IT security in the staff room

Whether it's a computer, laptop, tablet or smartphone, protect your devices with a code or biometric encryption. Lock your devices as soon as you stop using them, even if it's only for a few minutes. This will ensure that your personal data and your students' data remain secure.

Software updates close security gaps. It is therefore essential that you install updates as soon as they are released. Some systems also offer automatic software updates overnight if the settings are configured correctly.

When surfing the net, as in many places, common sense is required. Always check whether the website you are visiting is secure and SSL-encrypted – the first indication of this is https:// in the URL. If a site has questionable pop-ups or advertisements, caution is advised.

Do you need a specific programme for preparing or following up on lessons? Only purchase or download programmes and apps from trustworthy websites or official providers. Remain vigilant during the download process: does the programme really need all the access it requests?

Which network are you currently connected to? School network, home Wi-Fi, hotspot or public network? Always exercise caution when using an unknown or public network. When on the move, it is better to switch to your smartphone's personal hotspot.

Exams written, corrected and stored locally on your work laptop. But then the unthinkable happens: your laptop is stolen or you accidentally spill a glass of water over the keyboard. Not only is the device gone, but so is all the data stored locally.

To ensure you don't lose this important information forever, we recommend always creating a backup on the cloud. This allows you to easily restore your data at any time. Again, make sure you choose a trustworthy provider.

Visit Educa Navigator(opens in new tab), the Federal Agency for ICT in Education(opens in new tab), which has tested and evaluated a wide range of applications in the school environment. Although not specifically designed for schools, our mycloud.ch service is secure and stores all data in Switzerland.

Adhere to the minimum requirements for secure passwords. Create a separate password for each service provider and login, and use a password manager if necessary. We recommend Swisscom blue Security & Service. Avoid writing passwords on Post-it notes at all costs.

Tip: Passphrases are often significantly more secure than passwords. 

Develop a healthy scepticism when you are unexpectedly asked to open a link or document. Phishing emails often look deceptively genuine these days, but they are frequently characterised by urgency, insistent requests or exclusivity. Check the sender carefully and, if in doubt, avoid clicking on any links or attachments.

Report suspicious emails and links to your ICT manager – especially if you have already (accidentally) clicked on them. You can find out how to recognise phishing emails here.

Make it difficult for cybercriminals and protect your data twice over – with two-factor authentication. Depending on the login and provider, after entering your access data (username and password), a code is sent by text message or email, or double authentication is carried out in an authenticator app. Learn more about 2FA.(opens in new tab)

Have you been the victim of a hacker attack? We'll tell you what to do now.

Storing pupil data in the cloud not only has the advantage of making it available anytime, anywhere, but in most cases the provider also creates a fail-safe backup copy. Ideally, the cloud should be protected with a password and two-factor authentication.

It is advisable for schools to evaluate and implement a suitable storage solution. This has the following advantages:

1. Thorough analysis of the provider (including security aspects) and the cloud solution
2. Simplified exchange of data between teachers
3. Consistent development of skills among the teaching staff

If you store data such as exams or grade overviews on a USB stick, for example, you run the risk of the USB stick being lost or stolen. We advise against transporting or editing data using a USB stick. In addition, malware can be “transferred” via a USB stick and thus enter the school network.

Ensure that you always handle data carriers containing sensitive data with the necessary care and do not leave them unattended on the table. Data carriers should also be stored safely away from external influences to prevent damage and loss of data.

When making a telephone call in Switzerland, you can generally assume that data security is guaranteed. However, it is not always possible to determine the identity of the other party with certainty and thus ensure that they are authorised to receive confidential information.

In many schools, email has replaced letter-based communication. Although emails are efficient, they offer little or no data security for confidential information.

However, the email or newsletter format is an efficient way to share general school information, such as term news or event announcements, with parents and guardians.

When sending circular emails, be sure to either use a professional newsletter application or send the various email addresses in blind carbon copy (Bcc) (and not in carbon copy (Cc)!

In many classes today, it is common to use a shared class chat on WhatsApp or similar messaging services. Such a chat can be very useful for communicating with parents.

However, it is advisable to thoroughly check the desired tool in advance with regard to data protection. This is especially important if you want to exchange confidential information in this way. For legal and data protection reasons, Swiss services such as Threema are generally recommended for this purpose. Like WhatsApp, these services use end-to-end encryption, but significantly less data is temporarily stored on the Threema servers(opens in new tab).

For reference: Messaging apps in comparison(opens in new tab)

Modern school administration platforms such as Klapp(opens in new tab) or escola(opens in new tab) even offer an integrated communication channel with pupils and parents or guardians. This means that the information remains in the protected area of the platform.

Sometimes it may be necessary to allow third parties access to certain data storage. For example, parents and guardians can access class photos from the ski camp.

In this case, it is important to remind parents of the necessary care and responsibility with which they must treat the sensitive data stored there. As a teacher or administrator, you can also restrict the type of access depending on the service and, for example, block the downloading of data.

To ensure that only authorised persons can view confidential information, you can also create separate storage locations and access rights for each authorised person and/or party: e.g. only make the photos of their own children available to parents.