Schools hold an unusually sensitive combination of data: minors, home addresses, medical notes, financial circumstances, and in many cases safeguarding records. They also tend to have no dedicated security staff. That combination is why education is a persistent target.
Most breaches are access problems
The dramatic breach is an external attacker. The common breach is a staff account with far more access than the role required, used carelessly or retained after the person left. Access control is unglamorous and it is where the actual risk lives.
- 1Define roles by what the job needs, not by seniority
- 2Make offboarding a single action that revokes everything at once
- 3Log who viewed a student record, not only who changed one
- 4Review access every term — permissions accumulate silently
Encryption is necessary and not sufficient
Encryption at rest and in transit is table stakes and worth confirming, but it protects against a narrow class of attack. It does nothing about an over-permissioned account, a shared login, or an exported spreadsheet sitting in someone's downloads folder.
Exports are the leak nobody watches
Every system with a download button has a shadow copy of its data outside the system. Ask how exports are logged, whether they can be restricted by role, and whether anyone would notice a bulk download at two in the morning.
Have a plan you have actually read
- Know who declares an incident and who contacts families
- Keep an offline copy of the plan — it is no use inside the system that is down
- Test a restore from backup, because an untested backup is a hope
- Agree in advance what you will tell parents, and how quickly
Ask a vendor what happens after a breach, not whether one can happen. The second question has only one honest answer.
- student data security
- education data privacy
- school data protection
- role based access control school