Cloud services security twitch

[chewee]

We recently had some photos of pupils from our school sent to us through google photos, now my twitch started when i could download all of the photos (including ones of pupils from others schools) and share the album with anyone

 

My concern is that schools are woefully under equipped when it comes to the legal side of how technology is changing how files are accessed and shared and so are the parents of pupils.

We are looking at moving over to having documents stored in the cloud and i know Microsoft take security seriously but no system is perfect and i feel that any file with any sensitive data should go near an online system.

 

Has anyone else had these thoughts and what arose from them, have you mentioned it to management or simply felt it wasn't your place?

[FN-GM]

You should have a look at this

 

https://www.gov.uk/government/publications/cloud-software-services-and-the-data-protection-act

 

I know G Suite is GDPR compliant. - https://drive.google.com/file/d/0B3f6ReLrNvlgV0NES2VCazQtOVk/view

[chewee]

ive had a read of both of those today ( very dry reading ) some interesting stuff but i feel they look at the purely legal aspects and not the practical aspects of how cloud services are used for things such as sharing of photos or documents.

[FN-GM]

It isn't all about technical restrictions, it is also about staff training.

[jthompson]

We recently had some photos of pupils from our school sent to us through google photos, now my twitch started when i could download all of the photos (including ones of pupils from others schools) and share the album with anyone

 

When I set up our G Suite domain, I restricted sharing outside of the domain wherever the option was presented. Files in Drive, for example, can only be shared with other Google users in our domain. It's the same with Sites.

 

If a member of staff has uploaded a load of photos to a personal cloud account and shared them, then that's their fault, and they perhaps are in need of education on that point.

[TwistedHelixis]

That possibly puts a big red X next to your safeguarding policies. Are any of those students exempt from having their photos taken? Were they taken during school time? if so why were they not taken on a school designated camera or phone and shared by school designated methods. The list goes on and on ........ BTW I generally go over kill, but its better to be safe than sorry.

[chewee]

none are exempt from photos.

The photos were taken by an event organiser, using their own phone.

the event had several schools there and the link has been sent to those other schools, and that makes me twitchy as i have no idea who the team at those other schools are or what policies they have.

It may seem like im being a bit paranoid but i feel that when it comes to the safety of the pupils under our care there is no such thing as overboard

[jmak]

If it was an external event and the event organiser was taking photos, maybe there should have been a separate photo permissions request to parents as the permission they have might not cover what the organiser wants to do with the photos. This has happened for quite a few events my kids have been on.