The HFL Education Business Services Podcast - Tech in Schools; friend or foe?

Technology in schools can be a powerful tool, or a significant burden. In this episode, Catherine Loake, Director of Business Services at HFL Education, is joined by Zoran Dimitrijevic, Head of Technology in Schools, to explore why some schools thrive with technology while others struggle.

They unpack the two critical ingredients for success: a clear strategy and governance framework, and choosing the right IT delivery partner. With growing cyber threats, evolving digital expectations, and increasing financial pressures, getting this balance right has never been more important.

This honest and jargon-free episode offers school leaders clear guidance on navigating complex technology decisions; helping them move from being burdened by IT to truly benefiting from it.

Bite-sized listening for headteachers, CEOs, school business leaders and governors, the series helps leaders step back from day-to-day pressures, reflect on the bigger picture, and explore practical ways to lead their organisations sustainably and strategically.

Host: Catherine Loake (Director of Business Services)

Guest: Zoran Dimitrijevic (Head of Technology in Schools)

Created by: Rachel Lodge, Paul Hayward, Biljana Miljkovic

Questions? Email podcast@hfleducation.org.

HFL Education (formally Herts for Learning)  is a not-for-profit organisation providing all the services, training and resources needed to deliver a great education to every child.  

Transcript

Catherine: Hello and welcome to the HFL Education Business Services podcast. I'm Catherine Loake, the director of Business Services at HFL Education. We wanted to create this series of mini podcasts because we recognise that the role of school leadership is growing ever wider and ever deeper, and it's becoming increasingly challenging for school leaders to find the time to get under the bonnet and unpack some of those key issues away from frontline teaching and learning. So that's where we come in. 

And I'm joined today by Zoran Dimitrijevic. Zoran is our head of technology in schools and both of us work across technology in schools in HFL education. And I think I commonly see two scenarios in schools, schools that are benefiting from technology, where it's embedded across the school and it's in the curriculum, it's in the classroom. It's working seamlessly for students and staff behind the scenes.

And then we say the schools are burdened by technology. It's fragmented, it's, slow, it's cumbersome.

And I think for me, there's two keys to being a beneficiary rather than someone who's burdened by technology.

The first is having the right strategy and governance framework in place, and the second is having the right sort of delivery of IT, so the right IT partner. And it strikes me if you get the first one right, if you get the strategy and your framework right, and the right decisions are being made in the right places, finding the right sort of delivery method becomes a lot easier.

Is that what you see as well?

Zoran: Yes. I mean, this is something that, has over time entered every aspect, you know, sort of before all of the other vertical markets, irrespective of where you go, all of that is literally sort of just now spilling, you know, sort of and coming into, into the education, and obviously...to the schools.

It's difficult for the schools to try and capture all of that skill set and the understanding within the school themselves in order to be able to provide, the right direction or the trajectory that schools should take in order to protect themselves or to benefit.

With the Department for Education they have recently come up with standards and aligning your school to those standards is now a much easier task because there are goals, there are measurables that we have to sort of kind of align ourselves to. Having gone through to all the DfE, standards - there is a lot in there.

So, I do find that it would be difficult for somebody who is not from the IT or the technology sector to go and dissect all those standards and say what is actually important, what is the priority for my school versus,

nice to have sort of options, and how can I now filter that all through in order to select the correct IT partner or employee internal IT.

The requirements will change in terms of what each school requires but aligning that to the standards make that job a lot easier.

Catherine: I was pleasantly surprised when I read that the DfE digital standards, because quite often these documents can be quite difficult to digest but to me they were really clear and absolutely are where schools need to get to, and the standards state that schools should be working towards them by 2030. And I suppose with my broader business services director hat on, the technologist in me thinks they shouldn't be working towards them by 2030, they absolutely should be meeting them,

A key part of education is keeping children safe and actually, keeping them safe in the school environment means we need to be really tight with technology from a safeguarding perspective.

But also, you know, schools are vulnerable, doubly so because you've got the insider threat in schools from, you know, children who are curious and sort of experimenting in cybercrime sometimes.

So we've got these really, really important standards but also schools are under huge financial strain and if you haven't kept your investment in technology up, and I completely understand leaders who are deciding, you know what, that TA for that vulnerable child in that class is more important to me right now than replacing those 30 laptops - I get that decision - but it makes attaining those digital standards so much harder.

So how seriously should schools be taking the digital standards and is it good enough that schools are working towards and by 2030, or should they absolutely be there.

Zoran: That's a very good question if I may say, sort of a loaded question. There is a reason, why the standards are out there. The standards that the DfE has provided are the same standards that businesses have been working on for the last decade. It is this slower introduction into...for all of those standards, into the education, was pretty much based on the reality of threat.

When we are talking about cyber criminals, the cyber criminals will be going after the bigger enterprises because that is where they can actually get their reward through the ransomware and everything else. And it's also because compiling those cyber attack strategies took time. To engineer the phishing attack, which is targeted to a particular person in order to obtain all the credentials relevant in order to extract as much money out of that organisation as possible to the ransomware. The revenue potential for the criminals by attacking the school is a lot smaller than attacking, you know, sort of an enterprise organisation. However, what we have seen is the proliferation of AI, because it has reduced the amount of time and the research and the effort required to engineer a good spear phishing strategy. Previously that would take weeks, if not months to prepare. Now it takes minutes and seconds.

Because this is now sort of become really cheap to engineer they're now going after the mass market, wo this is where now the threats that used to be predominantly seen in that medium sized businesses has now dropped to small businesses to education, to schools, it has enabled cyber criminals to provide this blanket approach to cyber attacks, which increases the risk for schools tremendously.

Three years. It is going to be too late because the risk is here now.

Catherine: And I guess this is the challenge, isn't it. Schools probably the most vulnerable within that group because we know typically they're spending around half of what commercial businesses are spending. We know that a lot of their systems are out of date, often disjointed, very easy to attack and so schools are especially vulnerable. And we've both seen, haven't we, see first hand the impact of, cyber attacks on schools, the hardest ones have been special schools, the last place you think anyone with a clear conscience would attack.

But the reality is these are criminals. They don't care that you're, you know, serving children and young people and the fact of the matter is, you hold lots of very, very, sensitive data that in the wrong hands can be very valuable, which is exactly why schools are kind of being targeted.

Zoran: Because of the budget constraints, the infrastructure is not at the level where it should be. The security and all of the mitigations that should be addressing all of those risks are not in place.

There is a constraint. The schools have to decide where that pot of money, how that should be divided. And usually obviously, you know, teaching and teaching resources will take the priority over IT security, but that is definitely posing a really, really high risk, especially aging infrastructure, the aging computers, the approach to plugging those, security gaps is hugely, hugely important.

But schools will struggle, so they will usually almost offload that to the IT partner.

The risk now doesn't become sort of the school and just the school infrastructure but it's also who does actually look after that and how.

Catherine: That brings us seamlessly on doesn't it? You and I have been heavily invested in a transformation program with our technology in schools service, because I think we're seeing exactly that, that schools aren't able to keep pace with commercial businesses in terms of investment in IT.

That equipment is becoming older, it's harder to fix when something goes wrong so we're having to use higher level, technicians to fix things. As the technology landscape evolves around us, there is, you know, a broader and broader skill set that technicians need be able to be competent in, to get across a whole, school infrastructure.

So we've kind of got to the point where it was really difficult to run a sustainable service. We've talked about this in other podcasts in the series. You know, when that happens, you can't do more with less and you have to change the model. And again, I think this is where the DfE standards have been really helpful for us because, the IT provider standards, I think, you know, really confirmed our thinking that this is the direction we need to move in.

So we've moved away from this model of having the same technician visiting the school on a sort of set timeframe, whether that was once a fortnight, once a week, because what we were finding is that technician increasing was getting stuck. If you've got vulnerable kit sitting waiting to be fixed, that leaves the school in a real difficult and vulnerable position.

So we've now moved haven’t we, to two elements of our service. The first is, a piece of the service that’s proactive behind the scenes, that is picking up threats and fixing them automatically.

And we've also now got a system with, unlimited escalation visits. So something goes wrong in a school, the school will ring us, we'll try and fix it remotely initially, because that's the most effective and efficient way of doing it. If that doesn't work, we'll send the right person out, because we recognise we've got this cadre of technologists in HFL, all with a different skill set. And actually someone who knows about a particular type of server, if a school’s still using a server,  might be very different to someone who's got, a knowledge of, of cloud based systems.

So we now have moved to a system where we're making sure we're deploying the right person. 

And we've talked a lot in this series of podcasts about increasingly education, taking a village that no one person can know at all, whether that's the school leader or the tech on site.

So to what extent Zoran is it true that it now takes a village to kind of look after technology?

Zoran: I think in in short, you know, sort of the answer would, would be yes.

Those scheduled visits and engineers coming to the site, there are two aspects to it.

One is the efficiency and the other one is the limited skill set available for the technician. But we have to offset that with we all like to deal with people.

That engineer is there at the school be there any problems are not. So this is where you have to understand, how does that financially impacts school potentially there is a cost associated with that engineer and what we are saying is that that engineer obviously needs to be paid irrespective if they’re resolving a problem or not.

Catherine: Problem or not yeah. 

Zoran:  They are actually sitting in the school

Catherine: Staff in teaching roles know that, Martin, the tech is coming on Tuesday between 10 and 12,

and if they've got a problem with their laptop, they can take it to Martin

But where we are now sort of being pushed to, I guess, because of the broader threats in technology and that the digital standards are about sort of ticketing you know, schools need to call a help desk, and then that ticket gets tracked through.

If you’re a busy classroom teacher and you've got five kids with significant additional needs that you're trying to scaffold teaching and learning for, it's really hard to kind of get out of the classroom and register that ticket.

But there comes a point, doesn't there, a kind of a tipping point?

It’s a bit like multi-factor authentication as well, you know, we know that can be really cumbersome in the classroom but there comes a point where the threat becomes greater than the convenience and I think it feels to me that in education, we're at that tipping point now and the things that that we like, like that technician that comes in and really can meet the needs of teachers, we're almost tipping past that now and if we don't change, it's all well and good, and we do want, you know, people to fit around schools as best we can but the sort of downside of that is that there's a sort of greater risk. We are going to have to think about, well, how do we enable teachers to report their technology issues and  I've seen some great practice in schools where actually the teacher takes it to the office and the office log the ticket. So I think there are workarounds aren’t there,

But I think this sort of resistance to change is dangerous potentially because actually we're at this tipping point and, we are all for supporting schools and supporting staff in classrooms, so we wouldn't be advocating for this new model if we didn't think it was going to keep schools safe and secure and that was important.

But it's a reality that if we don't move this way, we'll be the ones explaining to a school why there was a cyber attack.

Zoran: Definitely is. This is one of the reasons why we had to restructure the approach to resolving the issues for the schools, because the time is an important factor. The benefits of structuring the support to focus on resolving the issues on time, prioritising, which issues to resolve first, which issues can wait, has become obviously like more important. That's why we switched to the escalation visits, the school doesn't have to wait until next week, Thursday, in order to get the technicians in order to resolve their issue.

So this is going into the service desk, they will try to resolve that issue. If that isn't possible and requires a technician on site, the technician is dispatched immediately.

So that way the problems are getting resolved much, much faster.

But I understand, teachers are busy. We don't need to really ponder about that. It's there. They're in the classroom, something goes wrong - how do they report the tickets?

Similar issues existed also in the commercial world, in the private sector. That has changed over time because everybody has suddenly realised that the benefit of resolving the issue, because any issue that hasn't been resolved quickly enough will slow down the teaching process, it will slow down the business process.

And that in terms of the value and the cost and the benefit, all of that put together means, even though we like having somebody come in, sort our problem first, because that is what is holding us back

The escalation visits, and this is one of the reasons why we said it is unlimited, because we don't want the schools to feel there are any limits to how much help they're going to get.

So the IT partner needs to be able to provide that at any point in time. The cost of waiting to school kids sitting in, in the classroom, not being able to learn, teachers not being able to prepare their teaching materials for the following day. All of that, feeds to a lot more cost to the school, than the actual sort of cost of the, of the IT support they have provisioned.

In some way people will communicate that they have got an issue. So when we say teachers don't have smartphones in the classroom, that is one of these aspects that will over time change because of the multi-factor authentication, because that is one of the primary ways of how to prevent the cyber attacks, or somebody taking over an account pretending to be you, because that multi-factor authentication means not only that I need to provide the password to login onto something, but I need that secondary thing which requires my physical device that the criminal can have, so it lowers that risk, and the schools will have to manage that requirement with the risk it carries or what risk it reduces.

The benefit in logging that message means that that particular issue has now gone into the whole triage, understanding what the problems are and being able to compare if there is more of those problems happening, to identify what the root cause of maybe some of these problems.

Catherine: So Zoran, we've talked, about the challenges that schools face and the need to adapt to a changing technology environment and the risks and it's a real conundrum for heads.

And we said that there are two keys to success getting the strategy right and getting the right IT partner.

What advice would you give to a school leader about how to select the right IT partner?

Zoran: One is skills. You need to ensure, that you can ask for an evidence from your IT partner that they are maintaining the skill matrix, so that you can see that there are some improvements and moved forward so that they can demonstrate, provide you with the evidence that there is a skill matrix, here are the engineers, here are the skills required and who is where they are on that classification, and that will provide in return the confidence that that IT company has got sufficient skills to be able to support

The second one is being able to classify the issues and the problems. You would be asking for, evidence of the platform used. This is the platform that allows you to classify the types of the tickets, the reason why that is important, the types and the subtype of the tickets. It's the granularity of the issues and the classification of those. Because once you can analyse that data, you will know where the root cause of the problem is, so you want from your IT provider to demonstrate and to provide the evidence that they're using a platform that is capable of classifying the issues to the granularity required for that to become the strategy. And by that you can actually then address multiple of these strategic goals put forward by DfE.

And then the third one is how is that communicated to the school. The school want the evidence of reports. So you, the school says, I want to have the reports to understand how many tickets have we logged in the whole year of this support contract? How much time did your engineers spend from an IT provider?

Basically that is a feedback where you're going to gauge the value of the contract to the school.

You want to understand based on that reporting the types and the subtypes of all of those issues, because that provides that important strategic decisions, because as we mentioned previously, it is always better to invest into the assets and into the infrastructure in the school rather than paying for IT support more in order to of support the aging equipment.

Those reports need to back those decisions. Then there is also the evidence that you want from these reports about the customer satisfaction. So you want to know that other customers of that IT provider are satisfied with their performance.

Catherine: Yeah.

Zoran: he understanding these guys are providing good support, their customers are sufficiently happy. So there is a less risk there of disappointment.

And there is the SLA adherence report. SLA provides the evidence of how quickly their problems can be addressed and how quickly can they be resolved.

And obviously the fourth category is cost. If you select multiple companies, they can take the boxes, all these four boxes that, that you just mentioned. 

Catherine: That’s when the costs can come in rather than the salami slice, it's getting the quality and then worrying about…

Zoran: it's the same thing if you're budgeting to buy a car. There is a difference – you can buy a 15 year old car but then understand, the cost of that car is going to be very low for as long as you're happy to accept the risks.

Catherine: But the maintenance is going to be huge.

Zoran:  But you might stop in the middle of the road! I'm happy to accept certain risks, but the cost is important for me, for as long as they have ticked the previous three boxes.

Catherine: Zoran, I think IT is probably the area that is most difficult for heads to get under the bonnet of and unpack, not least because technologists often bamboozle us with tech speak.

So thank you for your sort of straight talking and for explaining things so clearly. I think this is going to be really, really valuable for school leaders in thinking about, you know, the importance of those DfE guidelines that I think, or the standards. I think it was very interesting that you said, yeah, absolutely. Schools should be working towards them - the cost is high, but the cost of not doing anything is equally high. So I think there's a real conundrum for heads to ponder there. 

But I think sort of breaking down this idea with this race to the bottom, this salami slicing with IT provision and actually getting the strategy right in terms of what you want from your IT provider and then cost coming into the equation is a real golden nugget. So thanks for providing that.

If you've enjoyed this podcast there are a whole series available. So please do like and subscribe if you've got any questions for Zoran or I, please leave them in the chat. Thank you very much.