Skip to content

Final Project

Analysis and Hardening of School Administrative Systems Through Cybersecurity Awareness Training

1. Introduction

In this project, I analyzed the security vulnerabilities associated with the school administrative digital environment and explored ways to improve cybersecurity practices among users.

As an ICT teacher and ICT coordinator, I observed that schools are becoming increasingly dependent on digital platforms such as EMIS, Google Workspace, Google Classroom, and online examination systems for managing academic and administrative activities.

These systems contain sensitive information such as student records, examination data, teacher information, and school documents. Therefore, protecting these systems is important to maintain confidentiality, integrity, and availability of school data.

While technical security measures are important, I identified that human behavior is one of the biggest factors affecting cybersecurity. Unsafe data handling practices, weak password habits, and lack of awareness can create security risks even when proper technologies are available.

Therefore, this project focused on improving user security awareness as the first step toward creating a more secure digital environment.

2. Objective

The objectives of this project were:

  • To identify cybersecurity risks in the school’s administrative systems.
  • To analyze human-related vulnerabilities affecting school data security.
  • To improve cybersecurity awareness among staff users.
  • To promote safe data handling practices.
  • To develop a cybersecurity culture where every user understands their responsibility.

3. System Description

The system analyzed in this project was the school’s administrative digital environment.

The main platforms used by staff include:

  • EMIS for managing student and school records.
  • Google Workspace and Google Classroom for communication, document sharing, and learning management.
  • Online examination and assessment systems for managing academic assessments.

Approximately 20–50 staff members interact with these systems regularly.

The important data requiring protection includes:

  • Student personal information
  • Academic records
  • Examination papers and results
  • Teacher information
  • Administrative documents

4. Vulnerability Analysis

During the analysis, I identified several human-centric security vulnerabilities.

Vulnerability 1: Unsafe Data Handling Practices

Observation

Some users may share files without carefully checking permissions or may accidentally send sensitive documents to the wrong recipients.

Examples include:

  • Sharing documents publicly instead of restricting access.
  • Storing sensitive files without proper protection.
  • Sending confidential information through insecure methods.

Threat

Unauthorized access to sensitive school information.

Trust Model

The system depends on users handling information responsibly and following security guidelines.

Residual Risk

Even after training, accidental mistakes or insider threats may still occur.

Vulnerability 2: Weak Password Practices

Observation

Users may reuse passwords or create simple passwords that are easier to remember but easier for attackers to guess.

Threat

Account compromise through:

  • Password guessing attacks
  • Credential theft
  • Unauthorized access

Hardening Action

Users were encouraged to:

  • Use strong and unique passwords.
  • Avoid sharing passwords.
  • Enable multi-factor authentication where possible.

Residual Risk

Users may still reuse passwords on personal accounts or ignore security recommendations.

Vulnerability 3: Phishing and Social Engineering

Observation

Attackers often target users instead of directly attacking systems.

Users may receive:

  • Fake login pages
  • Suspicious emails
  • Malicious attachments

Threat

Attackers gaining access to school accounts and sensitive information.

Hardening Action

Users were trained to:

  • Verify suspicious emails.
  • Avoid unknown links.
  • Report suspicious activities immediately.

The principle promoted was:

See something, say something.

Residual Risk

New phishing techniques may continue to appear and require continuous awareness.

Vulnerability 4: Unsafe Use of Generative AI Tools

Observation

With increasing use of AI tools, users may accidentally enter confidential information into public AI platforms.

Examples:

  • Uploading student information.
  • Sharing confidential documents for editing.
  • Trusting AI-generated information without verification.

Threat

Data leakage and inaccurate decision-making.

Hardening Action

Users were encouraged to:

  • Remove sensitive information before using AI.
  • Verify AI-generated content.
  • Follow acceptable AI usage guidelines.

Residual Risk

AI technology continues to develop, and users may still over-trust AI outputs.

5. Security Hardening Measures Implemented

To improve security, I focused on building a strong cybersecurity culture among users.

1. Cybersecurity Awareness Training

I conducted awareness sessions focusing on:

  • Importance of protecting school data.
  • Recognizing phishing attempts.
  • Creating strong passwords.
  • Safe document sharing.
  • Responsible use of AI tools.

2. Promoting Secure Data Handling

Staff members were guided on:

  • Checking sharing permissions before sharing files.
  • Avoiding unnecessary storage of sensitive information.
  • Maintaining confidentiality of student and school records.

3. Creating Security Awareness Culture

To make cybersecurity part of daily practice, I encouraged:

Leadership Priority

Cybersecurity discussions can be included during staff meetings and ICT-related activities.

Reporting Culture

Users should feel responsible for reporting suspicious activities instead of ignoring them.

Continuous Learning

Cybersecurity awareness should not be a one-time activity but an ongoing process.

6. Cyber Resilience Approach

Instead of focusing only on preventing attacks, the project also considered how the school can recover from incidents.

A possible scenario considered:

What happens if an important school system becomes unavailable due to a cyber incident?

The response plan should include:

  • Backup of important documents.
  • Alternative communication methods.
  • Clear roles and responsibilities during incidents.
  • Quick recovery procedures.

This helps the school continue functioning even after facing cybersecurity challenges.

7. Results and Observation

After analyzing and improving awareness, I observed that:

  • Users became more aware of protecting sensitive information.
  • Staff understood the importance of checking file permissions.
  • Users became more cautious about suspicious emails and links.
  • The importance of cybersecurity as everyone’s responsibility was highlighted.

However, cybersecurity requires continuous effort because human mistakes and new threats will always exist.

8. Learning Outcome

Through this project, I learned that cybersecurity is not only about installing security tools or configuring systems.

The human factor plays a major role in protecting information.

A secure digital environment requires:

  • Proper technology
  • Clear policies
  • User awareness
  • Responsible behavior

By improving cybersecurity awareness among staff, schools can reduce risks and build a stronger security culture.

Conclusion

This project helped me understand the importance of securing school administrative systems through a combination of technical protection and human awareness.

Although systems like EMIS, Google Workspace, and online assessment platforms provide many benefits, they also introduce security challenges.

By identifying vulnerabilities, training users, and promoting responsible digital behavior, the school can better protect sensitive information and improve its overall cybersecurity resilience.