By Jessy Irwin
Every day, teachers are responsible for maintaining numerous logins, passwords, data, and other private information about their students. As chief technology officer in the modern century classroom, an educator’s role becomes more complex (and potentially overwhelming) as more tablets, computers, and web tools are put in the hands of students. With so many tools, security and privacy are often an afterthought despite the increasing number of websites that fall victim to data breaches and security vulnerabilities each day.
Last week, researchers discovered Heartbleed, a massive security flaw in an encryption tool used to protect data across some of the most popular sites on the web. For almost two years, this hole in OpenSSL may have quietly left two-thirds of the web vulnerable to eavesdropping, leaking private data including logins, passwords, and other information stored in Web servers to anyone who might be listening. Given the enormous amounts of information entrusted to teachers about their students, colleagues, and their communities, here are a few important measures teachers can take to protect themselves from Heartbleed.
-
Don’t login to a site or attempt to change your passwords unless you’re certain that a vulnerable site has been fixed. Though most major web companies have fixed the Heartbleed bug, it’s important to note that logging in and changing passwords on a vulnerable site will leave you vulnerable to the likelihood of an attack.
-
There are numerous resources that can help you determine whether a site is vulnerable or if it has been patched. If you use Google Apps for Education, Yahoo! Mail, Pinterest or Minecraft in your classroom and you haven’t changed your passwords in the last week, it’s safe to do so now. For Android users, this tool from mobile security firm Lookout will help identify whether your operating system is susceptible to Heartbleed. Alternately, there are many tools that can check encrypted sites for the bug here, here, and here.
-
Your online accounts are more likely to be compromised by a phishing attack that attempts to steal account credentials than a hacker exploiting Heartbleed to steal data from servers. Because public awareness of Heartbleed is high, malicious hackers will do their best to make the most out of this situation as they can. For maximum security, educators should be manually accessing the sites they use when they want to login and change passwords instead of clicking through links within an email.
-
If you’re using the same password for multiple accounts on the web, it is safest to assume all of the accounts using that password have been compromised. In the wake of major data breaches, criminals can and will employ tools that attempt to break into any online accounts they can. If you are one of many educators exercising this insecure habit, now is an excellent time time to break it. Password managers like LastPass, 1Password and KeePass are valuable tools that can help educators to generate, store, and audit passwords for all of your web accounts.
-
Heartbleed may be affecting your school or district network, too. Security engineers are beginning to discover that firewalls, switches, virtual private networks, servers and other important network hardware are also susceptible to the hole in OpenSSL. In some cases, the records of your current and former students stored in an SIS are vulnerable, and sensitive information could be leaked without a trace to the rest of the web. District technology leaders, technology coordinators, and anyone maintaining databases full of student information should double check with hardware vendors to confirm whether their systems need patching or not.
Though technologists and engineers have patched many of the sites vulnerable to Heartbleed, it's impossible to determine if sensitive user data may have leaked onto the web. While there is no such thing as being completely safe from hacking and data breaches on the web, there are many preventative measures that can be taken to protect sensitive data and online accounts. If there’s a lesson that can be taken away from Heartbleed, it’s this-- there’s never a bad time to be proactive about online security.
Jessy Irwin is a privacy and security advocate who once integrated technology and social media into a class of 3,000 students.