QR codes have become more common in and beyond education. Teachers use these instead of printed handouts and many are regularly placed on fliers advertising university or school events. So it shouldn’t be a surprise that hackers have begun looking for ways to exploit QR codes.

One way they do this is by hanging fraudulent QR code links in real life or by including malicious QR codes in gifs or as part of fliers sent in emails. Since spam blockers have more trouble recognizing images, and because it's common for school announcements to include QR codes, this is a particular concern for education.

Over the past year, Microsoft Defender for Office 365 blocked more than 15,000 emails per day targeting the educator sector with malicious QR codes. Microsoft highlighted the threat of malicious QR codes in its latest cyber threat intelligence brief, Cyber Signals.

Jay James, the Security Operations Center (SOC) Director at Auburn University, and Corey Lee, Security Chief and Technology Officer at Microsoft, both share tips for ways in which classroom educators, administrators, and students can help limit the threat posed by malicious QR codes.

1. Avoiding Malicious QR Codes: Slow Down

Lee says one important step to avoiding unintentionally opening a malicious link through a QR code is just taking a moment to examine the source of the QR code.

“It sounds cliché, but really slowing down to speed up is one consideration,” he says, adding that he knows it's challenging with everything that is going on for educators during the day, but it’s important to remember. “We think most QR codes are scanned and clicked because things are just so fast-paced.”

2. Apply Lessons From Other Cybersecurity Training

Required cybersecurity training in many educational settings have taught us to recognize potential phishing attacks. James says these same lessons apply to potentially recognizing a malicious QR code.

After you’ve slowed down to assess the source of the QR code, start looking for the same warning signs that might make you suspicious of a link. You might ask yourself, “Is this something I’m supposed to receive?” James says. If the school president or principal doesn’t usually email you, maybe that’s your first sign something is suspect.

You should also ask, “Is this something that I'm getting from a sense of urgency?” James says, since a requirement that the user act quickly is often part of phishing attempts.

3. Report Things You’re Unsure About

As with standard phishing emails, when it comes to QR codes sometimes educators may be unsure of the source. Legitimate emails often seem strange and phishing attempts may look pretty good.

“If you are an educator, faculty, or staff, feel free to report things to your cybersecurity team or your technology team because they would love to hear about it even if it's a false-positive," James says. "We'd rather get more reports than less and clear up any questions that you may have."

4. Evolve Your Cybersecurity Training To Include QR Codes

Lee says some organizations have been using the same cybersecurity training for some time. These trainings need to evolve to focus on the latest threats and/or the latest vectors bad guys use to trick users, including malicious QR codes, which also will continue to evolve.

In addition to updating these trainings, Lee recommends institutions run phishing simulations and provide targeted training. The idea is to test your school community using similar tactics that a bad actor might use. “Then, based on how the user did, we're going to provide them targeted training,” Lee says.

5. Get Students Involved

Awareness training around the potential for malicious QR code use and other cybersecurity lessons should be extended to students as well, both Lee and James say. They also say students can help combat bad actors.

James employs students in his SOC. The students get real-world job experience of the type they might obtain in an internship and James is able to tap into a rich talent pool. He says getting students evolved was "a game changer."

He adds, “Don't underestimate the talent that they can bring to the table to help secure our organizations.”

• Best Free QR Code Sites for Teachers
• 5 Cybersecurity Tips For Schools From CISA’s Deputy Assistant Director

How can schools create the infrastructure that supports the equitable and safe use of technology in schools today -- and in the future? 

During a recent Tech & Learning roundtable, Sandra Paul, director of IT for Township of Union Public Schools in New Jersey, and Rob Dickson, CIO for Wichita Public Schools in Kansas, discussed best practices on how school districts could implement the tools and systems to ensure IT is safe, accessible, and easy to manage. The webinar was hosted by Dr. Kecia Ray and sponsored by Microsoft. 

View the on-demand version of the talk here. 

Access Anywhere and Everywhere  

Providing students equitable and safe access to technology goes well beyond the classroom today. “We've accepted as a society that our kids are going to be multi-medium connectors,” Dickson said. “Before, when we thought about learning, we kept it in the confines of that classroom, or we kept it in the confines of that district.” 

Paul agreed. “When it comes to equity, the biggest thing is we've changed the whole concept of instruction and learning,” she said. “It's no longer boxed into a school district or in the four walls of the classroom. It's gone out into the community and beyond.” 

Education technology leaders now need to think about the tech that is available in each student and teacher’s home and what kind of support the district can provide for effective and secure use of that technology. 

Limits On Use 

In her district, Paul said she provided student access to educational materials but not to everything on the internet. “My whole idea was to make sure that the students get what they need, but also make sure that whatever device they're using has the filtering, or has the ability to give them what they need on an instructional site,” she said. For instance, parents were not able to check their personal emails on a school device. “We had to do workshops for parents that explained a Chromebook is not a laptop, or an iPad, or cell phone,” Paul said. 

Dickson also employs filters on school-issued devices to help keep students and the school’s network secure. However, he will loosen certain restrictions with students and staff members who he knows are knowledgeable about how they are using a given device. “If I've trained a student or a staff member on something, I’ll allow them to go a little bit further than I typically would the standard user,” he said. 

Privacy Concerns 

Dickson discussed how there is more awareness of data privacy in Europe and more restrictions on the way data can be gathered and used. However, more U.S. states are beginning to focus on data and the need to protect data that can be used to identify students – even if it’s not explicitly sharing a student’s name. 

Paul said that leaving student security and safety up to technology directors alone is a mistake and that laws surrounding student privacy and safety need to be updated. Not only do directors have to try and protect student data but they have to help students steer a safe course while using devices that are increasingly controlled by algorithms that might prey on their insecurities by doing things such as reinforcing worries about weight or appearance. “Everybody was in a rush to give out these devices, not realizing that there is a side of it that we need to definitely step back and take a look at because the laws have not caught up,” she said. 

Guarding Against Cyber Attacks 

School IT infrastructures continue to increasingly be targets of attacks from hackers. 

“It's a matter of when not if it's going to happen,” Paul said of cyberattacks. “We, as directors, try to be preventative. We try to educate and inform everyone that's a part of the entire instructional and learning process.” 

In addition to providing advice on how to protect school information, IT directors also try to inform educators about protecting their own personal information. Dickson’s district has moved all staff to two-factor authentication. “That’s non-negotiable,” he said. 

Other Steps Districts Can Take to Protect Themselves 

Paul advised those who are new technology leaders to connect with others in the field. “Reach out to your colleagues in the next district, your next state,” she said. “Reach out and join some national organizations. COSN has been amazing.” 

Dickson is working with other tech directors in Kansas to share best practices and knowledge. “We're going to start creating peer groups where we review one another's processes and procedures,” he said. “There are some things that are very inexpensive that you can put in place to help.” 

In addition, Dickson said that his district is working with Microsoft to help protect student data by providing secure platforms and help the district respond if an incident were to occur. “If something were to happen, let's say a data breach or data leak, I can contact Microsoft and have one of the largest entities in technology in the world helping me to remediate that,” he said. 

• Recent Tech & Learning Webinars

Certiport, a Pearson VUE business, today announces a certification program for secondary schools and higher education in partnership with EC-Council, a global provider of cybersecurity education. Certiport and EC-Council will launch the EC-Council Associate Series certification exams, practice tests, and curriculum beginning in fall 2018 starting with the Ethical Hacking Associate (EHA) and Cyber Forensics Associate (CFA) exams.

Beginning in fall 2018, schools can offer the new EC-Council Associate Series EHA and CFA certification exams with curriculum and practice exams that align to exam content and are easy to implement into existing courses.

[What to do After Your Education System is Hacked]

EC-Council Associate Series certification curriculum is available for review so schools can begin to prepare for the 2018-2019 school year. Visit https://certiport.pearsonvue.com/Certifications/EC-Council/EAC/Overview for more information.

[Minecraft: Kids Learn 21st Century Skills While Building New Worlds]

Choosito

Filter expert-curated sites by grade and subject with safe search tool

Pros: Search safe, teacher-curated sites organized by grade level and subject area.

Cons: While there are more than 150,000 sites to browse, it's still not the same as researching using databases and other tools.

Bottom Line: An easy-to-use tool for safe online searching.

Read more.

App of the Day picks are selected from the top edtech tools reviewed by Common Sense Education, which helps educators find the best ed-tech tools, learn best practices for teaching with tech, and equip students with the skills they need to use technology safely and responsibly.

By Common Sense Education

School security unfortunately remains a popular topic in the Tech&Learning newsfeeds. NBC News looks at industries providing such tech and questions its validity: “These modern tools range from instant background checks for visitors and social-media monitoring software to gunshot-detection sensors and ID cards equipped with panic buttons. They’re driving a rapidly growing school security market, which has ballooned to a multibillion-dollar industry — despite little proof that the new methods prevent violence.” Nevertheless, districts from Buffalo, NY to Connecticut to Michigan continue to invest. What choice is there but to try anything and everything?
—Kevin Hogan, Content Director.

[Gaggle Releases New Student Safety Solutions for Google Hangouts and Canvas]

PikMyKid today announced that it will be offering 1,000 free school licenses for its Kidio Safety Panic Button app. This feature on the PikMyKid platform enables school staff to raise an alarm on any device with one push of a button.

Interested educators can apply for the Kidio Safety Panic Button app by clicking here.

The Panic Button app delivers alarms silently to prevent panic at school. Users can create custom contact groups related to each incident, and protocols are quickly pushed to group participants.

The app sends emergency responders an alert of the event as well as a digital blueprint for the school, providing them with exact layouts. The app also live-tracks the phone, sending continuous positional information of the person who pressed the panic button to emergency responders.

CoSN (the Consortium for School Networking) today announced that the organization is expanding its work nationwide on interoperability in school systems. As part of CoSN’s increased commitment, the organization has received support from the Michael & Susan Dell Foundation to update and deliver additional resources through the Interoperability Standards initiative. In addition, CoSN is partnering with Project Unicorn, a national coalition that advocates for K-12 interoperability, and encouraging school districts to sign the updated Interoperability Pledge.

School systems are struggling to address the interoperability imperative at a level beyond Single Sign-On (SSO) with limited knowledge about the standards. CoSN will develop an Interoperability Toolkit to help districts achieve interoperability beyond early stages like SSO.To learn more, visit: cosn.org/interoperability.

Gaggle announced today the public release of SpeakUp, a safety tipline for K-12 schools.

Because SpeakUp is integrated into districts’ G Suite for Education accounts, students see the SpeakUp email address whenever they start to compose a message.

Messages sent to SpeakUp result in an auto-reply message, which explains how the tipline can be used to report unsafe situations at a school and describes that real people are monitoring SpeakUp. Replies also include a dedicated phone number that students can use for text messages or phone calls.

All SpeakUp messages are routed to Gaggle’s Safety Team 24 hours per day, seven days a week. Trained professionals will alert school officials of unsafe situations and can even contact local law enforcement.

To learn more about SpeakUp, visit gaggle.net.

How do you implement 22,000 Chromebooks in a district with 93,000 students—while giving teachers an easy way to manage the devices in their classrooms? Or allow students to access resources like YouTube safely and productively during the school day?

Teacher’s choice for classroom management, while providing administrators with unparalleled filtering and analytics. Lee County School District in Florida is solving their challenge with an award-winning filtering and classroom management software. GoGuardian gives the district full visibility into how students use their devices, along with a host of tools to make learning safer, more personalized, and productive. More here.

Teach kids valuable digital habits, while keeping them safe inside and outside of the classroom. With this software, educators at Denton ISD in Texas have full visibility into how students are using their Chromebooks. Students can use resources like YouTube safely and productively, and the district can even send real-time personalized messages that empower students to become better digital citizens.

Learn how Denton ISD is teaching digital citizenship—one message at a time.

Personalized Learning in a Large District
Dwayne Alton, Director of IT/Support for the School District of Lee County explains how GoGuardian’s scalable and reliable cloud infrastructure allowed more teacher and student engagement while increasing implementation throughout their district.