Security on the Internet

Security on the Internet.

There is a strong incentive for companies to continue to make the Internet safe. Rarely do I post concerns about various issues that arise. Many of you may have heard of the Heartbleed vulnerability on the news. We’ve done a posting on the issue on the tech blog  I’m not a “the sky is falling” prognosticator, but the Heartbleed bug is a serious issue.

  • The Chrome browser currently provides the best security. Please use it as much as possible.
  • Please change you passwords. Seriously. Change your passwords (both for work and your personal ones).
  • It is good practice to change your passwords regularly – but it is absolutely critical that you change passwords now. This bug has been in place for a while.

This follows the Target debacle of last year.

Passwords

Passwords are a necessary evil. Currently, we don’t have a better way to make sure that you are you. Although biometrics may be coming, they are not fully here yet. Best practice says that you shouldn’t repeat passwords (ie. you should have a different password for every site). However, remembering that many different passwords is impossible. Thus, people tend to pick really easy to guess passwords and use them everywhere. In reality, the pros tend to use a password management system. (Writing your password and “hiding” under your keyboard doesn’t qualify as a system). Here are a few:

  • 1Password – this is a paid program (this is also the one that I personally use)
  • LastPass – Free for individuals. There are premium features (such as mobile support) that are paid.
  • KeePass – Free and open source.

All of the above work pretty much the same way. You have one secure password to remember that lets you create different passwords on web sites. These programs fill the passwords in on sites that you visit. These vary greatly in usability however. 1Password is the most expensive, but the easiest to use. KeePass is free but the least user friendly.

Most browsers will also offer to save passwords. This isn’t very secure as that file can be easily read.

Really. Change your passwords. This applies to your personal accounts as well.

Please note that your district password is the same for several sites, including Gmail for work. If you change your password at a computer, this will change your password for Gmail. That means that you’ll have to reenter the new password on your smart phone which checks your work email. Oh, and your iPad. And your Android tablet. And your home computer. ETC.

You can change your password by going to the Staff Resources page, Then Change your password under Productivity.

Where do you need to change your password?

Changing your password will not hurt anything – except for the inconvenience of entering and remembering it. The list of sites is changing daily. Mashable is currently hosting an updated list of sites with their current vulnerable status.

How about your work password?

We are moving to more secure passwords. This has been in planning for some time. We have tried to hold off to develop some training, but we will need to reevaluate this. We truly understand that this can be difficult, but it is important. More information will be provided via email.

The new password requirements will be as follows:

  • Passwords must be different than your last 3 passwords.
  • Passwords must be at least 5 characters long.
  • Passwords must contain characters from three of the following four categories:
    • Uppercase characters
    • Lowercase characters
    • Number (0 through 9)
    • Nonalphanumeric characters: ~!@#$%^&*_-+=`|\(){}[]:;”‘<>,.?/

Heartbleed

What is it?

Heartbleed is a serious security vulnerability in web servers that run OpenSSL. (A lot of web servers run OpenSSL). Intrusion leaves absolutely no trace what so ever. Thus, there is no way to know if someone has implemented the vulnerability.

Why should you care?

Lots of web servers run OpenSSL for security and authentication. This bug could allow someone to steal your user name and password, without anyone knowing.

What should you do?

The short answer is that you should change your passwords on all important sites. The bad news is that you need to do that after the server has been updated and new security certificates installed. However, unless the individual site tells you that they have updated, you’ll have no way of knowing.

UPDATE: Most providers have updated their sites. It is prudent to change your passwords.

Examples

The following sites are SOME sites that are vulnerable or not:

Vulnerable Not Vulnerable
Yahoo Google
Flickr Youtube
Eventbright Twitter
Scoopit Facebook
Zoho Wikipedia

Note

This will be especially important for your personal accounts. We are currently reviewing our network vulnerability.

Student Portfolios – A tool for every student

A little known secret in iLearn is the ePortfolio tool.  This tool is built using software called Mahara and is fully integrated with iLearn.  This tool allows students to collect, store, and display their work.  They can form groups and more to share information, create pages, and connect with other students.  They are able to build portfolios by choosing which pieces of work they want to share in pages.  Writing, reflection, sharing – these are all traits of a good portfolio system and we have this tool ready and waiting for your students!

Teacher Robert Harrison at EFHS is a true pioneer (Not to be confused with a “pioneer” in the DHS sense) working with a blended learning classroom.  His latest endeavor is having students write and reflect on their work using ePortfolios.  The Mahara ePortfolio solution was ideal because his students were already familiar with logging into iLearn.  The portfolio button is right on the iLearn homepage and easily accessible to students even if the teacher is not using iLearn for blended learning.   By having the students store their lab reports, writing journals, and adding other learning material in the portfolio the students are able to produce, collect, and share their learning.

The best part is that the student at any time can export their entire portfolio and all their work as a zip file and take it with them!  Lets take a look at a few images of what the student portfolios look like.  Remember, the students build these on their own.

SBAC Testing

Several schools will be piloting SBAC testing next week. While we are working on moving as many of the links that students need to our Applications page, some programs can’t be linked that way. In those cases, we put an icon on the desktop of student computers.

 

In the case of SBAC, the icon will look like this:

SBAC Icon

iOS 7 Update

There is a very important update for iOS devices. The update (iOS 7.0.6) updates a SSL script that is very important to keeping your device safe. However, after updating, some may notice their Google Calendar not syncing all events. We believe that we have a fix.

After updating your iOS device, please do the following:

  1. Open your Settings.
  2. Open the Mail, Contacts and Calendars.
  3. Scroll down to “Fetch New Data”. (This should be set to “Push”). Open the Fetch New Data setting.
  4. Scroll down the last section “Fetch”.  Select “Hourly” (or Every 15 minutes or Every 30 minutes). This was probably set to Manually. 

 

That’s it. This means that your calendar may be up to an hour behind changes made on other devices. However, this is generally preferable to syncing taking days and days.

Technology Tidbits

Technology Tidbits – The Tech News Roundup

Note:  To get all the technology updates please subscribe to the technology blog:  https://iblog.dearbornschools.org/technology/

If you have any questions or want to explore using district blending learning tools please contact me.

Chris Kenniburg

Webmaster, Dearborn Public Schools
313-827-3084

New Password Criteria

We will be slowly rolling out a new set of password criteria. We will begin with ninth grade students and then expand to all students and employees.

The new password requirements will be as follows:

  • Passwords must be different than your last 3 passwords.
  • Passwords must be at least 5 characters long.
  • Passwords must contain characters from three of the following four categories:
    • Uppercase characters
    • Lowercase characters
    • Number (0 through 9)
    • Nonalphanumeric characters: ~!@#$%^&*_-+=`|\(){}[]:;”‘<>,.?/

So, why update our password requirements? Well, we believe that it is important to teach good habits to students and to practice what we “preach”. You may be aware that several large businesses have had breeches of their online services. Good passwords can help protect against damages. Remember, you should not be reusing passwords on different sites.

Email Group issue

We have discovered an issue with email sent to groups that began yesterday. The issue is related to users who’s last name begins with the letters A-D. These users may not have received email that was sent to a group of which they are a member. For example, email addressed to the ASC building would not be received by Ruth Bankhead. Ruth also would not receive emails sent to the group Dept. Human Resources. Ruth would receive her sent directly to her.

We are working on a resolution.

Free Webinars

In the spirit of Digital Learning Day, #TeamJXN will be offering several FREE online, after school, webinars. Each On Air PD will feature local educators sharing how they use technology in their own classrooms.

Teachers who view the On Air PD live will have the opportunity to ask questions live to the panel. Each session will be recorded for later viewing for those who can’t attend the live sessions.

On Air PD Lineup:

  • Monday, February 3 at 3:00 p.m. – Coding in the Classroom (Theresa Helm)
  • Tuesday, February 4 at 3:00 p.m. – Building Engineering into Your Curriculum (Lloyd Hilger)

 

Participate in On Air PD’s at https://edtech.jcisd.org/on-air-pd.htm

Follow this blog

Get every new post delivered right to your inbox.