Using of

Bring Your Own Device (BYOD) in Education A Research Paper Submitted to the Seminar Day of the Education Faculty at AL-Aqsa University, Gaza which is to be held on May 15, 2014

Prepared by:

Dr. Sameh Khalil Al-Jabbour PhD in "Computer Security Systems"

ICT Expert, Education Department UNRWA – Gaza E-mail: [email protected]

15 May, 2014

‫ﺑﺴﻢ ﺍﷲ ﺍﻟﺮﲪﻦ ﺍﻟﺮﺣﻴﻢ‬ ‫)و َ ﻣأَﺎُوﺗ ِﯿﺘ ُﻢ ْﻣ ِﻦ ْاﻟ ْﻌ ِ ﻠ ْﻢ ِ إ ِﻻ ﱠﻗ َ ﻠ ِﯿﻼ ً (‬ ‫ﺻﺪﻕ ﺍﷲ ﺍﻟﻌﻈﻴﻢ‬ ‫]ﺳور ة اﻹﺳراء‪[٨٥ :‬‬

‫‪Page 2 of 19‬‬

Table of Contents

No. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.

Title

Page

Abstract Introduction Impacts of the BYOD Trend in Education Advantages of Using BYOD Devices Allowed on BYOD's Network Integrated System Key Challenges in BYOD BYOD Implementation in Education Example: Cisco BYOD for Education Appendix References

4 5 6 7 7 8 9 11 12 13 15

Page 3 of 19

Abstract

Bring Your Own Device (BYOD), also called Bring Your Own Technology (BYOT), Bring Your Own Phone (BYOP), and Bring Your Own PC (BYOPC) refers to the policy of permitting employees/ students to bring personally owned mobile devices (laptops, tablets, and smart phones) to their workplace/institution and to use those devices to access privileged company/institute information and applications. The education industry has the highest percentage of people using BYOD for work. The term is used to describe the practice applied to students and teachers using personally owned devices in education settings. BYOD in education refers to technology models where students bring a personally owned device to school for the purpose of learning, where a personally owned device is any technology device brought into the school and owned by a student (or the student’s family), staff or guests. Put simply, BYOD is a solution where students quite literally bring their own device to school in order to access the internet and/or school network by 3G or Wi-Fi, be it a smart phone, tablet, laptop or other device. Ultimately the concept of BYOD can encourage collaborative education, increase student engagement, and allow opportunities for more personalized learning where students can excel at their own pace. Students’ personal mobile devices tend to be more cutting-edge, so schools can more easily stay up-to-date with technology. The value of this research paper comes from the importance of the subject itself: "Using of Bring Your Owen Device (BYOD) in Education", where it presents and focuses on features advantages, implementation and challenges of this new technology trend at educational environment.

Page 4 of 19

Introduction Bring Your Own Device (BYOD), also called Bring Your Own Technology (BYOT), Bring Your Own Phone (BYOP), and Bring Your Own PC (BYOPC) refers to the policy of permitting employees/ students to bring personally owned mobile devices (laptops, tablets, and smart phones) to their workplace/institution and to use those devices to access privileged company/institute information and applications. BYOD first entered in 2009, courtesy of Intel when it recognized an increasing tendency among its employees to bring their own devices to work and connect them to the corporate network. However, it took until early 2011 before the term achieved any real prominence. The BYOD movement has received a lot of attention in recent years. People depend on their personal devices, and they want to be able to use them everywhere to make their lives easier and more productive. Many industries are adopting BYOD quicker than others. A recent study by Cisco partners of BYOD practices stated that the education industry has the highest percentage of people using BYOD for work. The term is used to describe the practice applied to students and teachers using personally owned devices in education settings. So BYOD in education refers to technology models where students bring a personally owned device to school for the purpose of learning, where a personally owned device is any technology device brought into the school and owned by a student (or the student’s family), staff or guests. Put simply, BYOD is a solution where students quite literally bring their own device to school in order to access the internet and/or school network by 3G or Wi-Fi, be it a smart phone, tablet, laptop or other device. Ultimately the concept of BYOD can encourage collaborative education, increase student engagement, and allow opportunities for more personalized learning where students can excel at their own pace. Students’ personal mobile devices tend to be more cutting-edge, so schools can more easily stay up-to-date with technology.

Page 5 of 19

Impacts of the BYOD Trend in Education 1. BYOD is a way for schools to get closer to that 1 to 1 (every student has a device) model without incurring the higher costs of a 1 to 1 model. It’s a cost-effective way to save schools money on technology for staff and students. 2. Education specialists believe that technology in the classroom is not only an important step in staying with the times, but that failure to use it can actually stunt childhood development. 3. Teachers must use technology in the classroom, or their students will suffer academically. Our world is (already in) a technology age and it’s not going anywhere. It’s definitely not a passing fad. Other educators believe BYOD can promote greater participation in the classroom. 4. Children are spending more time on screens (than ever before). We use technology intentionally to promote a child’s growth and development, and as part of the curriculum. 5. A research from Concordia University (USA) found that if new technology is introduced into a classroom and used as part of the everyday curriculum, students are more interested in the material and are more likely to succeed. 6. The National Association for the Education of Young Children agrees that when technology and interactive media are used intentionally and appropriately, it supports learning and development in young children. 7. In addition, school districts looking to stay ahead of the curve are adopting BYOD in an effort to appear technologically savvy and forward-thinking, which can then attract families from outside the district. 8. BYOD will increase the interest of students inside and outside the classroom, through active learning strategies.

Page 6 of 19

Advantages of Using BYOD 1. Increase Productivity: comes from a user being more comfortable with their personal device, being an expert user makes navigating the device easier. 2. User Satisfaction: occurs with BYOD by allowing the users to use the device they have selected as their own rather than one selected by the IT team. 3. Cost Savings: can occur on the company end because they now would not be responsible for furnishing the employee with a device, but is not a guarantee. 4. BYOD allows students to carry one device as opposed to one for work and one for personal. 5. Student's personal devices are often more cutting edge. 6. BYOD as it allows for the ability to easily take the device home and work. 7. BYOD typically means more devices to support. Personal devices could easily be disconnected as a distraction rather than a tool. Devices Allowed on BYOD's Network The learning environment is evolving with the rapid adoption of technology. To allow for this evolution, we needed to provide our students and the institute with a secure way to access the network using personal devices, such like: # 1. 2. 3. 4. 5. 6. 7. 8. 9.

Device Name Apple iPad Personal Laptop/Desktop Apple iPhone Android Phone Other Tablet Devices Blackberry Phone Gaming Consoles IPTV Other Table (1)

Page 7 of 19

Usage % 96.1 94.6 92.8 89.9 86.3 82.4 33.3 20.7 3.6

Integrated System The different parts of network infrastructure required to support BYOD could be: Wireless networking, wired networking, firewall and network security systems, server infrastructure….the list goes on and on. They all have to work together. In order to support BYOD we need to think systems, not products. BYOD requires an integrated and systematic approach to design, implementation, and management.

Figure (1) There are three ways users can get access to the BYOD network: 1. Wireless. 2. Wired. 3. VPN.

Figure (2)

Page 8 of 19

Key Challenges in BYOD  A challenging but important task for institutions who utilize BYOD is to develop a policy that defines exactly what sensitive institution information needs to be protected and which users should have access to this information, and then to educate all colleagues on this policy.  While BYOD is increasingly important for satisfaction, it poses significant challenges to IT in terms of security risks, productivity loss, support issues and costs. BYOD forces to wrestle with three key operational challenges: 1. Governance & Compliance BYOD could cause you to violate rules, regulations, trust, intellectual property and other critical business obligations. Hear are recommendations on how to keep your system running smoothly.  Best Practices: Managing multiples – new norm at least 3 devices, probably 4 to 5. BYOD doesn't mean you stop supporting the user if you also said they could do business work from personal systems. Is your help desk ready to deal with all of the device variations?  Risk: How will I recognize problems such as data leaks? How will I stop bad things from happening? How would I answer the auditor if information is compromised?  Control: What's my level of risk and how do I quantify it? How much do I want to avoid risks and will my efforts interfere with user experience and productivity?

2. Mobile Device Management (MDM) Mobile Device Management (MDM) is the administrative area dealing with deploying, securing, monitoring, integrating and managing mobile devices, such as smart phones, tablets and laptops, in the workplace. Many educational facilities are turning to MDM to help them get all these new mobile devices secured and under control as painlessly as possible. There are many of mobile device management software and solutions out there that can help keep schools wireless network secure, protect students, manage and secure all these mobile devices our students and staff are toting to class.

Page 9 of 19

The ideal MDM tool can: 1. Compatible with all common handheld device operating platforms and applications. 2. Function through multiple service providers. 3. Implemented directly over the air, targeting specific devices as necessary. 4. Deploy next-generation hardware, operating platforms and applications quickly. 5. Add or remove devices from the system as necessary to ensure optimum network efficiency and security. 3. Security Security is a big challenge-unless the system is built on what we call “Role Based Access Control”. Simply put, it’s knowing who, what, when, and how people are connecting to the network, and having the ability to limit their access based upon that profile.

Figure (3) The key to a secure device is having a well-managed device. How should you secure your environment? How much management is enough? If left unmanaged, BYOD can lead to loss of control, impact your network availability and cause data loss. You need the right network access strategies and policies in place to secure your environment:  Data Leaks: Sensitive information loss is a certainty. How can I ensure that company data is in the right place at the right time, encrypted and ultimately deleted according to my business rules? Page 10 of 19





Network Protection: Patch releases, identity and audit management, and more. What access controls will I need to decide which devices can open a VPN or connect an employee to the company Wi-Fi? Do I want to put incompletely unmanaged devices on my LAN? Stolen Devices: Devices are too easy to lose. Loss and theft statistics are staggeringly high, and not just for travelers. Consumer devices are at risk from weak passwords and OS defenses.

BYOD Implementation in Education The BYOD movement got its start in colleges and universities nearly a decade ago, spurred by technology-savvy students who demanded to use their personal devices on campus and by forward-thinking administrators who recognized that allowing network access using personal devices could improve the educational experience while aiding their recruiting efforts. Here are MDM implementation features that mobile device management solution should have for BYOD on schools, colleges and universities wireless network: 1) Remote Support It’s important for IT to have the ability to push school compliance policies, secure multiple applications across various platforms, service devices, and perform diagnostics remotely. 2) Mobile Data Leakage Prevention MDM solution can also, prevent students and staff from using their mobile devices to send sensitive data by letting IT set content and context-aware security policies. For example: You can have a policy that recognizes the format of social security numbers and will automatically recognize and prevents students from sending it. 3) Lock Apps Keep your students on track by using context-aware security to lock specified apps like Facebook, Twitter, etc. during school hours.

Page 11 of 19

4) Monitor User Traffic and Behavior Your MDM solution should provide real-time visibility into mobile network traffic and user behavior, and discover and block any unauthorized devices. 5) Platform Support With the plethora of mobile devices out there today, it’s important that your MDM solution can provide full support to all types of mobile devices. 6) Easily Distribute Apps You can go head and package everything together so when students log on to the network for the first time to enter passwords and whatever else, it automatically downloads the apps they will be using in class so they are all ready to go for classroom. 7) Location Tracking You can track all your mobile assets across your school/campus. Say a student loses his iPad; this helps IT know the mobile device location by using GPS & network location facilities.

Example: Cisco BYOD for Education As students, staff, and admin connect their devices to the network using a single Service Set Identifier (SSID), the Cisco solution takes over. Users are completely unaware of the seamless, behind-the scenes actions: • The network uses 802.1x Extensible Authentication Protocol (EAP) authentication. • The Cisco Identity Services Engine (ISE) uses a number of device fingerprinting variables to accurately identify the device as schoolissued or a personal asset. • An appropriate policy is determined using a combination of criteria such as who the user is, what device is being used, the location and time, and so on. • The Cisco ISE then enforces the policy by placing each device on an appropriate VLAN while the device remains connected on the same SSID.

Page 12 of 19

• The Cisco Wireless LAN Controller automatically grants access to resources as appropriate, based on policy.

Page 13 of 19

Recommendations Following are recommendations for best practices for BYOD in education when developing a BYOD solution: 1. Conduct an In-Depth Analysis of Your Network Visibility and Security: • How much visibility do you currently have into who and what is connecting to the network? • Can you identify the types of endpoint devices that are connecting, as well as who is using those devices to connect to the network? 2. Create or Update Your BYOD Policy: • Decide which devices you will support (iPads, smart phones, PlayStations, Xbox, IPTV, etc.) • Determine which operating systems you will support, and which AV software you will require (and their versions). Allow at least one “free” antivirus option whenever possible. • Decide whether you will prohibit or restrict any specific applications (such as Peer-2-Peer music sharing) • Determine the different role-based access policies needed for faculty, staff and students • Determine remediation policies — such as isolation or limited access • Set up remote registration so that students can pre-register their devices before they leave home. • Keep the process simple — remember that students get frustrated easily 3. Implement in Phases: • Start with problem areas that are high risk • Expand into other areas 4. Provide a Solution for Guests: • Make guest access easy to find and connect • Limit guest access (network and bandwidth), or guest networks may become overused and overloaded 5. Communicate the Policy: • Keep it simple: the fewer words the better. • Make sure all stakeholders know the policy requirements. • Offer assistance (give them a supervised place to go when they get frustrated). Page 14 of 19

• Let them know you are just ensuring compliance. Note: One of the most important things to remember is that you can’t just set up your policy based on a snapshot of security risks and student/faculty needs at a single point in time. BYOD is an ongoing process: You must continuously check for the changing needs of users, and modify your policy accordingly. Using the right technology solution is a key factor in ensuring your policy is up-to-date and network access is automatically managed. Network access control gives your IT department the ability to manage and secure the BYOD tsunami, while enabling students and faculty to take education beyond the classroom walls.

Page 15 of 19

Appendix

Bradford Networks Report on The Impact of BYOD in Education

Where does the BYOD movement in EDU stand now? Bradford University Networks decided to find out. The Impact of BYOD on Education report is based on the response to a survey of more than 500 IT professionals from colleges, universities and K-12 school districts across the US and UK. It examines how BYOD is being used, security challenges and concerns that are impacting wider adoption, and the potential going forward. Key findings include:

 85% of educational institutions allow BYOD, yet security lags behind.  58% of educational institutions allow instructors or students to use their own devices on institutional networks according to a new survey from Bradford Networks.  6% of respondents reported that their institution had no BYOD policy and no plans to implement one.  56% reported using network access control (NAC) to onboard devices,  17% said IT registered each device manually,  27% told researchers they allowed anyone to access the network without registration.  54% of those surveyed said they do not require users to install any kind of antivirus protection on their devices.  89% of respondents from colleges and universities reporting they allowed students to use their own devices.  44% of K-12 participants reporting the same. Page 16 of 19

 84% reported that they receive frequent requests from students to do so.  78% of respondents with a BYOD policy said personal devices were being used "for personal use by teachers and students,  72% said they were used to complete assignments,  52% said they were integrated into the classroom.  61% of respondents reported that their institution uses role-based access.  38.9% told surveyors that all users have the same access to their network;  67% said they "do not have the visibility to monitor who is attempting to connect to the network,  62% said they "do not have the visibility to monitor which device types are attempting to connect to the network,"  64% reported that they don't have the resources to onboard userowned devices.  69% said can't scan personal devices for security software or updates.

The survey results ultimately reveal two key findings about the state/future of BYOD in education: 1. There is strong evidence that BYOD is a dominant model in educational settings at all levels. Putting technology in students’ hands is transforming the educational experience, not only in colleges and universities, but in K-12 schools as well. BYOD is fueling the transition as educators move from traditional lecture-based instruction to new models of learning, teaching and collaboration. Rather than resist this revolution in education, results suggest that more and more institutions are embracing it. 2. There is considerable uncertainty about how to make BYOD work. The survey revealed some questionable security practices as well as possible misconceptions about the right way to handle security when students are bringing their personal devices to school. Not all institutions were aware of the importance of visibility into both users and devices accessing the Page 17 of 19

network, or the access control measures needed when thousands of varied users and devices are trying to get on the network. These are areas that schools and universities will have to address if their BYOD initiative is be a success.

Page 18 of 19

References

1. The Holy Quran. 2. http://campustechnology.com/Articles/2013/05/21/Report-85-%of-Educational-Institutions-Allow-BYOD-Yet-Security-LagsBehind.aspx?Page=1 Retrieved on: 16-4-2014. 3. http://www.bradfordnetworks.com/resources/whitepapers/theimpact-of-byod-in-education/ Retrieved on: 16-4-2014. 4. http://www.cisco.com/go/psbyod. Retrieved on: 19-4-2014. 5. http://www2.bradfordnetworks.com/e/5632/the-impactof-BYODin-education/td1kf/830756522 Retrieved on: 20-4-2014. 6. http://www.bradfordnetworks.com Retrieved on: 2-5-2014.

Page 19 of 19