Security Assessments and Penetration Testing
Security Assessments and Penetration Testing: what it means for a student record system, who may use it, and the check to make before it moves.
- Record
- student record system in security controls for student data
- Data
- Security Assessments and Penetration Testing
- Safeguard
- least-privilege access, encryption and access logging
- First check
- Limit the sharing to the minimum the purpose requires.
The short answer
In short, security assessments and penetration testing hinges on one issue: which student record platform is involved, who retains it, and what objective justifies the next step with it. Get those three answers right and most of the rest of the decision follows; miss any one of them and the requirement applied shall be the wrong requirement for the facts in front of you.
Accessibility tools can collect personal information about disability, and their confidentiality review must be as careful as their accessibility review.
Penetration testing finds technical gaps, but it does not test whether a disclosure decision was lawful, and both tests are needed.
The safest test for any proposed sharing is to write it down in one sentence naming the record, the receiver, the objective and the authority, and then to read that sentence back critically.
The record comes first and the rule follows it, and any decision made in the opposite order should be rechecked before it is acted on.
What this covers
Undocumented students face serious consequences from record disclosure, and staff should be especially careful regarding sharing that could reveal status.
Campus card platforms hold transaction and location data, and their retention ought to reflect that sensitivity rather than the convenience of indefinite logs.
Facial recognition on campus raises identification risks that go beyond ordinary photography, and its use needs a documented justification and a review procedure.
Media requests for student information ought to go via the confidentiality officer, not via the first department that picks up the phone.
AI grading tools produce a new record in the form of the grade and the feedback, and that record inherits the protections of the underlying submission.
Audit and evaluation releases must be limited to the audit or evaluation purpose, and the recipient must be bound to that purpose.
How to work through it
Explain redactions in access responses, because an unexplained gap teaches a student that files are edited at shall.
Delete on schedule, and make removal verifiable, because a removal that cannot be shown is a removal that will be doubted.
Scrutinise monitoring in education apps for younger students, because behavioral data grows quietly over a school year.
Limit financial aid disclosures to what the aid decision needs, and do not contain unrelated file details because they happen to be in the same file.
Own every group mailbox membership list, since an unowned list is an access control failure waiting to be discovered.
Safeguard alumni files with the same care as current files, since graduation does not end the institution's duty.
Require verifiable parental permission for younger users, and do not accept a checkbox that anyone may tick as verification.
Support students who retain personal copies of their files, because a student who can track their own file is a student who can spot errors early.
A worked illustration
Consider a survey of younger users on an education platform that collects birth dates for age screening and then retains them indefinitely.
The contract in that illustration names the information, limits use to the college's purposes, bans advertising use, and sets removal ninety days after the contract ends.
Consider a student employee whose employment record is requested as if it were an academic record, and a registrar who distinguishes the two capacities.
In that illustration the merged college reconciles the schedules before migrating data, and deletes files that both schedules agreed had expired.
Consider a vendor that suffers an incident affecting student files, and a college whose contract required notification within three days.
Where guides go wrong
Accepting a vendor's consumer privacy policy as a substitute for a contract is a mistake, because consumer policies describe the vendor's own practices, not the college's purposes.
Auditing releases without verifying the log is a mistake, since a disclosure missing from the log is a finding, not a clerical gap.
Screening younger users by collecting more data than the screening needs is a mistake, because the safeguarding then becomes the problem.
Writing a policy that employees can not state without opening the document is an error, since the policy shall not be followed under time pressure.
Disclosing to a parent on the basis of family relationship alone, without establishing dependency, is an error that recurs every enrollment season.
Sources and evidence on the record
- Family Educational Rights and Privacy Act regulations, 34 CFR Part 99, text on eCFR.
- National Institute of Standards and Technology, Computer Security Resource Center - control guidance used here as method, not as law.
- US Department of Education, Student Privacy Policy Office, studentprivacy.ed.gov - FERPA guidance, FAQs and model notices.
Evidence basis: 34 CFR Part 99 and NIST control guidance used as method Applies when: When a college holds, uses or discloses a student record system in the context of security controls for student data