Why you should ban USB drives at school

After spending hours restoring desktops recently, which a clever student had booted from a rogue USB flash drive loaded with Malware, it dawned on me that the convenience of these handy little gadgets might just be overrated. And when combined with the benefits of the cloud, specifically the free cloud available to students via the Office 365 (live@edu) service, the risks vs. benefit ratio has clearly tipped towards risk.

I know it seems like such a simple way to transport data like homework, projects, photos, etc, but it also just as easy to transport utilities that can destroy the hard drives on your computers, take direct control of the underlying computer hardware, or modify computer registry errors in a way that is nearly impossible to repair.

You may have the very best security practices in place, such as a perimeter Unified Threat Management (UTM) device, endpoint Anti-Virus protection, and separate VLans (network isolation), and yet be vulnerable to a meltdown caused by a free download from the Internet attached directly onto a PC in your school. It is nearly impossible to guarantee computer security if there is physical access to the device.

Banning USB devices is one of the simplest and most effective ways to reduce the cost of network administration in your school.

But aside from the security aspects, there are also some real practical benefits of tossing those USB drives. Let’s take a look at the advantages to see if they don’t, in your specific circumstance, outweigh the benefits.

Here are the top 10 reasons why you should ban USB drives at your school, in favor of the cloud:

• 10) Eliminate the cost of purchasing the hardware. At $5.00 - $75.00 ea. (depending on capacity), you could save a bundle of money.
• 9) Reduce the cost of managing the devices – tracking these identical (presumably) looking devices and accounting for them can be burdensome.
• 8) Avoid the cost of replacing the devices – responsibility for replacing the drives when they are lost; placing identity (ownership) upon them is difficult.
• 7) Reduce plagiarism - unauthorized sharing of work is nearly impossible to detect and prevent while using a flash drive.
• 6) Improve collaboration – accountable sharing of work is possible in the cloud, impossible on a flash drive.
• 5) Reduce support costs – time spent unnecessarily managing infected or otherwise misconfigured hardware is a real cost.
• 4) Lower the cost of your infrastructure – spending money on student servers can in most cases be completely eliminated.
• 3) Improving teacher to student interaction – with cloud based services, teachers can simultaneously push information to an entire class of students.
• 2) Increase student access to teachers – individual work can be made available to teachers with no extra effort by the student other than saving the work to their private cloud space.
• 1) Eliminating the excuse of “I forgot my homework, it's on my flash drive!” Homework is always a device away (computer, tablet, phone, etc). Presuming it is done, of course!

There you have it, ten solid reasons to ban flash drives from your school.

Now if you are more gently persuaded, have plenty of resources, and don’t want to offend anyone’s sensitivities, you could adopt a more persuasive approach to the matter by making cloud services available to your students and making flash drives subject to inspection if used on school computers.

Given the chance, smart students will quickly realize the tremendous advantages of using their own private cloud and soon leave their flash drives at home.

Ten cool things you can do with Lync 2010

We just completed our first migration from BPOS to the academic version of Office 365. Okay, so there is no academic version of Office 365, just academic pricing (as in mostly free). At any rate, we were anxious to show the new capabilities to one of our school partners.

Yawn… their lack of enthusiasm was underwhelming.

It turns out that Office Communicator, while present in the school for the past 9 months was rarely if ever used in the day to day operations of running the school. In fact this was the second Unified Communications solution that we enthusiastically rolled out, only to find that the users were universally unimpressed.

No doubt there was a need for better training on our part, but the biggest problem appears to be the lack of understanding about what Lync 2010 (formerly Office Communicator) offers. Most viewed it as a simple Instant Messaging client and never really bothered to even set their status, much less use the other features.

Maybe I just don’t understand the classroom environment, but the benefits to using Lync 2010 seem remarkably relevant to the classroom.  And I think it would improve communication, discipline, and security in the school immeasurably, here are 10 really cool things you can do in the classroom with Lync 2010.

1. Take attendance. No, not student attendance, but staff attendance! There is no simpler way for your staff to report present and accounted for than by setting their status when they are in their classroom ready for the day. With one quick glance you know the status of your entire organization.

2. Make announcements. Do you take into consideration how distracting the school PA system can be when you are trying to communicate to a small subset of your organization? Using Lync to communicate directly to small subsets can be done with ease and without interruption.

3. Make Phone Calls.  Are you having difficulty justifying the expense of telephones on every teacher’s desk? Use Lync instead, it is a robust VoIP system that takes “zero” real estate (space) on your desk.

4. Direct connect with parents.  Properly configured, Lync 2010 can communicate with virtually every messaging system in existence. Sometimes a quick one-liner is all it takes to resolve an issue about a student, with a parent.

5. Produce instant video recordings. Can’t afford thousand dollar IP cameras, expensive DVR servers, and all the connections? Place inexpensive web-cams on the top of each teacher’s screen and rotate them around when needed. Documenting discipline issues becomes rock solid and the principal can be watching… real time.

6. Hold virtual parent teacher conferences. Do you have difficulty scheduling and managing parent conferences? With Lync you can connect with parents in a video conference on the fly with no advance setup requirements. They can be across town or around the world and still experience face time with your staff.

7. Send lesson materials. Do you ever need a resource, such as a photo or document from the library or resource center right in the middle of class? Reach out to the media specialist and they can deliver that material right to your desktop, you won’t need to leave your desk.

8. Improve team teaching.  Improving teacher utilization is an important part of managing resources and team teaching is often part of the mix. But let’s make it a lot easier. Lync 2010 allows teachers to share their desktops (or portions thereof) with others. Imagine the rich dialogue of interaction if teacher “B” get’s plugged into the classroom with teacher “A” with just the click of a button.

9. Extend your presence via Mobile Phone.  Recently released iPhone, Android, Windows phone apps now let you set your presence on the go, and communicate with your team members via your mobile device. Good idea when you’re out running an errand on school time, not so good on the weekends – but the nice thing is that you can always set your presence, whatever it is you choose to display.

10. Instant Messaging.  Topping off the list, with the most common feature in Lync 2010, is instant messaging. It’s interesting that users who send thousands of texts per month on their cell phones fail to see the benefit of text messaging from their desktop. The difference with Lync is that by setting your status (Busy, Available, Do Not Disturb, Be Right Back, Away, etc.) your team knows whether or not to send a message and may think twice about interrupting you.

These are the immediate things that came to mind with respect to Lync 2010, there are probably a dozen others. From a larger view, the term “Unified Communications” is mostly techno-babble when used outside the technical support community.  But what it really boils down to is a set of software tools that connect people with one another using technology in ways that are convenient, deeply integrated on all devices, and driven by your stated availability.

Summary

Lync 2010 is a core piece of the Office 365 experience and offers significant communication improvements in charter schools. It allows users to communicate with team members in a variety of ways and from a wide variety of devices. By understanding the status of team members, communication can be tailored for the right time and place for delivery.

And for those schools we manage, Lync 2010 is part of our customer service experience… and our status is always “Available”.

Data Management Plan

Sometimes the most basic concepts can really trip you up. That happened last week when a new school was asked to come up with a Data Management Plan for a grant application.

They reached out to us for insight, and here is our take on the subject. If you are struggling to describe a way to corral those wild 1's and zealous 0's, perhaps this will help. Please feedback your insight and suggestions.

Definitions

Data: digital information in any format utilized by a school for the management of people, processes, and things (resources) associated in any capacity with the school.

Management: awareness, oversight, and control of the aforementioned data.

 

Overview

Data management planning addresses three core components:

1. Ownership and oversight: Managing both the data and the resources that control information systems;
2. Data Security and compliance: Protecting  privacy, controlling access, and securing resources from within and without;
3. Data retention, archiving, backup and disaster recovery planning: Assuring data access in any circumstance for the timeframes specified by law and by policy.

These three core components are intentionally broad to address the wide variety of choice associated with implementing information systems which house, transport, and protect data. However, there are basic standards driven by industry, law, and state education agency guidelines that should be considered standard practice, as individual school boards implement policy.

The purpose of this document is to set forth broad concepts associated with Data Management Planning for Charter Schools and to provide a basic checklist to identify weakness.

Ownership and Oversight

Schools should have direct ownership or contractually delegated control of all resources which are used to store, route, and distribute data. Common examples of these resources are domain names, web hosting accounts, email systems, and hosted applications that store data in the cloud.

The seemingly small matter of legal ownership can cause enormous challenges if mismanaged. It is very common for well-intended parents, volunteers, or even board members to have control of these resources.  However, it can be very difficult to regain control of these resources if problems arise or relationships sour.

Imagine the damage a disgruntled former staff member or parent could inflict if they own your domain name, website hosting account, email system, or other hosted application. Don’t laugh, we have seen it happen.

Checklist:

• Do a simple ”who is” query on the internet and determine who is the registrant of your school's domain name. Is that individual or company still associated with your school? And do you have long-term confidence in that relationship? Is the address and contact information current?
• Determine who hosts your school website. Who owns the hosting account, who has access to control the web server (usually a control panel)? This is not the same as access to the website itself.
• Evaluate the email accounts used to communicate with students, parents, and the community. If your teaching staff is using Hotmail, Yahoo, Gmail, or other consumer based email system you have no control over the contents of those systems. In any kind of Open Records query or legal discovery, you will be unable to search messages without the express permission of the owner of that email account. This could be both embarrassing and costly.
• Review any hosted (Cloud) applications such as a backups, management systems (eRM or IEP), or desktop management systems. Do you have ownership of those accounts and termination processes when managed by a service provider?
• Determine who owns your social media accounts. If it is not you or someone in your organization, takes steps now to gain control of those accounts.

Data Security and Compliance

Fundamental to managing data is controlling access to that data in order to comply with privacy laws, ensure integrity in the education process, protect students and staff from data breaches, restrict sensitive or confidential information to authorized users, and provide safeguards for financial transactions. Infrastructure choices will impact these objectives and should be considered well in advance of any solution implemented.

Many of these challenges can be avoided by using the built in security and access controls provided in a  Microsoft Active Directory based network. But primary schools may find this security model too complicated. Other solutions may need to be considered.

Email systems should have central administrative capacity as well as the ability to do Open Records requests or legal discovery searches. These systems also need to be capable of addressing the wide range of employee changes without difficulty. Confidential email messages need to be archived and retained for the appropriate periods of time, and email destined for former staff needs to be redirected to an administrative user or replacement email account.

Computers and users need to have several layers of security protection starting at the perimeter and ending on the device in order to protect the data sets being accessed. This starts with a CIPA compliant firewall and is enhanced with added layers of protection through security updates or patches and anti-malware services (virus, spyware, malware protection).

Checklist:

• Review the age and feature set of your firewall, new generation firewalls (termed Unified Threat Management devices) provide a wide range of security services that directly impact data management. One of the foundation services is Child Internet Protection Act (CIPA) compliance, which is a basic  component of eRate funding eligibility.
• Review your device based security services (Virus and Malware protection) and consider enforcing security compliance as a condition of internet access. This is a simple process with new generation UTM devices (firewalls).
• Consider implementing Active Directory services into your network environment if you are not doing so already. Couple this with group policies and automatic security patch updates.
• Avoid using personal email for school business, this not only dilutes your brand, but could be very embarrassing in the event of an Open Records Act inquiry or legal proceding.

Data Archiving, Retention, and Disaster Recovery Planning

The most frequent data management deficiency is the lack of planning for the retention of data and the lack of testing backup systems for the recovery of data and associated information systems in the event of a disaster. Typically, retention planning never happens and eventually, hardware failures always occur. Both deficiencies are an important subject for consideration in a data management plan.

Data retention requirements vary by subject matter and user class, each data set should be identified and described in terms of the following four criteria:

1. File format – the format type used to store the data (Word, Excel, pdf, database, image, etc.);
2. Archive length – the time required to retain data;
3. Storage location – the physical location of the stored data;
4. Access control – the security and user permissions associated with the data.

In a well managed environment, data is centrally managed, automatically backed up, and secured with a reasonable level of password protection and/or encryption. Far too often, we see data scattered across a wide variety of staff resources, poorly structured, improperly secured, and inadequately backed up.

The tasks of data archiving, retention, backup, and disaster recovery planning are really connected components of a well structured data management plan. The simplest and most effective way to address these tasks is to view them as a continuum, or a data life cycle – data is created, stored, then deleted at appropriate times, with appropriate security measures during each phase.

Checklist:

• Take inventory of data associated with your school and describe each data set by the above criteria.
•  Seriously question any tape backup systems that are not managed by a highly competent and trained network engineer – 80% of all tape back-up systems fail during recovery.
• Take advantage of the data retention features found in information systems you use. For example, there is no better email archiving, backup, and security solution than Microsoft Exchange Server – the program used to create the email system. Even better is when the Exchange environment is hosted offsite in Tier 3 data centers hosted by Microsoft.
• Consider a single system to manage this process to the extent possible, it will simplify your planning an  execution.
• Test, test, test – always do a full disaster recovery test to validate your plans and document your processes.

Summary

Data management planning need not be an overwhelming project. Rather it should be the logical conclusion to well-designed information systems. When implementing any technology solution, always consider it in light of your data management requirements. Be sure the system compliments your plan, but does not complicate it.

Keep legal and logical control of your data resources, ensure data is secure from all types of threats, and establish clear policies for data lifecycles – including the destruction of data when appropriate.

Contact us if you need assistance drafting a data management plan specific to your school, which may be required for your initial charter application or a grant.

Driving Efficiencies in Desktop Administration

Let’s do a quick math test to give you an idea of the time typically spent doing routine maintenance on the computers in your school and then discuss ways you can dramatically cut those time requirements. We’ ll use round numbers to make it easy, starting with the assumption that you have 100 computers to manage.

At least once each month, you should be doing software updates, security patches, and system scans – the routine maintenance that keeps computers in optimal shape. Doing this maintenance will help keep your computing experience consistent, remove unwanted virus’ and spy ware programs, and apply the latest improvements in operating system and software program functionality.

In a perfect world this process would be entirely automatic, but there are a number of reasons why automation fails and part of desktop administration is monitoring and resolving those failures, proactively.

Back to the math quiz….

How much time does it take update 100 computers each month? If you do it the old fashion way and allow yourself 20 minutes per computer (that’s optimistic) you are looking at 2,000 minutes – plus travel time (between computers). That is roughly 35 hours; which approximates the amount of time we normally spend in an entire month managing infrastructure at a typical school. Not a sustainable model because there are more tasks required to manage technology resources than just updating computers.

The way to improve desktop administration is a three point approach consisting of automation, reporting, and remote control. These actions should be taken simultaneously and there are a wide variety of solutions to help you.

Whatever system you use, and there are several, you should focus on the following three areas:

1. Automation – implementing automatic updates that work within your security model
2. Reporting – providing a centralized inventory of computers and their current status
3. Remote Control – installing remote control tools for efficient technician access

Automation

At the most basic level, you should set your computers to do automatic updates from Microsoft,  but depending upon security settings or user account privileges, this might not work. Finding the right balance between local user access and security of the environment is tricky, but as it relates to automatic updates it can cause the process to fail.

In an enterprise the size of a charter school, the single biggest problem we see (in terms of wasted resources) is having an open desktop security policy, with local install permissions. Managing this is the first order of business when struggling to gain control of computer administration costs.

With no security (access control) in place you will quickly find every single computer in a different state. There will be different backgrounds or wallpaper, butterfly or alligator pointers, and a wide variety of default program settings, browser toolbars, and freeware (accompanied by malware) installed.

The conflict between automatic updates and access control is best managed by a programs such as  System Center Essentials, Windows InTune, or other third party desktop administration tools that provide sufficient security access to accomplish the automatic updates required, with no intervention on your part. The sooner you get control of your desktops – the sooner your support costs will plummet.

In order to measure the success of your update automation, you’ll need some kind of centralized reporting tool.

Reporting

Quickly evaluating the state of your desktop computers is the essential job of a reporting tool. Rather than waiting for a user to call the help desk to address a computer issue, a good reporting tool will notify your help desk well in advance of a pending computer problem.

Applying support resources in advance is almost always more efficient than resolving a problem after the issue has caught the attention of an end user.  And sophisticated reporting tools are both inexpensive and quite robust.

Not only will a reporting tool disclose the state of your computers, with respect to software updates; it will also report impending hardware failures, disk space limitations, device driver conflicts, and other developing problems. And often these are represented in very clear color coded graphs and charts to not only give you a realistic overview of system health, but allow you to drill down to details of a given issue.

Remote Control

Simply stated, Remote Control is the ability for your technical support team to reach across the limitations of physical space and control your computer.  This allows technical support to happen as though the support engineer were sitting physically at your desktop, when in fact they are on the other side of the building, city, or country for that matter.

But there is much more to the advantage of remote control than remote access. Most remote control solutions are Internet browser based and as such, a support engineer can open multiple support sessions at once – as many as a dozen or more, depending upon bandwidth, browser limitations, and the ability to keep track of a large number of simultaneous support sessions. This is the model of efficiency.

In a recent upgrade scenario involving a major Windows Service Pack, we measured the time to do it manually vs. remotely. The time required on site was more than four times greater than doing so remotely.  One significant benefit that is often overlooked with remote support is the ability to provide support services while the class is in session, which is not practical on site.

One of my favorites remote tools is LogMeIn.com, a free browser based program that works well, is easy to install, and can be configured by having end users click on a link within an email message and follow a short installation routine. There are many others that work equally well.

Summary

An efficient desktop management model looks at your infrastructure once each day to view the state of computers. It proactively manages required updates, mostly through automation, but manually if required;  then resolves any computer errors using remote tools that do not interrupt your class.

Our experience suggests that by investing 20 – 30 minutes each day, you can proactively manage 100 computers. That of course does not include repairing intentional damage caused by students, catastrophic hardware failures, or major operating system upgrades, which require physical access.

Want to improve the score on your math quiz stated above? With automation, reporting, and remote administration your total will be a little more reasonable than what you are doing now.  Contact us if you would like a free recommendation on the automation, reporting, and remote support tools that will best suit your situation.

Managing Computers in a hostile computer lab

OK, so the notion of a hostile environment may be a stretch, but hear me out on this one. Jr High and high school students are not always the sweet and innocent models of decorum we would like. But having been there once,  I  understand. Managing computers in a lab can be frustrating, but with a little forethought you can keep your sanity.

Whether it’s showing off, flirting with a classmate, or just plain horsing around; stuff happens in the computer lab. Keys get popped off of keyboards, mice get ripped free of their chords, and the best one I’ve seen yet is a perfectly sized slice of baloney in the DVD drive. Being able to laugh about it is probably a good place to start.

However, if the problems are getting a little overwhelming with your resource constrained staff, here are some suggestions that might help.

Start with the right equipment

To the extent possible, use desktop computers in student labs, rather than laptops. They cost less to buy, are less expensive to repair, and tend to grow legs less often.  For real savings and administrative advantages, see the article about Multipoint Server in a computer lab, it will reduce the cost of the lab by 75%.

Desktops can often be mounted in cages that prevent physical access, which is an important step in your attempts to secure a computer.

Keep the network simple

Whenever possible, use a wired network connection for student labs. The bottleneck of twenty simultaneous You Tube videos will always impact a wireless network more adversely than a wired network. And wired adapters are much more reliable, given the security protocols passwords, keys, etc. that accompany WiFi.

Once configured, wired network devices rarely need management and access to the hardware is less apparent. In fact normal access is preventable through group policy settings. Speed is much faster on a wired network where even the very fastest wireless internet connection is about half the speed.

Provide Adequate Supervision

Adequate supervision is paramount in a computer lab. And this is the most common challenge we observe. If your staff is unwilling to provide accountable supervision and you as an administrator are unwilling to require it, then you might want to consider a teachers aid or parent volunteer. Even a non-technical individual can readily discern when a student is dismantling a computer.

It makes little sense to assign the task of student-sitting to your desktop or network support engineer. In a well managed environment,  they  are better utilized spending time resolving more complex issues.

Install video surveillance

This may seem  an overreach, but there may in fact be a very good case for this – especially in those schools with high risk populations  or special education requirements. Not only will this reduce vandalism, but in extreme cases may provide a solid defense against litigation. And there may be other very good reasons for videos surveillance.

Just knowing the possibility of videos recording exists can change behavior.

If you elect to use video surveillance, be sure to use digital cameras that are correctly specified as to focal length, field of view, and pixels per foot.  In most cases you can use your existing network infrastructure and Power Over Ethernet to eliminate much of your installation costs.

Summary

Remember that the only way to completely secure a computer is to prevent physical access to the computer.  Even the most hardened computer can be compromised if a student is given access to the physical device. By rebooting a computer with a bootable USB device, a very secure computer can be easily compromised by a clever student hacker.

So start with the right equipment, improve your supervision – either in person or by camera – and be suspicious if you see a student in the lunch room with a baloney sandwich, without the baloney.

Desktop Security - How to avoid getting the latest bug

I was raised on a small farm in Idaho, where, believe it or not, one of my daily chores was to milk a cow – by hand. It was not a particularly difficult task, but did require a few essential pieces of equipment (aside from the cow), that being a bucket, cleaning supplies, and a wooden stool. The stool had three legs and was crucial to a successful outcome of the task.

Think about that 3 legged stool as we address the topic of desktop security; there is a lesson.

You should understand three important components to adequately address desktop security, trying to provide security with less can be a problem. They are:

1. A Firewall to block all of the ports into and out of your computer’s resources
2. Antivirus software to detect and destroy malicious code that arrives on your computer
3. Spyware/malware protection to avoid being tracked, hijacked, or otherwise taken for a ride

Although possible, it was rather hazardous to milk the cow using a one or even a two legged stool. And no stool at all was a real show stopper.Keep this corollary in mind as you consider how to protect your desktop from intrusions, virus’, and malware. Optimally you need all three, having none of them will eventually stop your computer from working – unless you have no connection to the outside world whatsoever.

What about one of the popular Security Suites?

A number of software companies provide security suites for PC’s. They attempt to combine all of the aforementioned security services into one package, and sometimes throw in some extras. Are these a good use of your resources? Generally, they are not and here is why.

The problem with most of the security suites on the market today is that they are akin to using a Lazyboy recliner to milk the cow (think of the above example).   Most of them just get in the way of getting the task at hand accomplished.

Let’s keep this real simple and cost effective to boot, by reviewing the three legs of the stool in more detail and how to construct them.

Desktop Firewall

Every Windows Operating System today has a built in firewall. It is more than adequate, especially now that most networks are protected by a gateway or perimeter firewall device. Even most consumer class DSL /Cable Modems, which connects you to the Internet now have this functionality.

So, rarely do you need to buy additional firewall software. In fact, part of the problems associated with added firewall software is the inevitable conflict with the Microsoft Windows firewall.  It either turns it off, tries overriding it, or attempts to co-exist with it.

Some of these third party firewalls are so obtrusive, they may actually block current programs or programs you are attempting to install. This in turn requires you to configure the firewall to allow access to these programs. And if you are installing one brand of security software that competes with the security software of another provider, the problem can even get worse.

As conflicts and performance issues arise, the firewall often gets turned off to accommodate running a particular program, defeating the entire purpose of the firewall in the first place.

My recommendation is to turn on the Windows Firewall and use it alone. If you have already purchased one of the Security Suites, simply uninstall or turn off the Firewall portion of that duplicate Firewall.

Antivirus Protection

Antivirus software is an essential part of securing your desktop or laptop. But having tried just about every brand out there, it is my opinion that few difference exists between them. No doubt there are minor differences in function and form, but most provide the same basic protection and nearly all Antivirus Software manufactures share Virus Signatures with each other in a cooperative manner, especially true during a new Virus outbreak.

It really boils down to price, and I mean total price.

Manually installing 100 copies of a free Antivirus solution in your school may be much more expensive that doing a centralized “push” type of installation from a server or management console, using a commercial antivirus solution. In other words, the hidden cost of labor could far outweigh the savings of “free” software.

My recommendation for organizations of 10 or less PC’s is to use one of the free antivirus programs available. My favorite is Microsoft Security Essentials. It is free (currently), reasonably light weight (meaning it is not a resource hog), and effective.

You can obtain a copy at the following URL: www.microsoft.com/security_essentials (don’t miss the underscore if you type that url) If you have a Microsoft school agreement, you can buy anti-virus, (end point ) protection for a few dollars per computer per year.

Spyware/Malware

The difference between a Virus, Spyware, or Malware infection can be very slight, indeed there is significant overlap in the two areas. And while much of the spyware or malware software is relatively harmless, it is a great idea to understand what software on your system may be running in the background without your knowledge or consent.

Common purposes of more serious Spyware/Malware programs are to harvest information from your system, utilize your system for unsavory purposes (such as sending out SPAM), track your browsing habits, and/or taking control of your computer.

There are all types of clever ways you can become infected with these programs, so you do need protection.  A common trick used to infect your system convincing you to install a free “Antivirus Program” or click on “Free Malware Scan”. This is usually accompanied by an unsolicited  pop-up telling you that your computer is infected.

I won’t even try to list the good, the bad, or the ugly when it comes to the enormous variety of programs in this category. I like to keep things real simple and cost effective.

My recommendation, again, for organizations of 10 or less PC’s is to use Microsoft Security Essentials. If you are still running Windows XP, then you'll need to look for Windows Defender, instead; it is still available for computers running earlier versions of Microsoft Windows. For a larger numbers of computers, please consider adding the software for your Microsoft School agreement.

Summary

I am quite aware these are all Microsoft solutions, but I make no apologies. In education, particularly, Microsoft provides a compelling value for software of all kinds. And who better is capable of understanding the real security issue of the Windows operating system than the company that created it.

And in spite of problems that are common to any mega Corporation, Microsoft has a wide variety of software solutions for education that perform as good or better than most other companies (especially in light of the wide variety of solutions they offer),and you can trust a genuine Microsoft product to actually work as specified.

Best of all - the programs mentioned above are free, or very close to it, and work quite happily together; or in larger quantities can be bundled with your School agreement at a fraction of the cost of buying antivirus software commercially.

One final note. You can dramatically improve desktop and laptop security by keeping your operating system up to date. Optimally, that would include a Windows 7 upgrade. As a minimum, be sure your installed operating system has all of the latest security patches. All versions on Windows have an update facility built right into the main menu.

Stay safe out there!