
Schools and colleges need to focus their available funds on teaching and learning, and in the students within their care. As such it can be difficult to justify significant spending on cyber security. Investing in cyber security is investing in preventing the possibility, a chance, of a cyber incident occurring. The challenge therefore is establishing a way to frame the costs in order to identify what represents good value.
Cyber security is all about risk management. Every risk has a probability of occurring. This might be a 1 in 100 or 1 in 1000 or 1 in 1 million. This is where the difficulties in justifying spending on cyber security arise. For the last 10 years an institution may not have suffered any significant incidents. As such how can the head of their IT justify spending an additional £4000 or £5000 per annum on cyber security? We are working from the point that it is more likely an incident wont happen that it will. Viewed from the point of view of past experience, the institution has been fine for 10 years, with the probability of an incident assumed to remaining roughly the same, so is likely to be fine in the next 10 years, excepting for this small probability. So, stay as is or spend £40,000 – £50,000 over 10 years to provide additional protection just in case? Viewed from this point it may be difficult to justify the spend especially if the overall budget for the school is low.
Let’s take a more mathematical approach to the problem; If we take approximately 25,000 schools in the UK where I am aware of around 20-25 which have experienced cyber incident this year. Let’s assume I am aware of only a small number of the schools which actually experience incidents, say 10%. So, lefts take a probability of 250 incidents per 25,000 schools or 1 in 100. At this point rather than looking at the chance of an incident occurring, we are assuming that an incident is guaranteed to occur within a given period. Taking this probability, in 100 years, every school in the UK would likely have been hit. If hit, let’s make an assumption that the cost would be £250,000 to recover (this is very much a guess figure and would be dependent very much on the size of the school, its type, complexity, infrastructure, etc). Taking the probability of 1 hit every 100 years, with each hit costing £250,000, this means the approximate annual equivalent cost would be £2500 per annum. The cost for the additional protection is looking a little better at this point. All it would take is for the recovery costs to grow to £400,000 or for the probability of a hit to increase to 1 in 62.5 rather than 1 in 100 schools.
For me the key things is to move from a position of looking at the chance on an incident happening, where we assume it is more likely an incident wont occur and moving to a position of “not if but when.” At this point we are accepting an incident is guaranteed to occur within a given time period, but we just don’t know when. With this viewpoint we can start to make a more reasoned judgement on costs. We can also factor in the schools risk appetitive, with a school with a high risk appetite likely to choose to underestimate the probability of an incident while one with a low appetite for risk likely to overestimate.
We very much need to reframe how cyber risk and cyber security investment is looked at. Hopefully the above presents at least one possible way to do this in an easy but yet meaningful way.



I thought I would share some initial thoughts following day one of JISC DigiFest. The event was launched with a very polished and professional pre-prepared video displayed on screens scattered around the events main hall, focussing on the rate of change in relation to technology and some of the technological implications of technology on the world we live in. The launch session also included a room height “virtual” event guide introducing the sessions and pointing you in the direction of the appropriate hall. In terms of the launch of a conference this was the most polished and inspiring launch I have seen albeit on reflection there wasn’t much particularly innovative or technically complex about it.
The keynote speaker addressed the changing viewpoints of different generations of people focussing particularly on Generation Z, the generation which currently are in our sixth forms, colleges and universities. I took away two key points from the presentation. The first was how each generations views were shaped by their experiences particularly between the ages of 12 and 20 year old. Jonah Stillman used thoughts on space as an example showing how Generation X might have positive views focussing on the successes of the moon landing whereas Millennials may have a more cynical view following the Challenger disaster. Additionally, Jonah mentioned movies as a social influencer and how those in the Harry Potter generation may view cooperation and trying hard, even where unsuccessful, in a positive manner. Those born later than this may draw on another series of films, in the hunger games, resulting in a greater tendency towards competition and the need to succeed in line with the movies storyline of everyone for themselves and failure results in death. The second take away point from the session resulted from the questioning at the end of the session around what some saw as the absoluteness of the boundaries between generations. I think Jonah’s use of the word “tendency” addressed this concern in that the purpose of the labels was for simplicity and to indicate a general trend and tendency rather than to suggest that all people born on certain dates exhibited a certain trait. It increasing concerns me that this argument keeps coming up when surely it is clear that there is a need to use simplistic models to help clarity of explanation and that no model, not matter how complex will ever truly capture the real complexity of the world we live in.
As we use more and more cloud services, internet access and school internet provision becomes critically important. Due to the critical nature of internet access, when looking at Internet service provision, firewalls and core switches, the two main focal areas I would consider are doubling up where finances allow or carefully examining the service level agreement along with any penalties proposed for where service levels are not met. In the case of firewalls and core switches, cold spares with a lower specification may also be an option to minimize cost but allow for quick recovery in the event of any issue. When looking at the SLAs of providers in terms of their support offering for when things go wrong consider, is it next business day on-site support or return to base for example and how long their anticipated recovery period is.
In the case of edge switches and Wi-Fi Access Points we are likely to have large numbers especially for larger sites. I would suggest that heat mapping for Wi-Fi is key at the outset of a Wi-Fi deployment, in making sure Wi-Fi will work across the site. In looking at resiliency for when things go wrong my view is an N+1 approach. This involves establishing a spare or quantity of spares based on the total number of units in use and the level of risk which is deemed acceptable. High levels of risk acceptance mean fewer spares, whereas a low level of risk acceptance may lead to a greater number of spares.
Cables break plus various small animals love to chew on cables given half a chance.
I have been planning to post on IT strategy in relation to some of the areas which I believe need to be considered. Initially my thought was for a single post covering a number of different points, some being obvious and some less so obvious, however as soon as I started writing it became clear that each point could be a post in itself or would result in a really long single post. As such I decided to undertake a number of separate posts of which this is the first:
I remember someone telling me that IT is the 3rd most expensive thing in a school after staffing costs and the cost of the building and school estate. With such a large part of a schools finances invested in technology it is important to make sure that we are getting value. Now I note my use of the word “value” as opposed to impact; This is due to impact being often associated with examination outcomes. In my view this is a narrow view on technologies potential within education. Exam results, for example, don’t provide a measure of the positive effect which technology can have to a student with Asperger’s who previously found it difficult to interact with the classroom discussion but now can do so easily via an online chat facility. For me value suggests a broader classification which might include using technology to engage a particular student who previously wouldn’t or couldn’t access learning, like in the above example, it might include introducing new experiences to students which were either difficult, dangerous or costly without tech or it might be using technology to bring about new more efficient processes for teachers such as dictation of feedback, etc. Value is much more diverse and also context specific than exam results. Seeking value in our technology should be a key objective in all technology decision making but mustn’t be confused with cost cutting.
