Security isn't just for techies anymore.

During the time it takes you to read this article, your computer network will have been scanned and assessed for vulnerabilities by some unscrupulous individual attempting to exploit any identified weakness. At the same time, school district personnel are placing confidential correspondence or student data onto a common network folder and perhaps your human resources and administrative services departments are processing new applicants into your financial software application. Meanwhile, students in your schools are actively exploring the Internet as part of a class.

You may be thinking, "I don't have any worries. The security of my district's technology is not my responsibility-that's why we have a technology department." This mindset could be costing you, your students, staff and school district more than you know. Imagine your e-mail or phone service being out of service for several days. What horrors come to mind if an unauthorized individual gained access to your student, financial, assessment or human resource data?

School district networks are particularly difficult to protect given the diverse types of users, software, equipment and connections that most school districts provide. Take a look around you. How many flavors of technology are you serving in your district? Do any of these items sound familiar: desktops, laptops, handhelds, servers, LAN/WAN connections, wireless access and remote access?

Surely your district has a common platform and common specifications for all software applications, access and equipment making it easy for your numerous and well-rested technology staff to maintain and support. Surely you already devote a significant portion of your budget to support security in the area of technology. Undoubtedly, staff turnover in your district is non-existent so that users are always highly trained and aware of your up-to-date and well-publicized technology security policies and procedures.

Does this sound like your school district or any other district you know? Probably not.

Types of Threats

Vulnerabilities to the security of your district's technology infrastructure can relate to users, data, software, hardware and transmission. While many of us are familiar with the problems of computer viruses and worms or individuals gaming unauthorized access to electronic records or systems, new threats appear faster than you can learn how to avoid the old ones. Have you heard the latest about spyware or phishing?

Top district leadership should take ownership for understanding and monitoring the security of their technology. This does not mean you need to be able to articulate the difference between the application layer and the transport layer of your district's network operating system. However, it does require that you treat technology security as a fundamental part of the district's core functions.

Providing adequate financial resources and support personnel is an essential start. TCO is not the name of the latest musical group to make the charts. It stands for the "total cost of ownership" for technology purchases and existing infrastructure. It means ensuring sufficient funding for training in security for support personnel and for the purchase of the needed tools and contracted services for the ongoing assessment of the security of your technology. Careful analysis prior to purchasing software, hardware and telecommunications services allows you to address potential security pitfalls.

Review of your district's technology security policies should be an ongoing activity. Good communication with your technology staff is a start. You entrust these staff members to carry out the district's technology initiatives. Providing leadership and support through your involvement is important. As the key administrator, your behavior and beliefs set the tone for the development of technology security procedures.

All staff should be trained on the district's security procedures. Reminders and refreshers are inevitable given the changing nature of technology and staff turnover. Likely training topics deal with completing backups of data, choosing and securing passwords, installing and updating anti-virus software and emphasizing common-sense concepts like logging off network accounts when away from one's workspace.

These may seem trivial until you walk around your district office to see how many users have their passwords written on a Post-it [R] note stuck to their monitor or never shut their computers down because they don't have time.

Security Audits

While audits of a school district's curriculum and financial records are neither unusual nor questioned, mention the phrase "security audit for technology" and some people will think you are talking about jiggling the door knob to the computer lab at the end of the day to be sure it's locked. Consider hiring a qualified consultant, perhaps recommended by your state education agency, to audit the security of your technology and probe for vulnerabilities.

Administrators should subject their technology systems to the same auditing rigors that you would apply to a core educational area.

Gone are the days when everyone played nice and we could leave our schools open for everyone to use. The security of your district's technology is an increasingly complex task. While no policy, process or system is ever infallible, logical and reasonable steps can minimize your exposure to security problems and crises.

Lane Mills is the assistant superintendent for accountability and technology for Wilson County Schools, P.O. Box 2048, Wilson, NC 27893. E-mail: [e-mail].