Working from Home

[Meghan]

Hello,

We have a number of teachers who want to use their own devices while working from home.

They have school-issued chromebooks but want to use their own devices.

Two questions:

Is there some google documentation about why it is best to use a school-issued device?

How can I best set up session time outs to protect our school data?

Thank you for the help.

[MarkLoundy]

It’s only best for the school. If a teacher owns a MacBook or a full-on PC, they are going to prefer to use them. Chromebooks are intended to be cheaper devices and can be quite frustrating to use for anybody with experience with traditional laptops. 

[Meghan]

Thank you.  I understand.  I am looking for tipshow best to configure session time outs, etc. for the OUs where people are working from home.  Thanks again.

[nsattler]

They are opening up themselves to possible legal issues if they have Personally Identifiably Information (PII) about students on their personal devices.  This not only includes personal computers but cell phones as well.  Anything downloaded that contains student data on these devices are a red flag.   You are best to discuss this with your Board of Education or Administration Team regarding any legal issues. 

At a minimum, you need to set up 2 Factor/Step Authentication with hourly reauthentication.

[kaned]

I would second @nsattler.  

There is a line for security, it is up to you and your district to determine where that line is.  These should be serious conversations about possible impact to the district vs convenience of employees.  These should also drive employee expectations.

We have had concerns about documents stored at home with Google Drive, etc.  This is on the radar for us but we have not yet done anything with this.  In all honesty, this is far down on my list of cybersecurity concerns (although it is definitely on the list).

There was an issue years ago (not my district) where a counselor had student information in their downloads folder on a personal laptop that was lost/compromised.  

IF I were to approach this, I would be using our MFA/Identify vendor to verify the machine prior to logon.  That's not the low hanging fruit I'm currently working on though...