 16, 2015 Posted January 16, 2015 (edited) link to government guidance https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/368034/Cloud-services-software-dept-advice-oct-2014.pdf which might be of use. reading an extract from it: If schools enter into arrangements with external providers (processors) to carry out any "processing" of personal information on their behalf, the school will remain legally responsible for any loss or damage to the information caused by their processor "the legal responsibility cannot be delegated to the provider" Edited January 16, 2015 by SHimmer45 1
mjk Posted January 16, 2015 Posted January 16, 2015 (edited) link to government guidance https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/368034/Cloud-services-software-dept-advice-oct-2014.pdf which might be of use. reading an extract from it: If schools enter into arrangements with external providers (processors) to carry out any "processing" of personal information on their behalf, the school will remain legally responsible for any loss or damage to the information caused by their processor "the legal responsibility cannot be delegated to the provider" I couldn't find that sentence in the document. I agree with the sentiment but the fines are imposed by the ICO when adequate checks have not been made. This is what the DFE have done on the behalf of schools. The documentation from the DFE is part of the check that we need to make when going ahead with outsourcing storage to protect ourselves from litigation. The question that Governors and Management need to ask is who they trust more: The advice from the DFE, an army of Google engineers and contract lawyers or the school technician. Personally I'd be happy with Government advice as I can't be 100% sure the next technician we employ could make decisions to ensure things more secure than Google do. Of course your mileage may vary. Edited January 16, 2015 by mjk
mjk Posted January 16, 2015 Posted January 16, 2015 ... Also, don't under-estimate your backup / restore requirements - Microsoft (via Office 365) were able to offer us only a 90 day data retention period - for staff emails this is simply not good enough (by our estimates we'd need 15 years to be fully compliant with the letter of UK law), and what are you going to do when x or y student says "can you get that document back I deleted last year?" ... its simply not possible... Google vault is free for Schools, 100 years unlimited data IIRC
GrumbleDook Posted January 16, 2015 Posted January 16, 2015 A quick interjection ... when people say 'cloud' they usually just mean Office365 or Google Apps for Education. These are public cloud. There is also the option of private cloud too, which many folk have had for years in different forms, from LAs, RBCs, other schools, etc. Would I stick everything in the cloud? Not the public cloud ... IL2 and below only. Private cloud? Yes ... up to IL5 in fact (and have done and had it as part of a Cabinet Office project!)
enjay Posted January 29, 2015 Posted January 29, 2015 I don't see that Google presents any greater risk of sensitive data being shared inappropriately. Any system which involves humans has the risk of files being emailed, printed, left on a train, downloaded to USB, etc. (and those people who are blocking USBs, please don't think you've solved anything, you have just encouraged people to email files or use personal Google Drive/Office365 accounts instead). Ultimately, staff have been accessing sensitive data at home for decades; secured storage such as Google Drive offers a safer way for them to do that, but it does of course still rely on people working appropriately. As others have said, we looked into the risks of this before moving to Google, and took an educated decision ourselves. Other schools should also do the same. Those who are setting policies for what staff do and don't keep online need to consider wider questions that just the obvious sensitive data. What about mark books? Would you keep those online? If not, you'd be missing out on some of the functionality of Google Classroom.
Sheridan Posted January 30, 2015 Posted January 30, 2015 We've been on GAFE for just over a year and its taking a while for the culture to change. We did effectively have a private cloud (Exchange and citrix) and I'd personally have preferred to keep that. Google do provide most of the tools and facilities to migrate your data storage but it still comes down to the question 'do you want to'? We have a good strong dedicated 100mbps internet connection with very little downtime. However any downtime has resulted in panic when youtube isn't available so I don't know how staff would react if their data was unavailable for a while! I can see use using both cloud and local data for a few years yet - with the local data option gradually subsiding. Staff and students will need local storage for certain applications (Music/CAD etc) where cloud files aren't really the best option. I think in schools a lot of staff still see the cloud as the 'risky' option i.e if they put their files in the cloud they will also want them on the network 'just in case'
enjay Posted February 3, 2015 Posted February 3, 2015 I think in schools a lot of staff still see the cloud as the 'risky' option i.e if they put their files in the cloud they will also want them on the network 'just in case' We definitely see more staff carrying external hard drives around since moving to GAFE...
Sheridan Posted February 3, 2015 Posted February 3, 2015 We definitely see more staff carrying external hard drives around since moving to GAFE... Ahh yes, there will always be a hardcore few who will always do this no matter what you're using!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now