Continuous Improvement by Justin St. Pierre

IT due diligence procedure published (BCE)

justinfstpierre — 2024-11-20 01:20:45 UTC

Volume of app requests has overwhelmed the process (BCE)

justinfstpierre — 2024-11-20 01:21:13 UTC

2 Processes: School & Enterprise (BCE)

justinfstpierre — 2024-11-20 01:21:43 UTC

Principal makes the final decision. IT provides a risk rating. (BCE)

justinfstpierre — 2024-11-20 01:23:35 UTC

Extreme risk apps cannot be used (BCE)

justinfstpierre — 2024-11-20 01:24:00 UTC

Templates are needed to simplify the request process (CEWA)

justinfstpierre — 2024-11-20 01:27:26 UTC

No documented process for approval until this year (CG)

justinfstpierre — 2024-11-20 01:28:30 UTC

Siloed in different departments with limited visibility (CG/L)

justinfstpierre — 2024-11-20 01:28:49 UTC

An approved technology list exists (in Confluence) but I can't see it (CG)

justinfstpierre — 2024-11-20 01:31:38 UTC

Building an approved technology list now (L)

justinfstpierre — 2024-11-20 01:32:34 UTC

Developing a relationship between tech and education is a big challenge (L)

justinfstpierre — 2024-11-20 01:33:43 UTC

Perpetually educating school staff

justinfstpierre — 2024-11-20 01:33:53 UTC

Make it like putting on a seat belt.

justinfstpierre — 2024-11-20 01:34:26 UTC

The reasons for the risk mitigation are clear

Despite an approved technology list existing and an ED, teachers still don't know about it after 18 months (CEWA)

justinfstpierre — 2024-11-20 01:35:01 UTC

How do you get messaging into schools?

justinfstpierre — 2024-11-20 01:35:15 UTC

How often are we changing people's opinions around existing apps that are approved and have been purchased?

justinfstpierre — 2024-11-20 01:39:24 UTC

No blame culture

justinfstpierre — 2024-11-20 01:47:59 UTC

If there's an element of fear, no one will do it.

Explain why sharing adds value

justinfstpierre — 2024-11-20 01:48:41 UTC

As an example, there's no shame in being the victim of a security event

Be transparent

justinfstpierre — 2024-11-20 01:48:48 UTC

Have a perspective of the end state

justinfstpierre — 2024-11-20 01:49:16 UTC

Consider what you put in the tender

justinfstpierre — 2024-11-20 01:50:34 UTC

Making sure the security perspective is embedded throughout every process. We should all be asking the same thing from vendors

We don't assess from a T&L context, we're looking at security and child-safety (CEWA)

justinfstpierre — 2024-11-20 01:52:22 UTC

The language is really important (BCE)

justinfstpierre — 2024-11-20 01:53:39 UTC

We use a scaling system (Extreme, High, Low). It's all risk related.

It's not our job to approve

Principals are invited to accept or not accept the risk (BCE)

justinfstpierre — 2024-11-20 01:54:02 UTC

Educator ratings around the use of tools would be helpful

justinfstpierre — 2024-11-20 01:55:42 UTC

Add in reviews and ratings around pedagogical use (MACS). Tripadvisor style reviews

Capture what schools are using different applications

justinfstpierre — 2024-11-20 01:56:01 UTC

Right now there's a buy culture to combat (CEWA)

justinfstpierre — 2024-11-20 01:56:41 UTC

There's a risk that people are gravitating towards shiny things

Proactively share recommended applications

justinfstpierre — 2024-11-20 01:57:31 UTC

Look here first (safe, embedded, endorsed)

Consider third-party reviewers

justinfstpierre — 2024-11-20 01:59:04 UTC

Arrow, AusCert, ST4S and others

What about educational effectiveness to compliment security effectiveness?

justinfstpierre — 2024-11-20 01:59:32 UTC

Arrow

Recurring training and security initiatives helps encourage the culture of understanding and planning for security risk

justinfstpierre — 2024-11-20 02:01:14 UTC

BCE lessons learned

2024-11-20 02:04:25 UTC

2023 IT Due Diligence Procedure (policy) published. Helps to support compliance.

Extended responsibility: “IT due diligence is everyone’s responsibility & brought BCE Office into Due diligence requirements.

BCE improved Review processes

2024-11-20 02:05:50 UTC

Problem: BCE has to assess every third-party app & service that is requested, unless totally unsutable. That is unsustainable, need more discernment & selection processes about the selction before apps are requested by schools.

Improved BCE online Request submission form to provide better information to assist triaging of request

Developing templates to streamline & get consistency in Reviews

Creating ways to easily assess ‘potato apps’ low risk but still maintain appropriate mitigatin strategies

Reusability of templates & reviews

IT Due Diligence is for everyone - includes BCE (Head) Office staff

2024-11-20 02:10:48 UTC

Great diversity of applications amongst Office staff using individual third-party apps for their work, without due diligence

Are schools actually using it?

justinfstpierre — 2024-11-20 02:12:43 UTC

Can assessments be completed in a 'reasonable' time?

justinfstpierre — 2024-11-20 02:13:02 UTC

Technologists need to be able to easily categorise apps

justinfstpierre — 2024-11-20 02:13:41 UTC

When technologists can't categorise today, how are educators meant to

Assisting the principal to say yes or no

justinfstpierre — 2024-11-20 02:14:37 UTC

Principals want to be able to consistently use their range of apps that are used by teachers

Monitoring adherence to an approved list

justinfstpierre — 2024-11-20 02:15:23 UTC

How do you ensure that individuals are correctly using an approved technology list?

We don't blacklist apps.... well rarely

justinfstpierre — 2024-11-20 02:15:59 UTC

Principals are too busy to be responsible for deciding about technology risk

justinfstpierre — 2024-11-20 02:17:13 UTC

Everyone from the top to the bottom within the organisation needs to be along for the journey

justinfstpierre — 2024-11-20 02:17:45 UTC

Conflicting recommendations of applications from certain teams within schools that haven't been assessed

justinfstpierre — 2024-11-20 02:18:23 UTC

Vendors are going direct to schools, bypassing centralised channels

justinfstpierre — 2024-11-20 02:18:39 UTC

Usage of technologies that already exist and are approved

justinfstpierre — 2024-11-20 02:19:50 UTC

Set realistic expectations

justinfstpierre — 2024-11-20 02:22:05 UTC

Include 'Have I used this app before?' in the assessment request

justinfstpierre — 2024-11-20 02:22:47 UTC

Make sure requestors do the due diligence first

Where possible, shift the workload to the requestor

justinfstpierre — 2024-11-20 02:23:02 UTC

Knowledge of delegation of authority is unclear in schools (CESA)

justinfstpierre — 2024-11-20 02:25:09 UTC

Principals occasionally sign off agreements that they shouldn't