The range and unpredictability of threats to your school district’s data system can be unnerving: Natural disasters, leaky pipes, computer viruses, and electrical surges can all imperil school districts’ servers—the computers that collect and deliver data to other computers on a network or over the Internet.
And while the not-so-secret formula of properly backing up data on remote servers and anticipating risks appears a simple one, it can be difficult to achieve. Budget pressures, a misunderstanding of data priorities, and a lack of communication between technology officials and other school and district administrators can all lead to more risky data-housing practices.
But education technology experts agree that creating a comprehensive plan to protect school data should be as commonplace as executing a school fire drill. Because, while the reporting of state and federal test scores drives much of the national conversation around school data, a major system crash can paralyze basic and essential school functions like teacher gradebooks, class schedules, library catalogs, and even school lunch operations.
“I always use the analogy of the pyramid of the educational data world,” says Larry Fruth, the executive director of the School Interoperability Framework Association, a Washington-based nonprofit that fosters the sharing of educational software information. “The bottom third of that pyramid is the data you need to really run a school.”
While data experts all support basic data backup, there are different approaches for how often data should be backed up, ranging from once every several days to once every few minutes. More frequent backup uses more server space and comes at a higher cost to the district if it’s done by an outside party.
“You have to ask, what is a day of data worth in your district?” says Robert Kilian, the director of technology services at Infinite Campus, a Blaine, Minn.-based vendor of student-information systems. Basic-level services, including daily backup of student data, costs approximately $1 per student per year with Infinite Campus, Kilian says, and a more constant live backup that can restore data compiled only minutes before a server crash costs an additional 75 cents per student.
1. DECIDE THE BEST METHOD FOR BACKUP: It’s pretty self-explanatory that backing up data onto a remote server is the easiest way to avoid losing data in the event of a server crash. But not every district has the financial or hardware resources to do up-to-the-minute backup on every piece of data recorded. Therefore, the data most essential for running day-to-day district operations should be the focus of the most extensive backup measures.
2. MAKE SURE YOUR BACKUP WORKS: Many districts assume that their backup procedures work despite rarely testing their backup servers’ restore capabilities. This is something that should be done regularly, say experts, and if the data is housed by an outside vendor, the district should demand that the vendor do similar testing.
3. ANTICIPATE CRISES AND CONCEIVE A PLAN: Some threats to data servers are pretty common across the nation, and some are more specific to a region. While nothing will completely eliminate these threats, having a plan of action for if and when they occur may save hours or days in restoring a data system.
4. TAKE SIMPLE MITIGATING STEPS: Threats can be reduced in many ways, from moving server computers to a less vulnerable room of a building, to constructing a network in ways that it is not reliant on the survival of any single server for its function. Much like data backup, using some of these solutions will depend on a district’s resources, but they are worth thinking about even for smaller districts.
5. KEEP YOUR OPERATING SYSTEM AND DATABASE SOFTWARE UPDATED: Makers of operating systems and software typically issue patches, or updates that help fix vulnerabilities within their products. Making sure to install these updates is crucial, because viruses typically prey upon the vulnerabilities the patches are designed to cover.
“I started [offering data backup] nine years ago. At the time, it was kind of a hard sell to get districts to buy into it,” Kilian says. “What districts have seen now is it’s one less thing to worry about. It’s not a big deal anymore.”
Routine Testing
School systems should also make sure there is routine testing of the backup server’s capabilities for restoring lost data, say experts. If they’re using an outside vendor for their student-information systems or other data systems, they shouldn’t just assume the vendor is handling information securely.
“One of the things I think people fail to do sometimes is contact the providers and vendors,” says Linda Sharp, the project director for cybersecurity and crisis-preparedness initiatives for the Washington-based Consortium for School Networking, or CoSN. “They need to make sure those they work with also have backup plans.”
But Sharp says no amount of backup can ensure 100 percent against a potential server crash. Sharp says school districts should be aware of potential threats based on everything from the local weather and geography to a district’s electrical grid, and potential for theft, vandalism, and hacking. And while data-system vendors often offer published guides to data-disaster recovery, Sharp thinks it’s important for individual district officials—and especially district technology officials—to think independently of vendor-provided literature when crafting a data crisis-response plan.
“I think what is the most critical thing to do is for schools to work through these scenarios themselves,” she says, “because then it becomes personal.” She adds that district technology personnel have a better understanding than others about the demands different threats may put on their data system, and need to offer input during the plan’s conception.
While a crisis plan is important because it is impossible to eliminate data threats, it is possible to diminish the threat level.
A very simple way to do this is to consider the physical location of the servers, Sharp says. How susceptible is the location to storm damage? Are the electrical grid and the communication infrastructure in the building dependable and up to date?
Protective Measures
Meanwhile, Kilian from Infinite Campus says keeping your operating system and data software updated with the latest patches—updates sent out by the makers to fix a vulnerability in the system or the software—can halt viruses that prey upon those vulnerabilities.
Beyond that, how a network is constructed can help minimize the effects of a server crash. For example, using clustering, or a network where the server is hosted on multiple computers, means that there is more flexibility for how to restore specific data functions if one computer fails.
And many districts are virtualizing servers, says Darryl LaGace, the chief information and technology officer for the 132,000-student San Diego Unified School District, meaning that the server hard drive is broken into partitions to create a local backup for the program. If a coding error were to harm the partition that is acting as live host of the data, a duplicate partition could be activated in its place to undo the damage.
But virtualization may be a better measure for preventing smaller losses—such as the deletion of a single data set—than for preventing more catastrophic data losses. And as with all preventive measures, this one is no good if you think of it after the worst-case scenario.
“You can pick up those virtual servers on someone else’s server and get them back up and running rather quickly,” says LaGace, but it is not “something you can do after a crash has occurred.”
