With schools around Aotearoa embracing technology and moving to blended learning, this greater flexibility has been shadowed by greater cyber risk. Te Aho o Te Kura Pounamu (Te Kura), New Zealand’s Correspondence School, knows this better than most. Turning 100 this year, the school has a modern and cutting-edge approach to digital technologies, to enable better learning delivery. To ensure its students and staff around Aotearoa were well protected at all times, it seized the opportunity to leverage Microsoft’s top of the line A5 security licence, which schools can access through Microsoft’s schools agreement with the Ministry of Education.
The massive digital acceleration we’ve seen over the past few years has created huge dividends for society – but it’s also exposing organisations and people to greater cyber risk. Prominent hacks at major organisations have led to services going down, ransomware demands, and incredibly damaging data losses.
Schools are at particular risk. Schools already hold large amounts of sensitive data relating to past and present students and staff; add in the rise of the digital classroom and distance learning and the risk dramatically increases. A 2021 report from Network for Learning showed that New Zealand schools’ networks were encountering 2.3 million threats a day. Attacks range from stealing exam papers to installing ransomware on school computers that shut down its entire operations until a ransom is paid, or uploading objectionable material that students might see.
“School data might sound benign, but we have records for students’ childhood addresses, for example. You might put down the street you grew up on as a security question for your bank account 20 years later, and it’s important that data can’t be weaponised,” says Julian Guedon, Chief Information Officer at Te Kura, New Zealand’s largest state school. “As an organisation, we have a responsibility to be kaitiaki of our digital taonga (safe custodians of data) for our past ākonga (students) and kaimahi (employees) just as much as our current ones.”
It’s important, then, for schools and kura to have a strong line of defence against malicious actors, but many schools may not have tools which work together effectively. Schools might have a VPN, an antivirus solution, and controls on file access, but often those solutions don’t speak to each other, and create more issues and friction rather than solving them.
As a nationwide correspondence school with more than 25,000 enrolments each year, Te Kura relies more than most on technology to deliver learning and engage with students/ākonga and their whānau and other members of its community. It was determined to provide the best possible security for its dispersed community, no matter what devices they used.
Microsoft’s Schools’ Agreement with the Ministry of Education offers all New Zealand state and state-integrated schools access to the A5 licence, which provide best-in-class security solutions for schools. It was exactly what Te Kura was looking for.
Securing students and staff
Microsoft 365 Education A5 is the academic-specific version of the E5 licence, Microsoft’s Enterprise suite of cloud-based apps to support innovation, productivity and security. Having an A5 licence means that a tiny school in the Wairarapa, for example, has access to the same level of security capability that the biggest companies in the world use, including Microsoft itself.
“The best thing about A5 for schools is that it’s all integrated,” says Jono Green, Head of Microsoft at DEFEND, a Microsoft Gold Security Partner helping schools implement their A5 licences. “It builds a connected security ecosystem across the school’s entire IT estate, so schools can detect, assess and respond to threats in one place.”
The A5 licence was the obvious choice when Julian started researching options for an upgraded security system for Te Kura in mid-2021.
“There’s already a trend to attack education institutions, mostly because they’re not well protected. And ransoms can be expensive as well, so cost was a real driver. We create our own distance learning education IP, and the loss of that could be massive,” he says.
“We also have complex needs and require a security solution that can handle those. While some of our ākonga and kaimahi (staff) are using devices provided by the school, others are using their own laptops and even mobile phones, so we need to enable that. Finally, security is not just about blockers and limitations to protect students, but on the contrary enabling the organisation to do things safer and smarter. We need to guarantee top-level security while also providing ākonga (students) and kaiako (teachers) with the freedom to access services, collaborate, manage documents and attend classes without friction,” Julian says.
That frictionless approach is something Jono from DEFEND would also recommend to other schools.
“It’s one thing to roll out technologies. It’s another thing to roll out technologies that disrupt what your people are trying to do, which they have to work around. That ends up impacting security too. Rather than focusing simply on the technology, we sit down with organisations to work out the key risks and threats, and what things they are trying to protect so we can work out exactly which solution is best,” he says.
“What I love about Te Kura is that they totally get the importance of having a strong security strategy. underpinning the deployment of technology. As it is a correspondence school, Te Kura has had to adapt to the challenges of providing a secure remote learning environment pre-pandemic, and as such it’s been a leader in adopting the A5 licence and exploring everything it can do.”
Julian and his team worked to integrate Te Kura’s systems into a centralised security platform, from its VPN to its telephony and document management systems. While Te Kura was already using Microsoft applications such as Microsoft Teams, other systems such as its student management system and learning delivery platforms also had to be included, in particular full identity management and protection. Fortunately, Microsoft’s security tools are designed to integrate seamlessly with any IT environment.
Constant vigilance, full mobility
The benefits of an integrated platform showed themselves right away.
For example, before they signed up to A5, Te Kura’s staff and students couldn’t access any documents without first logging into their VPN. Now, because of the security systems that come with Azure and A5, low-risk documents can be accessed any time, on any device. It’s a small thing, but the little things add up to create an environment that solves issues for users as well as improving the security systems.
As well as improved visibility and security of the school’s systems, Julian’s also delighted at getting even better value for money out of having Microsoft Teams for Phone, workplace and education platforms all integrated into a single licence.
Te Kura has also seen the benefits from continuous, automatic updates to Microsoft’s security software. A5 allows schools to benefit from the global Microsoft team’s work to identify and address new threats as soon as they arise, without any added work on the school’s end. Other agencies around the world are also updating the platform as they detect threats, so there’s no waiting for a new security patch to be rolled out – it’s constant.
Even smarter security
Because of the platform’s easy customisation, Te Kura was able to create rules that enabled documents with higher sensitivity to require multi-factor authentication to access (such as a password and text message), while getting the balance right between security and mobility. In future, Julian is keen to use smart technologies that automatically identify which documents may require stricter access (such as those that include personal information) by analysing their contents.
He is also keen to use more of Microsoft’s data analytics tools such as Power BI available through the A5 licence. There are more than 20 products for schools to choose from.
DEFEND has been working with schools around the motu to tailor solutions under A5 licences, getting the message out that every school needs a security plan.
“It’s amazing to see schools like Te Kura see such massive improvements in their security and systems through A5,” says Lydia Kronawetter, Education Industry Executive at Microsoft New Zealand. “We’re working to improve the cyber resilience of New Zealand schools in partnership with the Ministry of Education, so students are protected not just now, but for the future.”
Schools looking for more information on A5 Security Licences can head to this link.
Microsoft also runs regular Zero to Cyber Hero sessions to help schools looking to get ahead with their cybersecurity.