Cyber Safety & Security

Home/Parents/Technology & You/Cyber Safety & Security/

2022 K-12 Cyber Awarness Month 2022

Technology plays a vital role in education. The Halton District School Board leverages technology to enhance learning experiences for students, from online learning platforms to administrative tools.

With this increased reliance on technology comes the critical responsibility of ensuring the safety and security of students and staff. Cyber threats are constantly evolving and school boards are not immune to these risks. Cyberattacks, such as ransomware, phishing scams and data breaches, can disrupt learning and compromise sensitive student and staff information. These threats pose significant challenges to the safe and effective use of technology in education.

The HDSB recognizes that cyber security and data protection are paramount to maintaining the integrity of our systems, safeguarding sensitive data and providing a secure learning environment. The HDSB has implemented robust cyber security measures to protect against cyber threats, including:

Regular security monitoring, assessments and audits to identify and address potential anomalies and vulnerabilities in our systems and networks
Employee training and awareness programs to educate staff on best practices for data security, phishing prevention and recognizing and responding to cyber threats
Student digital literacy for all students (Kindergarten to Grade 12)
Advanced security technologies to protect our data from unauthorized access
Data privacy policies and procedures to ensure that all personal information is collected, used and disclosed in accordance with applicable laws and regulations.

Shared Responsibility

We recognize that cyber security and data protection is a shared responsibility and essential to ensure the continued success of education. Families are encouraged to play an active role in educating their children about online safety and responsible digital citizenship. By working together, we can create a safer and more secure digital learning environment for all students. Learn more about online safety and digital citizenship.

Guiding Principles

The HDSB, schools and all staff have a duty of care to take reasonable steps to protect students from harm within the online learning environment.

Data and information systems are critical HDSB assets and shall be safeguarded deliberately, appropriately and consistently.
Cyber protection shall be provided in a manner that serves the security and safety of students and staff while adhering to legislative requirements. Cyber risk management is a shared responsibility between the HDSB and school administrators. Accountability for cyber risks shall rest with the Director of Education and the Superintendent of Information Services.
Appropriate safeguards shall be in place to ensure the protection of student and staff privacy and their safety online. The effort taken to apply these safeguards shall be proportionate to the possible harm or injury that could result if confidentiality, integrity and availability are not assured.
All students and staff shall be responsible for ensuring safe and ethical online behaviour and understand their accountability for the protection of information that is received, created or maintained on behalf of the HDSB, in alignment with the Responsible Use of Information and Communication Technology (ICT) Administrative Procedure.

Cyber Protection Standards

Cyber Security: The protection of information and information technology resources with respect to confidentiality, availability and integrity and secure network-connected Operational Technology (OT) resources
Cyber/Online Safety: The promotion of safe online practices and the mitigation of the risks associated with the inappropriate use of technology in accordance with the HDSB’s Responsible Use of Information and Communication Technology (ICT) Administrative Procedure.
Digital/Online Privacy: The protection of personal and sensitive information from unauthorized access and recognition of the importance of guarding personal and sensitive information when using technology.

To achieve these objectives, the HDSB is committed to each of the following principles:
Cyber Protection Strategy/Roadmap: The HDSB’s plan to continuously enhance cyber protection and our overall approach to managing cyber risks to the Kindergarten to Grade 12 technology ecosystem and its users.
Cyber Protection Tools, Standards, Procedures and Guidelines: Specific mandatory or recommended measures (also referred to as safeguards or “rails”) to defend against cyber threats, producing a reliable foundation for cyber security, cyber safety and privacy protection for HDSB students and staff.
Cyber Protection Assurance: Continually assessing the adequacy and efficacy of cyber protection measures in protecting students and staff from cyber threats.

Cyber Protection Strategy and Roadmap

The HDSB has developed and maintains a multi-year cyber protection strategic plan for implementing and enhancing cyber security across the organization. This plan helps ensure that:

appropriate technical and administrative safeguards are implemented to secure resources to a degree that is consistent with the cyber protection requirements outlined in HDSB procedures, policies and legislation, and
users of HDSB-provided technology are informed or trained on the Responsible Use of Information and Communication Technology (ICT) Administrative Procedure and safe and responsible online practices.

The HDSB is committed to adopting CIS Critical Security Controls (CIS Controls), adhering to the requirements of the provincial Cyber Security Wellness Architecture (CSWA) and meeting the standards set out in the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 Core and Reference Architecture (RA) 3.0.

The HDSB is committed to a process of continuous monitoring, assessment, reflection, renewal and improvement as cyber protection standards continue to evolve.

Cyber Risk Management

Cyber risk management is an important practice that enables the HDSB to align cyber security, cyber safety and digital privacy with our strategic priorities and operational plan initiatives while effectively mitigating cyber risks to the HDSB’s assets and operations.
Digital and network-connected solutions in the HDSB undergo an assessment of cyber risks prior to entering into a contract or service agreement and before implementation.

Cyber Awareness and Data Protection Training

The HDSB conducts mandatory, regular and ongoing cyber awareness and data protection training for users of information technology and network-connected resources. Students and staff are provided with information and resources to enhance digital literacy and citizenship.

Identity and Access Management (IAM)

The HDSB will implement identity and access management (IAM) programs to ensure only authorized individuals are provided access to HDSB information, systems and networks.

Network and Cloud Security

The HDSB shall adopt and implement the principles of Secure Access Service Edge (SASE) as the core tenets of its security architecture framework in order to offer optimized and secure network services across individual users, premises, edge, remote and public/private cloud environments.

The HDSB shall operate in a Zero Trust Network Access (ZTNA) environment and adopt a posture of “assume compromise” whereby all systems will deny access by default and eliminate implicit trust under the assumption that all accounts and devices are potentially compromised. Only trusted individuals and devices will be permitted to access the HDSB network and other infrastructure.

HDSB staff and any other individual requiring access to sensitive HDSB information or systems shall first be authorized through a review and approval process.

Public Access to HDSB Networks

The HDSB shall not permit its networks to have open access except for managed guest networks that are isolated from the HDSB’s other network segments by reliable means.

Privacy and Data Protection

We recognize the need to differentiate the data of children (minors) from that of adults and accept that additional and different privacy safeguards may be needed. The HDSB shall take appropriate measures to ensure the confidentiality, integrity and availability of sensitive information, including but not limited, to:

sensitive business information such as HDSB financials and contracts
personnel matters
personal information of students and staff

We are committed to protecting the privacy of and safeguarding access to student and staff personal information held by the HDSB and to following rules for collection, retention, use and disclosure as required by legislation and detailed in the Records Management Administrative Procedure.

All individuals with access to this information, and other sensitive information, shall be required to comply with applicable HDSB policies, standards, procedures and guidelines and abide by all applicable privacy laws and legislations.

Technology, software and applications unable to meet the HDSB’s standards for privacy, security and data protection will not be authorized for use and will not be permitted access to HDSB infrastructure and systems.

Data Loss Prevention

To prevent end users from accidentally or maliciously sharing data that could put the organization at risk, Data Loss Prevention capabilities are designed to detect and prevent the unauthorized access, use and transmission of information by ensuring end-users do not send sensitive or confidential data outside the organization without proper authorization. Data Loss Prevention will send an alert, change permissions for the data or, in some cases, block the data when it is in danger of leaving the corporate network. Wherever possible, such measures will be automated.

Physical Security & Cyber Hygiene

The HDSB is committed to ensuring a safe working environment for all students and staff. All staff and students are expected to adhere to the physical and cyber security requirements, as detailed in the Responsible Use of Information and Communication Technology (ICT) Administrative Procedure.

Software and Technology Catalogue & Approved Applications

Information Services shall maintain and update its Software and Technology Catalogue to protect staff and student personal information and HDSB data. The Software and Technology Catalogue will detail software applications approved for use by staff and students, on the HDSB network and/or on HDSB devices.

Unless otherwise approved by Information Services, HDSB staff shall only use applications and software identified and approved in the Software and Technology Catalogue. Any applications or technology not approved for use in the Software and Technology Catalogue must not be used by staff and students on HDSB devices and/or the HDSB infrastructure (including HDSB networks) and will not have access to sensitive data, applications, and systems.

To determine inclusion or exclusion from the Software and Technology Catalogue, all applications shall be subject to an application vetting process to assess need, pedagogical value, procurement requirements, technical compatibility, privacy risks, and data and/or operational security risks.

Incident and Breach Response Planning, Management Response and Recovery

The HDSB will employ automated detection and response capabilities to monitor, detect and remediate potential or actualized cyber incidents and breaches on HDSB networks, devices/endpoints, systems/applications, network-connected equipment and platforms. While every effort will be made to minimize impacts to users, the priority of automated systems and staff will be to respond to and eradicate threats. Depending on the nature and severity of an identified threat, immediate action may be necessary or recommended.

Any person who causes or contributes to cyber incidents or breaches shall be held accountable when their actions contravene HDSB standards, procedures and guidelines.

Cyber Protection Assurance: Monitoring, Assessing and Auditing

The HDSB monitors risk compliance for critical information technology and network-connected resources. This may be done in the form of cyber risk assessments, penetration tests, vulnerability assessments, privacy impact assessments (PIAs), phishing campaigns, tabletop exercises, audits and other industry established practices.

HDSB networks, devices/endpoints, systems/applications, network-connected equipment and platforms are monitored to detect and prevent potential cyber incidents and breaches in accordance with legislation.

Monitoring and assessments including but not limited to cyber risk assessments, penetration testing, vulnerability assessments, PIAs, tabletop exercises, audits and other industry-established practices may be conducted across the organization or locally at specific sites or with specific user groups. Access to and analysis of monitoring data shall be restricted to authorized personnel.

Additional Information

Families are encouraged to explore the following resources and engage in conversations with their children about how cyber security plays an increasingly important role in their lives:

Board Office

Halton District School Board
J.W. Singleton Education Centre
2050 Guelph Line
Burlington, Ontario, L7P 5A8

Numbers

Phone: 905-335-3663
Fax:

Links

Email Us

Cyber Safety & Security

The HDSB shall adopt and implement the principles of Secure Access Service Edge (SASE) as the core tenets of its security architecture framework in order to offer optimized and secure network services across individual users, premises, edge, remote and public/private cloud environments.

HDSB staff and any other individual requiring access to sensitive HDSB information or systems shall first be authorized through a review and approval process.

To determine inclusion or exclusion from the Software and Technology Catalogue, all applications shall be subject to an application vetting process to assess need, pedagogical value, procurement requirements, technical compatibility, privacy risks, and data and/or operational security risks.

HDSB networks, devices/endpoints, systems/applications, network-connected equipment and platforms are monitored to detect and prevent potential cyber incidents and breaches in accordance with legislation.

Additional Information

Families are encouraged to explore the following resources and engage in conversations with their children about how cyber security plays an increasingly important role in their lives:

The ABCs of cyber security for kids - Government of Canada

Canadian Centre for Cyber Security - Government of Canada

Cyber Safety-Parent Tip Sheet - Ontario Principals’ Council

Cyber Security Ontario

Get Cyber Safe - Government of Canada

Resources for Parents - Cyber Security | MediaSmarts

Cyber Safety & Security

The HDSB shall adopt and implement the principles of Secure Access Service Edge (SASE) as the core tenets of its security architecture framework in order to offer optimized and secure network services across individual users, premises, edge, remote and public/private cloud environments. ​

HDSB staff and any other individual requiring access to sensitive HDSB information or systems shall first be authorized through a review and approval process.​​​

To determine inclusion or exclusion from the Software and Technology Catalogue, all applications shall be subject to an application vetting process to assess need, pedagogical value, procurement requirements, technical compatibility, privacy risks, and data and/or operational security risks.

HDSB networks, devices/endpoints, systems/applications, network-connected equipment and platforms are monitored to detect and prevent potential cyber incidents and breaches in accordance with legislation.

Additional Information

Families are encouraged to explore the following resources and engage in conversations with their children about how cyber security plays an increasingly important role in their lives:​

The ABCs of cyber security for kids - Government of Canada

Canadian Centre for Cyber Security​ - Government of Canada

Cyber Safety-Parent Tip Sheet - Ontario Principals’ Council

Cyber Security Ontario

Get Cyber Safe​ - Government of Canada

Resources for Parents - Cyber Security | MediaSmarts​

The HDSB shall adopt and implement the principles of Secure Access Service Edge (SASE) as the core tenets of its security architecture framework in order to offer optimized and secure network services across individual users, premises, edge, remote and public/private cloud environments.

HDSB staff and any other individual requiring access to sensitive HDSB information or systems shall first be authorized through a review and approval process.

Families are encouraged to explore the following resources and engage in conversations with their children about how cyber security plays an increasingly important role in their lives:

Canadian Centre for Cyber Security - Government of Canada

Get Cyber Safe - Government of Canada

Resources for Parents - Cyber Security | MediaSmarts