Despite some concerns about security, more K-12 schools are turning to cloud computing for their storage and application needs
By Jennifer Nastu
September 30th, 2011
Editor’s note: This Publisher’s Report was sponsored by CenturyLink.
Is cloud computing secure? That’s a question many ed-tech leaders have been asking as they’ve considered moving applications to the cloud. And the answer many are finding is: Yes, it is.
Despite concerns about security, more K-12 schools and districts have begun to move toward cloud computing solutions over the past few years. According to a 2011 Cloud Computing Tracking Poll by technology solution provider CDW-G, 83 percent of K-12 organizations already have used at least one cloud-based application, and 27 percent are currently implementing or maintaining cloud computing.
Cloud computing—a model for enabling convenient, on-demand access to a shared pool of configurable computing resources, such as networks, servers, storage, applications, and services, that are hosted by a third-party technology provider and delivered to users through the internet—is an approach that is attractive for education, because it allows K-12 organizations to scale and grow without having to own the technology, says Martin Capurro, senior director of product management for cloud services at CenturyLink (formerly Qwest).
“Cloud computing is a pay-per-use service,” Capurro says. “It’s seen as an easier way to meet budgets. The educational community has been quick to adopt this technology.”
Benefits of tapping the cloud
Cloud computing can be seen as offering three distinct services: Infrastructure-as-a- Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). Schools can use any or all of the three, but using the cloud for hosted applications (SaaS) such as messaging, eMail, and creating sites for sharing and other social environments is particularly relevant for education and is a natural starting point, according to Capurro.
Despite concerns about security, more K-12 schools and districts have begun to move toward cloud computing solutions over the past few years.
“Say a teacher has a lesson plan or assignment. [With cloud computing], she could post assignments to a common site, use a calendar function to lay out what the assignments are, [and] use document sharing so kids can upload their homework,” Capurro explains. “In the business world, we live by our calendars. That technology now can be used by lesson planners, by teachers, to better communicate their expectations to a broader group of students, who can review it at home. That can be extended to parents, too, who can verify it [and] see exactly what the student is supposed to be doing. This helps utilize parents to drive behavior from students.”
Using the cloud in this way also can allow students to partner with one another in an online environment so that, if they are unable to gather together in person to complete a task, they can work together online using video chat, for example, in a way that allows for true collaboration.
Fifty-seven percent of K-12 organizations that are using cloud computing use Google Docs, according to the CDW-G poll, followed by 39 percent that use Gmail and nine percent that use Microsoft Office Live Meeting.
Apps like these are the quickest and easiest way to make use of cloud computing, and those such as Gmail and Google Docs are free to use. “I can’t think why you wouldn’t want to use them, and these are the first things schools think of,” says Rich Kaestner, a project director for the Consortium for School Networking (CoSN). In fact, across all organizations that took the CDW-G poll, 73 percent of current cloud users implemented a single cloud application as their first step.
Then there’s the fact that with cloud computing, schools do not have the initial upfront cost of hardware and the ongoing support expense. “There is still the necessary expense of administrative support, but some of that second-level expertise for given applications will reside with the cloud vendor,” Kaestner says.
Because the education sector is seasonal and experiences peaks and valleys in terms of usage, it makes sense from a budget standpoint not to have to own some of these technologies and therefore not to have to pay for them 24 hours a day, seven days a week, says Capurro. Cloud computing also can save schools money because they only pay for those applications they have deployed.
Schools also are looking at cloud computing as a way to create economies of scale, points out David Cottingham, senior director of managed services for CDW-G. Because schools typically don’t compete against each other, they can work together to bring down costs on a large scale by using the cloud not just for applications but for networks, servers, and storage, helping rid districts of rooms filled with server racks that require costly cooling.
Schools in Illinois, for example, have banded together to share technology systems at a fraction of the price schools would pay on their own. IlliniCloud is a nonprofit cloud-computing consortium for Illinois schools that provides affordable access to virtual servers, online storage, and high-speed network connectivity across the state (see sidebar). Sharing data center resources and costs among schools allows schools to focus more of their IT budgets on the use of technology in classrooms, for the direct benefit of the students.
“By working together to maintain technology in the cloud, organizations can spend less time in the data center and more time delivering on their core mission,” explains Thomas E. Richards, president and chief operating officer of CDW-G.
Using the cloud also means schools can get an application up and running quickly and inexpensively. “You don’t have to worry about bringing it in, testing it … You’re just hooking onto it, so it saves upfront planning and time,” Kaestner says. “I don’t have to go out and buy a server to get this application running. It’s running in the cloud. All I have to do is attach to it.”
Schools are considering cloud computing for the same reasons businesses are; that is, they are trying to find the most efficient way possible to spend their IT dollars. “And schools are saying, ‘For those applications I have deployed, I am saving money,’” says Cottingham.
In fact, according to the CDW-G poll, 84 percent of all organizations using cloud computing say they have reduced their annual costs by moving applications to the cloud.
Cloud computing also can save schools money because they only pay for those applications they have deployed.
Security still a concern, but that’s changing
Despite the obvious benefits of cloud computing, many school districts remain hesitant to move more confidently to the cloud because of fears of security breaches.
Across all organizations that took the CDW-G poll, security was the top roadblock in moving to the cloud, with three specific concerns being cited most often: “My organization’s management does not trust the cloud’s data security” (cited by 53 percent of respondents); “We (IT management) do not believe the cloud is as secure as our own facility” (40 percent); “My organization’s users do not trust the cloud’s data security” (36 percent).
When technology is housed outside the walls of school buildings, people automatically begin to worry. They think, “If I can get into the system, someone else can hack their way in,” says Kaestner.
“Security is the No. 1, first objection people raise when they look at cloud computing, especially when looking at the public cloud,” he says. “It is a legitimate concern.” On the other hand, he says, the major vendors that offer services in the cloud understand that security is a concern and have security provisions in place. CenturyLink, for example, offers security baked into its cloud solutions.
CenturyLink has an advantage in this space because it already owns much of the network, says Capurro. “We approach cloud computing as nothing more than taking computing and storage solutions and delivering them over networks. We own a lot of the network, and now have taken the computing element and the storage element and have integrated them,” he says. “Because we own and operate both cloud elements and the network, we can ensure the cloud will work a certain way, and that’s pretty compelling.”
For background about CenturyLink’s recent merger, click here.
All security applications, such as anti-virus and anti-spam filtering, are integrated directly into the CenturyLink service. This security happens in the background and can be provided at a school level or on an ad-hoc basis, Capurro adds.
Cloud computing is entirely about how organizations choose to manage their risk. CenturyLink works with organizations to decide what applications and technologies they want to operate in the cloud and what technologies they’d rather host on site, on their own servers. Then, the company looks at the network and ensures that compliance is taken care of. Security is decided on a case-to-case basis, says Capurro. He adds that CenturyLink works with partners such as equipment, software and service providers who are like-minded on security issues and who have added skill sets to bring to the table.
Capurro points out that the cloud is not uniform, and there are private, public and hybrid clouds. The public cloud is delivered over the internet, but what some businesses have done to address the security issue is to bring the cloud into their own organization and create a private cloud. CenturyLink also helps organizations form what is known as a hybrid cloud, which combines the controls and security of a private cloud with the cost-effectiveness and flexibility of the public cloud.
“We do that by attaching it to our network. The hybrid cloud is a real linking of the data center to the public cloud and doing it in a secure manner,” says Capurro.
While there is plenty of rhetoric around security, much of it is being driven by people simply because they can’t see, feel, or touch the cloud, he says, adding that there really aren’t many issues that can’t be overcome.
“Security is the No. 1, first objection people raise when they look at cloud computing, especially when looking at the public cloud,” he says. “It is a legitimate concern.”
One approach schools are taking is to have a single sign-on that is backed by identity management. In order to get to any application, students or faculty members must log into their account and arrive at a “portal page,” which then lets them access only the applications that they are authorized to use—whether these exist in the cloud or within the school, Kaestner says.
CDW-G’s Cottington adds that service providers understand the security concerns of schools. He urges school leaders to make sure their cloud providers’ security expectations coincide with their own.
Some advocates for cloud computing argue that it’s even safer than the traditional model of having schools host their own software and services, owing to the centralization of data and the fact that cloud providers are able to devote significant resources to security issues which, often, customers themselves cannot afford.
Steps that K-12 organizations can take to secure data in the cloud include:
- Encrypt transmitted data.
- Manage access to cloud applications by staff.
- Change passwords at least every 90 days.
- Implement intrusion-detection technology.
- Monitor and apply daily hardware/software patch releases.
- Certify all security measures taken by cloud vendors.
- Provide annual structured information security training for all employees.
How to make the shift toward cloud computing
For schools that are making limited use of cloud computing, or for those that haven’t tried cloud computing yet, but wish to begin doing so, there are a few considerations to keep in mind.
After jumping into cloud computing with the most basic apps like Gmail or Google Docs, begin to consider what makes sense to run locally and what makes sense to run in the cloud, suggests Kaestner. Ask yourself: How do I pull it all together and provide it as a service to users? A strong cloud vendor can help with these decisions.
Another consideration, says Kaestner, is that, in order to access the cloud, you must have enough bandwidth between schools, so you have to look at your communications network infrastructure to make sure it can handle the demand. “That’s one of the things that will maybe slow folks up,” Kaestner says.
Cottingham suggests that schools begin to move toward cloud computing, but not without a written plan. “That applies to any IT project, and the cloud is no different,” he says. “Identify economic benefits [and] security concerns. Identify a select application in a department where you want to pilot something, do it in a thoughtful way with a service provider who can walk you through it, then take it department-wide and then organization-wide. Make sure you see the cost savings you thought you’d see. It has to be done in a thoughtful way.”
Cottingham notes that, according to the CDW-G survey, a high number of schools are testing some cloud-computing applications, a lower number are actively using cloud computing and a fair amount—31 percent—say they have a written plan for how they will use cloud computing in the future. Others are in the stages of discovery (37 percent), planning (28 percent), implementing (18 percent), maintaining (nine percent) and not considering (eight percent).
“Both the ‘implementers’ and the ‘maintainers’ have been able to identify some cost savings, so they do see a significant portion of their IT budgets being spent on cloud computing down the road,” he says.
The CDW-G survey makes some suggestions for organizations considering a move toward private and/or public clouds.
For consideration of private clouds, remember that:
- IT governance is mandatory, ensuring cloud efficiency and stability.
- Building your own cloud might be more time-consuming, heavy on scripting requirements and costlier than an automated, integrated, validated solution.
- Building a private cloud is similar to becoming a cloud hosting provider.
For consideration of a public cloud:
- Get to know your provider. Ask: How secure is your cloud, and can I audit it? Do I get a rebate if the cloud goes down? Will I have a services dashboard? Does my service have recovery built in? How will I connect to the service? Will my capacity scale for my needs? Will the solution be more cost-effective than what I have today?
- Remember: Independent software vendors will bring new features to market faster with cloud applications.
- Understand your “cost to serve” per application to determine your return on investment (ROI) for public cloud solutions.
Jennifer Nastu is a freelance writer from Colorado who writes frequently about educational technology.