Operations

1/31/2018
02:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

K-12 Study Gives Schools Low Marks for Protecting Student Privacy Online

Survey says local school districts and education departments lack even the most basic security and privacy safeguards.

A new study released today by EdTech Strategies found that the websites of leading state education departments and local school districts lack even the most basic online security and privacy protections.

Douglas Levin, president of the Arlington, Va., consulting group, says his study comes out in the context of an intense discussion the past several years about the online privacy of students.

"We need to protect students, but in many ways that is too narrow a focus,” Levin says. "Keep in mind that technology is used at school districts for human resources, food, health and transportation, and it is also used by educators and parents."

Levin based the study on automated and manual reviews of the 50 state department of education websites and the websites of 159 K-12 school districts nationally. The study, "Tracking EDU: Education Agency Website Security" was conducted from October 2017 to January of this year.

Here are some highlights from the study:

Lack of secure browsing. Most state and local education websites do not support secure browsing, which puts both schools and websites at risk. And, at least 12 states offer no HTTPS support for secure browsing: Arkansas, Connecticut, Kansas, Maryland, Mississippi, Nevada, New Mexico, Oklahoma, Rhode Island, Vermont, Virginia or Washington.

Widespread use of tracking cookies. Virtually every state and local district (158 out of 159 tracked) has partnered with online advertising companies to deploy sophisticated user tracking and surveillance on their websites.  Many states and the vast majority of local school district websites do not disclose the presence and nature of this ad tracking and user surveillance, or the mechanism for how users can opt out of these data collections.

Absence of privacy policies. Nearly 15% of state department of education websites do not publish a privacy policy of any kind. Of the 43 state agencies that publish a privacy policy, only 32 disclosed the use of ad tracking or surveillance cookies.

Noncompliance with Google terms of service. Despite the near universal deployment of Google Analytics on state and local education websites, only four state and two local school districts were found in compliance with Google’s terms of service which require specific privacy-related disclosures by its customers to their users, including what data is collected, and how users can opt out.

Moving forward, Levin says K-12 state departments of education and schools district should consider deploying HTTPS to offer more secure web browsing, and find ways to notify users of the presence of ad trackers. He says the websites posted by the states of Maine and Utah demonstrate that state and local agency websites can offer meaningful experiences to parents, educators and other stakeholders that offer privacy without resorting to invasive and undisclosed ad tracking. Maine, for example does not record personal information without the user’s permission.

Follow this link for a more complete list of action items.

Related Content:

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/1/2018 | 8:11:50 AM
THINK SCHOOLS ARE BAD? TRY A MEDICAL OFFICE
When I was an indeppendent consultant, my worst clients in terms of security and basic funding issues were medical professionals.  Forget HIIPA considerations.  They all hated to write to check and had zero understanding really of secure private patient data.  In part because their own minds are so full of medical data that perhaps they have no room for other stuff.  We all have that problem to a degree.
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1659
PUBLISHED: 2019-02-21
A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to...
CVE-2019-8983
PUBLISHED: 2019-02-21
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
CVE-2019-8984
PUBLISHED: 2019-02-21
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
CVE-2018-20122
PUBLISHED: 2019-02-21
The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vulnerable to a command injection vulnerability that can be exploited to achieve remote code execution with root privileges. No authentication is...
CVE-2018-6687
PUBLISHED: 2019-02-21
Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.