Simulating Walled Gardens with G Suite Sharing and Directory Settings

-
As I mentioned in a post several months ago, the school district I work for recently underwent an audit specifically focused towards G Suite domain configuration in a K-12 setting.  I would like to give a quick shout out to Amplified IT, it was a great experience to work with a company so familiar with the unique needs of an educational institution.

As with the results and recommendations of any audit, there is a process for evaluating and prioritizing the remediation response.  A significant consideration in any school district is the ability to maintain safety for kids with the least possible adverse impact on the educational environment.  Below I will detail a couple specific changes made to our G Suite domain as part of our effort to simulate "walled gardens" for our younger students.  Please keep in mind, this is by NO MEANS an exhaustive list.

Specific service sharing settings for our primary and intermediate student organizational units (Pre-K through 6th grade) were verified and/or adjusted for several applications.
  • Calendar Sharing Settings 
    • External sharing defaults set to a maximum highest level of "Only free/busy information".
    • Internal sharing defaults set to "No sharing."
  • Drive Sharing Settings
    • Sharing outside the school district domain restricted to "whitelisted domains."
    • "Allow users in OU to receive files from users outside of whitelisted domains" checkbox de-selected.
    • Access Checker set to "Recipients only."
    • Distributing content outside set to "No one."
  • Google Takeout
    • Turned off in additional services for both primary and intermediate student OUs. 
Additional changes were also made to Directory settings to implement and configure custom directories.  Google groups were created based on OU membership, effectively creating groups of students based on grade level.*  Custom directories were created and applied to limit auto-population when sending emails or sharing files.

There is no way to eliminate all risk in any internet connected environment.  Instead, we must attempt to ensure the safety of students while still providing a technologically relevant learning experience.  Always remember who you are working with, and who you are working for, when determining your priorities.


*If you would like read up on the automation processes used to keep these groups current, check out the GAM project on GitHub.

Comments

Post a Comment

Popular posts from this blog

I taught myself a thing today

-
My job was created as a response to communication issues between two different school district departments.  Basically, the curriculum department and the tech department needed a translator and someone to manage the systems that were solely the responsibility of the curriculum people (read: programs that were purchased to be integrated without understanding the work load or taking into account the capacity of the tech department). I love my job.  I declared myself neutral territory and put up my own "flag" in my office.  I also get to learn about all the things.  Today, I learned about cron jobs. Automated jobs and/or scheduled tasks are not an unfamiliar concept for me.  However, Linux is not something I've spent a lot of time with.  I do have administrator access to the server where we house all that automation, but "break everything" wasn't on my to-do list for today.  Instead, I installed an Ubuntu 18.04.01 virtual machine to poke at.  Then I dug out
Read more

No, You Don't Need That Highlighter App (A discourse on Google for Education and FERPA)

-
As educators, parents and students around the world struggle to rapidly adapt to our changed environment, now seems like a good time for a reminder that it's ok (even necessary) to slow down and evaluate our technology adoptions.  As such, I'm taking this opportunity to review some points about Google Apps for Education (GAFE) and FERPA compliance. The G Suite Terms of Service for Education Agreement is not a terribly long document, it totals out at just over 12 pages.  When a school district signs up to use Google Apps for Education, someone authorizes this agreement.  In it, Google asserts that they will act as a "school official" with regards to the data they receive.  There are two very important things to remember about this agreement however: This agreement applies to Google's Core Services and does NOT apply to additional services (explicitly noted in the GAFE privacy policy .) It is still the responsibility of the district to configure the G Suite
Read more

Synthetics monitoring with New Relic for PowerSchool products

-
Beginning August 2018, the school district I work for rolled out a new Learning Management System, PowerSchool Learning, for use by faculty, staff and students.   While our primary Student Information System (PowerSchool SIS) is housed on-premises, the learning management module is hosted by the vendor.   One of the concerns brought to my attention prior to the rollout was monitoring i.e. what kind of notice were we to expect during outages, and how could we most effectively communicate that to all effected parties.   So, to start with we needed an effective way to verify that a client could log in to the self-hosted SIS, then navigate through to the offsite-hosted LMS.   While there are many monitoring products out there, and many are very good at what they do, we eventually settled on using New Relic Synthetic Monitoring.   The primary considerations for that were as follows; the scripted browsers are easily configurable, the built-in tracking for Service Level Agreements, and
Read more