Re: Outsourcing Student Email - Security Concerns?

["Dr. Wole Akpose" <wole.akpose () MORGAN EDU>]

I second Brother Arnold's position on security, compliance and student's
experience. Another part of the conversation is value-add your school derive
by using either of these platforms. They provide more than just email and
calendar. As the vendors evolve their products, you no longer need to worry
too much about system upgrade and equipment/software life-cycle. The system
administrator EFT you now need for messaging, and many of the associated
services will decline tremendously (it is now mostly, somebody else's
problem).

The prose for migration IMHO far outweigh any potential (or known) cons.
There's no harm in even adding your faculty/staff into the mix. None of the
various states, cities and council governments across the nation that have
migrated to Google Apps have had any major secure yet (to the best of my
knowledge).

W. Akpose

Visit http://msusac.morgan.edu for up to date discussions on Cyber Security
Wole Akpose. CISSP, CGEIT, D.Eng, SS-BB
Planning & Information Technology
Morgan State University
1700 E. Cold Spring Lane
Baltimore, MD 21251.
p. 443.885.1850 / 443.885.3372
f. 443.885.8304 /443.885.8211

On 5/26/11 12:01 PM, "Kenneth G. Arnold" <bkarnold () CBU EDU> wrote:

You aren¹t really ³putting the student¹s active directory accounts into
someone else¹s hands² with Google. There is a directory sync process that
examines your active directory and Google and performs the necessary changes
to get them into sync by adding , removing and changing the Google
information.  Google needs very little information in order to operate so
you are  not giving them access to the student¹s entire AD record.  You can
use SSO to log the student into Google which means that you don¹t have to
share the student¹s password with Google. As far as compliance with FERPA,
Google¹s current terms of service states that they are as responsible for
following FERPA as your own school.
 
As far as Microsoft vs Google, we felt that the students are more familiar
and comfortable with Google Mail than with Microsoft Mail.
 

Brother Kenneth Arnold
Christian Brothers University
Information Technology Services
Associate Dean, Information Technology Services
(901) 321-4333
 

From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Allen Wood
Sent: Thursday, May 26, 2011 10:05 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Outsourcing Student Email - Security Concerns?
 
Hello all,
 
I work for a small community college and we¹re currently running Exchange
2010 for student email.  Our VP likes the idea of using Google Apps for
Education (or Microsoft¹s Live@edu) and freeing up that mail server for
something else.  I am leery of making the move and basically putting the
student¹s Active Directory accounts in someone else¹s hands. I would think
there are also possible compliance issues, but I haven¹t really studied that
side of it yet.
 
Have any of you ever made either side of this argument before?  If so, would
you mind sharing any info that you may have available that may help us
decide outsourced vs. locally hosted, and maybe even Google vs. Microsoft?
 
Thanks in advance for any info-
 
Allen Wood