Ouray School R-1. Information Technology Internal Audit Report. January 2016

Transcription

1 Information Technology Internal Audit Report January 2016 Ouray School R-1

2 Executive Summary In support of the FY2015/16 Internal Audit Plan, a review of the information technology (IT) process was conducted in the Fall of The IT department is responsible for setting up and supporting IT operations at the Ouray City School R-1. The department is responsible for the School s student terminals, servers, printers, data closet, and typical back-office IT operations. This is the first annual IT audit for the Ouray School R-1 that I am aware. The purpose of the Internal Audit is to provide school management findings and recommendations to improve overall efficiency and effectiveness within their IT operations. Although some steps have been made to remediate past issues (i.e. connectivity, infrastructure, etc.) A heavy focus needs to place importance on establishing a strong IT governance structure. Ouray School R-1 continues to work towards establishing leading practices within the IT operations. However, during course of this IT internal audit, talking with Ouray School R-1 Staff the following improvement opportunities were noted, in descending priority: Outdated or Lack of IT Policies and Procedures In efforts to remediate the findings of this IT internal audit, the Ouray School R-1 IT department recently began reviewing the need to create IT policies for both staff and students. Topics included administration privileges for staff on the servers as-well-as policy on use of student iphones, Bring Your Own Devices (BYOD) by both student and staff. However, many of the these proposed policies are still in developmental stage and have not yet been reviewed and approved by management. Incomplete IT Risk Assessment- A detailed risk assessment of the IT environment has not been performed. Insufficient user skills or testing student user skills are varied and inconsistent among similarly situated users without a method to test proficiency. Consistency in the network The infrastructure upgrade in 2014/15 helped considerably in the reliability of the network. However, software reliability and consistency in the platform needs addressed. Mac Lab Currently the MacIntosh machines available to the students reside in the KURA radio room. The Mac platform is an important part of learning necessary IT skills to be competitive. Cloud Services Currently all servers reside in the electrical closet and maintained on site. Cloud servers provide flexibility and reduce IT costs.

3 Background Information Audit Objectives The main objective of the audit was to verify that the IT infrastructure is appropriately safeguarded and that data reliability and accuracy are maintained within the environment so that students and staff can use the IT infrastructure to further educational objectives. The specific audit objectives were: Observe staff/student usage of IT resources Listen to concerns from staff/students regarding the resources available Assess the overall IT function to determine whether sufficient resources and skill sets have been appropriated to support the technology requirements Evaluate whether appropriate access has been granted to the network and selected staff and applications Validate whether databases are sufficiently backed-up and whether back-ups are restorable Confirm that staff /students follow IT general computer controls Scope This audit performed was designed to evaluate the current state of the IT function and how the staff/student interacted with the resources available. Statement of Auditing Standards This internal audit was conducted from October 2015 to December 2015 while setting up 3 new servers running Windows Server 2102r2 and deploying resources to the staff/student Findings, Observations, and Recommendations Summary of Findings and Related Recommendations The section below provides details regarding the audit findings and recommendations for moving forward with the IT function at Ouray School R-1. Statement on Technology Audit Remediation In 2014/15 significant upgrades were made to the wiring, switches, thin-clients and wi-fi throughout the school building coinciding with planned general improvements to the building. This made infrastructure to the network much faster and reliable setting the groundwork for deploying tools to the end user that are effective and reliable. Management has made completion of all outstanding IT infrastructure and operational goals a high priority during the current year within staffing and budget constraints.

4 IT Policies and Procedures It appears that policies and procedures for the IT function are sporadic and need developed and updated. Recommendation: It is suggested policies should be created and implemented by the IT committee that include but not limited to: Determining how Administrator privileges on the network are disseminated. Bring Your Own Devices (BYOD) Student iphone usage Deployment of software and resources that satisfy set outcomes Procedure for software upgrades including proper channels for deployment Use of and terminal servers/roaming profile Disaster recovery and securing the integrity of the server data Deployment of school owned laptops Develop a student/teacher agreement IT Risk Assessment Currently incoming and outgoing (i/o) traffic from the Internet is filtered thru iboss, a secure web gateway platform. Each server is equipped with ESET Endpoint Antivirus but is not all machines are configured for cloud or off site backup. Just mission critical servers. Recommendation: Segment the network isolating mission critical servers from high volume servers. Deploy off site backup in a hurricane proof-multi redundant data center to aide in disaster recovery. Limit connectivity from BYOD to dedicated media lab segmented from the main network. Insufficient User Skills In order to meet educational outcomes for IT skills, students must have standardized skill sets needed for successful academic and professional careers. This includes manual skills like typing proficiently to application of learning principles across software platforms. The injection of technology in every aspect of life as young as kindergarten students that remain malleable to technology will succeed. Recommendation: Since IT skills are critical to today s educational goals, set outcomes should be deployed for students at every grade to ensure proficiency. Exit exams should be developed for student s exiting fourth and eighth grades that demonstrate a student s ability to perform critical computer and educational objectives. Consistency in the Network Platform The most recent servers deployed operate on Windows Server 2012 r2 while the remaining servers on the network operate on Windows Server 2008 r2 or older. Windows Server 2016 is expected to release Q and is developed concurrently with Windows 10. Dee James is currently pilot testing Windows 10 in a lab environment. Recommendation: Since a major upgrade for the server software is on the horizon, and Windows 10 already released it would be advised to develop a timeline to adopt both operating systems. Windows 10 for the end users and Windows Server 2016 for the administrators. These two operating systems were designed together and would be the platform for delivering software to the students in a modern and consistent manner.

5 Introduce the Mac Platform Sean Hart has been working on funding and has received The Massard Trust and the Western Colorado Community Foundation have awarded Ouray School R-1 $1500. There are currently 6 Macs on campus for student use that reside in the KURA radio room. Recommendation: Integrating MacIntosh computers and the OS X operating system would offer students an easy to use, efficient platform that features a very friendly user interface. It s important to have a plan, timeline and goals for deploying any new platform into the school environment. Although it s not practical to deploy Macs school wide, it is prudent to use them for creative educational purposes and preparing students for the workforce. Introduce Cloud Computing Currently all servers are located in the basement electrical closet of the Ouray School R-1. Software is purchased or licensed and installed on the machines for deployment to the staff/ students. Recommendation: Cloud computing offers numerous advantages and cost savings compared to the current model at Ouray School R-1. It would be recommended that the tech committee determine the appropriate grade level to migrate from on site servers to cloud computing. DEFINITION of 'Cloud Computing' A model for delivering information technology services in which resources are retrieved from the internet through web-based tools and applications, rather than a direct connection to a server. Data and software packages are stored in servers. Benefits of Cloud Computing include but not limited to: Achieve economies of scale increase volume output or productivity with fewer people. Reduce spending on technology infrastructure. Maintain easy access to your information with minimal upfront spending. Pay as you go (weekly, quarterly or yearly), based on demand. Increase off campus access. Staff/students can access the cloud, provided they have an Internet connection. Streamline processes. Get more work done in less time with less people. Reduce capital costs. There s no need to spend big money on hardware, software or licensing fees. Improve accessibility. You have access anytime, anywhere, making your life so much easier! Less personnel training is needed. It takes fewer people to do more work on a cloud, with a minimal learning curve on hardware and software issues. Minimize licensing new software. Stretch and grow without the need to buy expensive software licenses or programs. Improve flexibility. You can change direction without serious people or financial issues at stake.

6 Conclusion Addressing the human issues first. As he surveys the K-12 environment and progress that it s made on the technology front over the last decade, Krueger said it s not the equipment, hardware, or software that s blockading future progress it s the people. We have a long-standing belief that the biggest impediment to effective use of technology isn t technical or technological; it s people, said Krueger. We ve spent the last 20 years asking, Why should we invest in technology? but now we re seeing more people asking, How can our technology make a catalytic difference in the learning environment? That s a whole different conversation. For example, it s not enough to buy 5,000 devices for a one-to-one program and expect teachers, students, and parents to pick up the equipment and start using it effectively in or out of the classroom. So many one-to-ones have failed due to improper vision and purpose; we need to learn from these missteps and improve for the future, says Krueger. Going one-to-one is awesome, but good teaching and learning drive the process not the technology or the device. It s important that the students at Ouray School R-1 remain malleable through out their educational careers. Students that can adapt to changing OS platforms and software will be able to apply their education far more effectively than students that learn to use technology as a crutch. For example, a student should be able to format and write a simple business letter at the high school level without depending on a template from Microsoft Word to lay it out. That student should use technology to make the process faster and more efficient than say using a typewriter.

7 Appendix A 21 education technology recommendations for 2016 Here s what the Education Department recommends, in our own words: 1. Create an anywhere, anytime learning environment that s equally accessible to all students. 2. Incorporate learning science design principles into ed tech resources. 3. Work backwards so that learning technology resources and methods lead to the desired student learning outcomes. 4. Design a rubric that helps educators determine which learning resources work for their students so that all of them have an equal opportunity to access the resources. 5. Build learning communities of various stakeholders who can evaluate and provide access to instructional materials. 6. Help develop incoming and long-time educators with professional development designed to encourage their use of technology as they improve student learning. 7. Provide online instruction for students in subjects that they may not be able to access at their home school site. 8. Train educators to teach in blended and online learning formats. 9. Establish technology competencies for teachers and professors. 10. Connect strategic planning initiatives across various education levels as educators try to improve learning with technology. 11. Collaborate with various stakeholders to set a vision for technology-enabled learning. 12. Use openly licensed content and figure out how to sustain technology purchases. 13. Pull together communities of practice for education leaders. 14. Revamp privacy practices and policies around sharing assessment data. 15. Develop dashboards and other systems that give stakeholders access to assessment data. 16. Try out a system to make better assessments across academic disciplines. 17. Research the effectiveness of interactive assessment technologies. 18. Set up equitable high-speed broadband access and wireless connectivity at school, making sure that students can also access these resources at home. 19. Figure out how to make sure every student and educator has enough tech tools to learn. 20. Draft sustainable funding plans for mobile devices and wireles access. 21. Track connectivity, device access and use of openly licensed educational resources throughout the country. Source: