Are schools keeping your private information safe?
Secondly, do schools have the systems in place and defence mechanisms to keep learners’ and parents’ details secure? And, vitally, thirdly: Are schools abiding by the laws which require them to protect our privacy, such as the Protection of Personal Information Act (POPIA)? Some experts have warned that up to 95% of schools may not be POPIA-compliant.
Some experts have warned that up to 95% of schools may not be POPIA-compliant. Schools are increasingly embracing the digital universe and now the COVID-19 pandemic has stratospherically accelerated the adoption of online communication and digital strategies for South African schools. Out of pure necessity, as school gates shut in March, many schools made the agile pivot to online education, as well as intensive online communication with learners and parents alike. But dangerous risks are emerging as schools take this online leap and parents should be sure to ask important questions, such as: Is personal information held by the school safe? Schools hold a vast amount of private information on their learners and their families. This can include anything from their home address, parents’ occupations, work name and address, ID numbers, bank account details for debit orders, the number, age and name of children in the family, closest relatives, telephone numbers, health conditions and more.
Willem Kitshoff, CEO of the d6 Group, South Africa’s leading online school management platform - used by more than 2500 schools around the country, says that not all schools are harnessing smart technology – which is leading to increasing concerns about data security. “There are so many advantages to the adoption of online strategies and the increasing use of digital platforms to improve a wide range of relationships within school communities. But school communities comprise real people, with real rights - who also need to be protected online. So it’s essential to balance speed, efficiency and easeof-communicating with very best security and privacy protocols.” Ross Saunders, who advises d6 as a specialist in data privacy and cyber security, explained some of the risks to parents and learners: “Information that is insecurely stored carries a tremendous risk of being leaked out. Once information is leaked, it’s like toothpaste from a tube. Risks to the person who the data belongs to would likely be identity theft, fraudulent transactions, and extortion.”
For schools, Saunders advised, there are further potential concerns: “Risks to the school would most certainly be reputational damage, but under POPIA there would likely be an inclusion of fines, civil liability (being sued) or both. Schools can also be held to ransom for the information they hold, should a ransomware attack occur due to insecure practices.”
So what should parents, and schools, do? “Parents should be asking questions around the security of platforms in use by the school, as well as any other manual processes within the school. Parents should hold schools accountable for the way the school stores, processes, and retains information and individuals have the right under POPIA to request a breakdown of what information a school holds about them and their children, and schools are obliged to provide the information,” advises Saunders. “Schools, in turn, should only keep the minimum information required to fulfil their obligations, and ensure that this information is stored securely whether it’s in electronic or physical form.” On the management front, many School Governing Bodies (SGBs) take on much of the responsibility for deciding what systems their schools adopt. Saunders explained: “Part of the law is to ensure that security safeguards are in place when it comes to data. The SGB should focus on the school’s policies and procedures, ensuring that secure practices are in use and that privacy is front-of-mind.”
“Cyber security and network security are critical for electronic data, while access control and physical security measures need to also be addressed for hardcopy information. SGB’s need to review the processes and any data transfers, satisfying themselves that security and privacy has been considered within a school’s dayto-day operations.” Kitshoff says both schools and parents are well-advised to interrogate the systems in place at their own school, to ensure they protect and comply. “d6 has developed a range of digital services for schools that are all highly secure and fully POPIA compliant. We realised the vital need to protect all of the information that schools hold and our fully integrated school administration system, financial management facility, digital and online communication platforms, as well as the d6 cashless services are all rigorously maintained with security in mind and the protection of information. Kitshoff ended with this assurance: “The digital school revolution is inevitable and exciting. These important issues around data protections may look complicated, but in partnership with the right experts, schools can walk a healthy line between expanding their online presence fast, while still maintaining strict, careful curatorship of every piece of information in their care.” For more information on the protection of data held by schools contact d6 on 087 820 0088, visit https://d6.co.za or email compliance@d6.co.za Ends
d6+ Security
To provide a secure system, we have implemented and continue to improve the security mechanisms and processes in d6+. These include: Passwords are hashed and not logged Despite the dangers of doing so, people often re-use the same password on different sites. To protect against the risk of leaked data, passwords in d6+ are securely hashed and not logged. Regardless, we recommend that you use a unique password on d6+ as well as on every other site, and use a good password manager to help remember so many different passwords.
use of password reset links. These links expire after being used or after a time, eliminating any historical record of sensitive information. Vulnerability assessment d6 contracted with an external security team to perform a vulnerability assessment during December 2019. The results were overall very positive and validated the work we put into making the system secure. However, malicious actors are working tirelessly to gain access to data, and we too must continue to improve the system. The feedback we got from the assessment will help us to further improve. 2-Factor authentication In June 2020, we added support for 2-factor authentication. When activated, users who login to d6+ will be prompted to type a one-time pin sent to their e-mail or mobile number. 2FA protects against leaked or guessed account information. We also allow a browser or device to be marked as trusted, so that the additional security does not create additional inconvenience.
Password strength checks When updating a password, a strength check is performed to prevent common or easily discovered passwords. When choosing a password, the longer it is the better. We really should be talking about passphrases rather than passwords these days.
Locking of failed logins When someone attempts to login to an account using the wrong password, their attempts will be counted and the account locked automatically after a specific number of tries in a limited time. The lock will expire automatically after a time, or can be removed by a superuser or by the user successfully changing their password.
Password reset links We moved away from e-mails and SMS’s containing sensitive authentication information, replacing them with the
Unauthorized accesses Good security mechanisms are only half of the solution. The other half is good practices - at d6 as well as at your
organization. Unfortunately, during 2019, some incidents occurred at schools where poor user management allowed unauthorized staff to access their system. The d6+ system itself was not compromised in any way. During these events, d6 reacted as soon as the problem was discovered, to lock down the affected accounts and to limit the consequences of the incidents. Such exercises can be costly to your organisation as well as ours, so we urge everyone to make sure that active user accounts and permissions on the system are up to date - don’t leave old accounts open or re-use them.
Offering on-site training for Administrators and teachers
d6+
The full day session will consist of the detailed handeling of the following: Compliance Overview Curriculum Setup Capturing of Important Information Overall System Information Basic Year-End Process Overview To book your on-site training session, please email: enrichment@d6.co.za
Be part of the Future of School Transportation Here’s a way your school can manage school transport bookings and help parents with ridesharing in your own community plus be rewarded at the same time.
d6 Rides, powered by Zipalong, connects parents that are making trips to and from school or activities with parents that are looking for a ride for their child. This happens within the safe d6 Connect environment.
Not only is there a financial benefit for the driver but for the school as well. Have a look at the video below and see how your school can become a pioneer in the future of school transportation or contact ladien@zipalong.co.za for more information. Simply another way how d6 is helping schools to be more effective.
Protection of Personal Information Act (POPI Act) On 22 June 2020, the President issued a Proclamation regarding the commencement of the main sections of the POPI Act (POPIA). Organizations that process personal information (including your organization and d6) have until 1 July 2021 to comply with the Act. It is a common misconception that POPIA only affects marketing and that it’s purely based on consent. Compliance with POPIA is a school-wide concern, from data collected in applications to internal staff records. The Act affects your internal policies and procedures, as well as how you go about processing and storing information once you’ve received it.
The Act details 8 principles which encompass how data needs to be managed. Schools are not exempt from these principles and will need to demonstrate compliance to them “on paper” as well as operationally. What this means is that you will need to review how the school operates from the ground up; reviewing your processes, educating your staff, and implementing changes in order to safeguard the highly sensitive information that any school collects. d6 has engaged with specialist consultants and has been working for the last few years to prepare our systems and staff for this event. We believe we are well-prepared but continue to work to improve compliance with all applicable legislation.
d6 media is expanding horizons A great new initiative is on its way:
Local Listings
EMERGENCY
ACCOMMODATION
AUTOMOTIVE
HEALTH & BEAUTY
What is Local Listings?
How will it work?
A place where community businesses can advertise their contact information in a simple and cost effective way. This will provide users the ability to search for a local service provider directly from the d6 Connect application.
On the d6 Connect application, there will be a section that opens the Local Listing functionality. A user can click on the name of the community business and can contact/ call them directly from the listing itself based on the contact information available.
What categories will be available? Category Accommodation
Sub-category Estate Agents
Category Legal & Financial
Guesthouses/BnB Automotive
Health & Beauty
Lawyers & Legal Firms Medical
Dentists
Fitness studios
Optometrists
Nail & Beauty Salons
Physiotherapists Pets
Pet/House Sitters
Electricians
Pet Groomers
Garden services
Vets
Painters/Handyman
Security
Alarms/Armed Response
Plumbers
Gate Motors & Electric Fencing
Pool maintenance
Locksmiths
Waterproofing/Roofing IT Services
Doctors/Medical Specialists
Service & maintenance Hairdressers Home Services
Accountants & Bookkeepers Investment/Brokers
Driving schools Panelbeaters
Sub-category
IT technician Repairs
Do you want to advertise on our Local Listing platform?
List your business - CLICK HERE
Covid cancelled your school events? Let us host a free virtual . l o o h c s r u o y r o f r e is a r d n u f
How will it work?
Engage your learners (and keep them out of their parents’ hair) with a fun, interactive online talent show Have learners, parents and grandparents vote for their favourite talent videos to compete for viewers choice rewards
How do we help?
Entries are filtered through our automated submission platform Viewers choice votes are calculated on your behalf Payments for entries and voting are processed automatically
What’s the catch?
There simply isn’t one... We, as Sticitt, have been working with our partner d6 and over 450 schools for the last 3 years to remove the risk of cash on school campuses. Seeing the financial strain schools are being placed under during the pandemic, we took it upon ourselves to help where we can.
a d6 initiative, powered by Sticitt
How do you get it?
Just send an email to sales@sticitt.co.za and we’ll do the rest
Introducing an even simpler registration process to get you “Connected”
CLICK HERE TO LEARN MORE
sales@d6.co.za | d6.co.za | 087 820 0088