It’s undeniable—the Google Chromebook has played a huge role in making digital learning accessible to K-12 students everywhere. Now, through the implementation of 1:1 technology in schools, young learners have access to a seemingly infinite array of learning apps, communication tools, and online resources.
This is a huge win for schools. However, without proper measures in place, students can easily abuse their assigned district devices or look for security loopholes. Not only does this result in damaging the devices themselves, but it causes your students to compromise sensitive data and put themselves at risk.
In order to ensure the safety of your student Chromebooks and—more importantly—your student body, we’ve provided an actionable list of security measures your school district can take.
How safe is Chrome OS?
Before we dive in, we need to answer an important question: How safe is Chrome OS?
The short answer is, very safe. After all, a study from EdWeek in 2018 found that 60% of school districts in the U.S. deployed Chromebooks, with Windows coming in second at around 20%.
The overwhelming adoption of the Google Chromebooks in K-12 Schools is a direct result of their outstanding security features. For starters, Chrome OS does not allow its users to install 3rd-party software on their devices (e.g. Adobe Flash, Photoshop, etc.). This protects students from potentially downloading unauthorized programs or malicious viruses from an email attachment.
Other Chrome OS security features include:
- Guest mode: Guest mode offers more than just casual web browsing. In guest mode, users cannot download any web apps or bookmark web pages. Then, Chrome OS erases all activities after logging out, such as browser history, cookies, and any downloaded files.
- Easy file encryption: In the unfortunate circumstance that a student loses their assigned Chromebook, you’re in luck. Even if someone removes the solid-state hard drive, all files are encrypted automatically.
- Sandboxing: In Chrome OS, every website and application runs independently of one another. This is called “Sandboxing”. So, if a student were to accidentally open a web page that contained a malicious virus, they can simply close the affected browser or tab to keep their device safe.
- Verified boot: Sandboxing is a huge perk, but what happens when a student’s device does get infected? Just shut it down. Each time a student turns on their Chromebook, Chrome OS automatically updates to the most recent version of the operating system and removes any discrepancies, such as dangerous malware.
- Automatic updates: With Chrome OS, security updates are automatically applied, meaning less work for your IT team and safer browsing for K-12 students.
- Powerwashing: If all else fails and a student Chromebook is compromised, you can “powerwash” their device (A.K.A. a factory reset). A “powerwash” completely wipes a Chromebook’s hard drive and installs a clean copy of the current version of Chrome OS. As long as students make sure to back up important, personal files in the cloud, a “powerwash” will have no negative impacts on your students’ ability to complete their school work.
The Google Chromebook is a cheap, powerful, and incredibly safe workhorse of a laptop, right out of the box. Now, let’s walk through some steps your K-12 IT team can take to make sure it stays that way.
Manage the apps and extensions allowed on student devices
Between the internet and the Google Play store, students can easily search and download all different kinds of Google apps and online resources. But where do you draw the line? Without supervision or set boundaries, your district Chromebooks could become filled with dozens of Google programs that simply take up space.
Google has an answer for this. K-12 IT teams can use the Google admin console to easily manage student Chromebooks and filter out unwanted educational apps or Chrome extensions—sorry kids.
Within the Google admin console, go to the “Set Chrome device policies” page. Then, navigate to “View and configure apps and extensions”.
From here, you can set policies for, add, view, and remove apps and extensions from your students’ Chromebook devices.
Go the extra mile with web filters
Chromebooks allow Chromebook users to engage with thousands of educational resources and interactive learning tools. However, with a few clicks, your students could end up on a dangerous or unauthorized site as well. So how do you make sure students are browsing safely?
Chrome OS is an incredibly secure operating system, but web filters provide vulnerable student devices with an extra layer of security. The GoGuardian Admin solution is a popular web filtering option that school districts can use to protect students from harmful content and eliminate unwanted distractions.
However, there are other functions within the Google admin console that K-12 IT teams can take advantage of without having to purchase additional software. Within the Google Chrome Enterprise Help knowledge base, go to the “Allow or block access to websites” page.
From here, you can see all the steps required to allow access to, block, and define exceptions to specific URLs for Chrome OS devices in your district.
Important Note: Be sure not to block too many URLs. It’s important to communicate with teachers and staff to identify which URLs need to stay accessible for educational purposes.
Standardize Chrome browser settings for your district
If you’re a Chromebook school district, chances are that you’ll also be using the Google Chrome browser (Google cloud, Google docs, Google drive, etc.). If that’s the case, you can standardize browser settings for every student device in your district to ensure that students are able to explore the web safely in school or at home.
There are a few different ways to customize the Chrome browser for your students.
If you’re a Google administrator, go to the Google Admin console and navigate to the “Set up Chrome Browser user-level management” page. From here, you’ll be asked to complete the following three steps:
- Turn on Chrome Browser Management
- Force users to sign in to Chrome (optional)
- Set user-level policies in your Admin console
Setting user-level policies will give you, and other Google admins in your district, the ability to standardize Chrome browser settings across all your assigned student Chromebooks. However, for greater control, you can review the different Chrome policies available within the Google Admin console.
Each Chrome policy has its own order of precedence. Take the time to learn about Chrome policy management and choose the settings that meet your district’s needs.
Policy management works great for school IT teams, but what about parents who want to monitor their kids’ browsing at home? To control the browser settings on an individual Chromebook, go to the Menu Page > Settings > Privacy and Security > Security. Voila!
Within the security page, you can:
- Disable prediction services so pages load more quickly
- Allows sites to check if you have payment methods saved
- Enable a “Do not track” request with your browsing traffic
- Enable safe browsing
The Chromebook’s ease of use allows parents and guardians to manage their student devices outside the classroom, so kids can explore the web freely and avoid unnecessary security risks.
How to secure lost Chromebooks
Kids lose things—it’s inevitable—and their assigned district Chromebook is no exception. However, if a student happens to misplace or lose their device, there are several security measures you can take.
To meet these challenges, your IT team can use Chromebook Management Software or the Google Admin console to remotely lock, disable, or deprovision a Chromebook device at any time. From here, users can also access additional device insights, including:
- When a Google device was originally enrolled
- The last time a policy sync for a device occurred
- Any recent users who have logged in to a device
You can learn more about securing lost devices in the Google Chrome Help Center. From here, you’ll be given step-by-step instructions on how to properly lock an individual student device or wipe it of its user data entirely.
Incorporating your School IT Help Desk
The sections above prove that Chrome OS is, by far, one of the safest operating systems school districts could use for digital learning. However, when something eventually does go wrong, students, parents, and teachers will have to submit an IT help request.
No more dropping by the office or stopping IT staff in the hall—school help desk software gives your entire district a central platform to ask for IT support.
Within school help desk software, K-12 IT agents can quickly deliver support to student Chromebooks. IT agents can:
- Approve specific URLs for Chrome OS devices
- Lock, disable, or deprovision a Chrome OS device right from a help ticket
- Use MDM and SIS integrations to deliver support without juggling between platforms
School help desk software also provides several benefits for parents and guardians as well. After submitting a help request for their child’s Chromebook, parents and guardians can start a chat with an IT agent within the help ticket itself. This helps eliminate back-and-forth emailing or long wait times—agents and requestors can stay up to date throughout every step of the support process.
Physical protection for mobile devices
Protecting your students from malware, unauthorized websites, and security breaches is difficult enough as it is, but it doesn’t prevent the most common problem of them all: physical damage.
If a student damages their school Chromebook, you’ll have to issue a spare and repair the damaged device. That’s really all you can do. However, there are several preventative measures you can take to minimize as much damage to your district’s Chromebook fleet as possible.
Invest in physical protection
This is the most straightforward approach. Purchasing a protective case for every student’s Chromebook in your district may seem pricy at first, but the ROI you’ll receive from preventing future damages far exceeds the initial purchasing cost.
Purchase Chromebook insurance
Insuring your devices may or may not work for your district. Depending on the number of Chromebooks you have currently deployed, insurance costs can quickly add up. However, Chromebook insurance acts as an extra line of defense when trying to prevent additional device purchases or repair costs.
Chromebook insurance typically provides coverage for accidents, damage, and theft. Insurance pricing will depend on the provider, but typical factors taken into account include:
- Product purchase price
- Product condition (new, used, refurbished)
- Amount of coverage required (Extended warranty, accident and theft coverage, etc.)
- Length of warranty (typically between 1-5 years)
Require acceptable-use policies
Requiring students and parents to sign an acceptable-use policy agreement is a must. An acceptable-use policy outlines all the rules and guidelines students must follow in order to be granted device privileges. Some sections may include:
- How students are allowed to use their assigned Chromebooks
- How to properly care for an assigned device
- Disciplinary actions for unacceptable device usage
- Security recommendations for parents and guardians
An acceptable-use policy keeps students accountable for their assigned Chromebooks, fosters good device stewardship, and helps districts prevent potential device misuse.
Track your assets with school asset management software
The more steps you take to prevent the misuse and damage of your district’s Chromebooks, the better. Even so, you still need to be able to effectively track and monitor them all. With school asset management software, you can manage assets in bulk, review service histories, quickly identify device ownership and location, issue spares, and more.
At Incident IQ, we’ve built a service management system that allows IT agents and requestors to access their school asset management system and district help desk in one, unified platform. To learn more about how you can manage school Chromebooks, schedule a demo with us and see the Chromebook management tools we’ve built for K-12.
