References

• Those procedures include non-disclosure of a student's protected information to a third party or any party that is not the student or the student’s parent(s). For instance, a school could not provide student educational information on a resume or recommendation letter without the expressed consent of the student.
• Students also have the right to inspect their school records and any request must be granted within 45 days of receipt. If there have been changes to the student’s file, the student must be notified before those files can be disclosed to future employers or other educational institutes.
• Institutions that do not comply with FERPA guidelines risk losing federal funding (Hlavak & Easterly, 2015).

• Although the school could lose federal funds for a FERPA violation, the court ruled that FERPA “does not give rise to a private cause of action” (Gonzaga University v. Doe, 2002, para. 1).
• The FERPA statute only addresses federal funding and does not offer personal rights under civil rights provisions of FERPA (Gonzaga University v. Doe, 2002).

• Cameras may be requested by any party related to the school.
• FERPA regulations still apply to the release of any video clip.
• Recordings must be retained for three months.

• Schools with zero-tolerance policies should review criteria to ensure that students are treated fairly.
• Policies that could be in violation of state or federal laws also should be reviewed.
• Parental consent rules may also be in violation of federal or state laws.

• Limited access.  Users should not have access to data that is not necessary for their job.  For example, does a classroom teacher need to know the SSN of students in her class?  No.  So the systems that house that data should make sure the teachers do not have access to that particular element.
• Mitigation. This goes along with Limited Access.  IF/When there is a network breach, only specific roles should have access to sensitive data.  For example, if a user's account is the source of a network breach, what becomes exposed is ONLY what that user has access to.  If this is a non-privileged user, they only have access to their classroom data which does not include sensitive data (such as SSN), but only Names and Local ID's. 
• Education.  In 2022, the end-user, without a doubt, is the most vulnerable piece of our security puzzle.  Majority (if not all) data breaches are focusing on the end-user clicking a link, opening and email, etc.  Educating the end-user to recognize illegitimate email messages and other communications is key in preventing network breaches (C. Walker & J. Hendry, personal communication, April 28, 2022).  

• Limit data access to only those who require it for their job. Teachers do not need the social security number or home addresses of students. Do a regular inventory of who has access to critical data and limit access where necessary (C. Walker & J. Hendry, personal communication, April 28, 2022).
• The safest way to protect data is to never collect the data. If specific data is not going to be used, then institutions should never ask for or collect that data (J. Clayton & J. Hendry, personal communication, May 29, 2022). 
• Limiting access rights to users can protect the overall network from potential bad actors. A teacher only needs access to some data regarding their classrooms. Principals only need data for their schools. Limiting access mitigates large amounts of data loss should those individuals get hacked or accidentally release data (C. Walker & J. Hendry, personal communication, April 28, 2022).
• Know your vendors. Make sure that you understand their methods of securing data and that the security they implement is adequate to safeguard data and meet legal requirements for security. Understand that anytime you allow a third-party company to access data, you are putting your data at risk (Elsen-Rooney, 2022).
• Educate your uses – frequently. Sometimes it’s difficult to remember that many teachers and administrators are not computer-literate. Most data breaches come from users clicking something they shouldn’t have, such as a bogus webpage, or a bad link in an email (C. Walker & J. Hendry, personal communication, April 28, 2022). Constant training, education, and online drills are necessary to help teach users the importance of online safety.
• Don’t ignore your infrastructure. An IT administrator should constantly monitor and check servers, computers, and other appliances to ensure they have the latest virus and malware protection updates. It’s much easier to keep holes closed than have to restore data from backups.
• Which leads to backups. Make sure that your off-site backups are stored in a secure location. I worked with a company once that stored their backups at the owner’s home. It was fine until his home was the target of a burglary and the perpetrators walked off with several backups of customer data.