Education Network Transformation Programme
Argyll and Bute Council · 15 August 2024
Back to Policy and Resources Committee — 15 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL POLICY AND RESOURCES COMMITTEE EDUCATION / CUSTOMER & SUPPORT SERVICES 15 AUGUST 2024 EDUCATION NETWORK TRANSFORMATION PROGRAMME 1. EXECUTIVE SUMMARY 1.1. Delivering the strategic vision for digital learning in Argyll and Bute and achieving the key priorities of the National Improvement Framework presents a number of major challenges for the council that will require an ambitious programme of investment in sustainable network infrastructure, cutting edge security technology and resourcing of associated technical skills. 1.2. The Education ICT Network infrastructure in its current design is no longer suitable to support the future delivery of the education digital learning vision and strategy. It requires a transformative technology upgrade, improved security, and reconfiguration to support in-school and at home learning. The network was designed to support learning styles applicable to a pre-pandemic in-school service only. There are increased security threats and risks to the corporate and education networks by retaining the education network in its present state. 1.3. This report details the technical and security challenges and investment required to transform and modernise the education network to improve service delivery and implement the local and national education strategies for digital learning [1], whilst mitigating the increased cyberthreats. A core objective is to create a secure and flexible network architecture to support the current and future digital learning requirements of the council’s young persons and professional skills development of our teachers. 1.4. Schools have invested significant funds in additional learning devices to supplement the council’s PC rolling replacement programme. Improved network infrastructure will sustain this investment and provide the capacity to support the outstanding commitment from the Scottish Government to ensure access to a device for every child. 1.5. Digital developments such as Artificial Intelligence [AI], augmented reality, virtual reality, Internet of Things and use of data are evolving at a rapid pace and it is vital that our network is robust and flexible enough to facilitate opportunities for all learners to develop key skills in these areas. Pedagogical approaches such as
Page 2
gamification can break down barriers to learning and provide multiple alternative paths to attainment and achievement for all learners. 1 1.6. Cyber attacks on education establishments are rising exponentially, with secondary schools and higher education establishments at most risk due to their high reliance on IT and digital learning platforms. These establishments may be targeted by criminals because of the sensitive nature of data that may be held or accessed by user devices, which are also vulnerable to email phishing and malware attacks without robust device management policies. 1.7. Education Network Review These priorities and challenges were posed in 2022 to Insight UK Ltd., a specialist technical consultancy, to review and recommend technology solutions to address the identified business objectives, mitigate security risks and transform the education network to be fit for the future. In summary the conclusions and recommendations are: • The network in its current configuration, along with associated security systems and device management software, is neither agile enough nor capable of supporting secure and efficient delivery of the education service’s strategic vision for digital learning. • To mitigate the increasing cyber security threats and risks to our network, and support the aspiration for hybrid learning (devices used at school and home), investment in ‘zero trust’ network security technology in conjunction with network traffic redesign and improved device management, is essential to provide the required flexibility and future proof the network. This is crucial as the council migrates towards a single MS365 tenancy supporting both the corporate and education environments. • Insight UK has considered the technical and operational aspirations and challenges, the council’s wide area network (WAN) model and the particular bandwidth restrictions across the area [note 2]. 1.8. ICT does not have the resource or capacity to undertake a strategic transformation of this scale and complexity without significant investment in hardware and software solutions, and additional engineering resources. It is anticipated a programme of works could take up to two years to fully deliver, and due to the rising security threats, commencement by Summer 2024 is recommended. 1.9. Outline Costs Initial estimates based on medium priced Zscaler technology were provided by Insight UK in 2022 and are presented as Option1. ICT has subsequently undertaken 2 Note: National and Scottish Governments have pledged funding to deliver improved bandwidth to harder to reach areas across the UK e.g. Reaching 100 programme and Rural Gigabit Connectivity Programme. These programmes have been very slow to deliver and Argyll and Bute continues to suffer with delayed rollout schedules.
Page 3
a proof of concept exercise working with our technology partner, Cisco Solutions, based on its flagship network security solution Cisco Umbrella. Repackaged and repriced licensing make it more affordable and achievable than previously thought (option 2). Refer also to Appendix 1 for a breakdown of technology solutions proposed, and the benefits/outcomes to be realised. Two options to resource the installation and implementation have been considered: Option 1: external implementation resources using Insight UK and Zscaler technology Initial capital cost: £1,762,950 Annual revenue: £552,000 The initial capital cost includes outsourced installation and initial implementation at an additional cost of £961,500. Additional ICT engineering resource would still be required post implementation and ongoing maintenance and support. The 5 year cost projection for option 1 is forecast at £4,544,950. Option 2: in-house implementation through additionally recruited engineering resources and Cisco Umbrella. Initial capital cost: £327,050 Annual revenue year 1: £295,000 Option 2 is preferred and represents the most economic and sustainable approach. The 5 year cost projection for the education network infrastructure and security upgrade programme is estimated at £1,908,716. Refer also to Appendix 2 for 5 year cost table. 1.10. Funding Sources • ICT has identified a one-off contribution of £81,500 from the ICT capital budget allocated to replace red risk education network equipment between 2024/25 and 2025/26 as higher specification equipment would be necessary. • Education service has identified a contribution of £460,000 from earmarked reserves pertaining to covid related education fund [£310,000], underspend from Skype for Business for education [£10,000], and education transformation fund [£140,000]. • The revenue model would require an ongoing cost and demand pressure for 2 x senior engineers of £115,000; and to education services £180,000 in 2025-26 and 2026-27, rising to £233,000 from 2027-28 onwards for additional specialist software licensing to deliver the required level of secure flexibility. 2. RECOMMENDATIONS That Members: 2.1. Note the need for the Education Service to deliver service improvements in Argyll and Bute and broaden available curriculum offerings across schools
Page 4
through digital learning provision; and that Option 2 will transform and modernise the education network to deliver the same level of security, equity and flexibility to education users as corporate network users. 2.2. Note the increased security threats and business continuity risks to the education and corporate networks by retaining the education network in its present state. 2.3. Note the optimum approach is a combined use of technologies which cannot be considered in isolation, with associated ICT resources to deploy and maintain this more complex environment. There is no scope to only implement certain aspects highlighted in this paper as all are interlinked. 2.4. Note that a total of £81,500 has already been secured from the ICT capital programme for investment in the education network in 2024/25 and 2025/26, and that a further capital investment of £245,550 and annual revenue investment of £295,000 is required to fund option 2 in 2025-26 and 2026-27 rising to £348,000 from 2027-28 onwards. This represents an overall saving in year 1 of £1,692,900 against option 1. 2.5. Agree allocation of identified education earmarked reserves of £460,000 in addition to reallocation of an estimated £60,000 underspend from the school wifi improvement project fund, reducing year 1 capital and revenue requirement to £20,550. 2.6. Agree the annual revenue requirement for specialist software licensing of £180,000 in 2025-26 and 2026-27, rising to £233,000 from 2027-28 onwards, as a future cost pressure to education service. 2.7. Agree the annual revenue requirement for additional engineering resource of £115,000 as a future cost and demand pressure for ICT. Any pay uplifts associated with the new posts will be included as part of the routine salary budget setting process.
Page 5
3. INTRODUCTION 3.1. The vision for digital learning in Argyll and Bute, as defined in the council’s Digital Learning Strategy 2021-2024 (under review), is in line with Education Scotland’s Digital Learning and Teaching Strategy for Scotland. Our aspiration also takes cognisance of the six core anchors that underpin the role of the local government sector of the future as outlined in the Improvement Service publication ‘Delivering a future for Scottish local authorities’3 , particularly the ‘anchors’ of: design for people’s need, create digital, design and technology enabled transformation and tackle inequality and meet the needs of all citizens. The work that we envisage in this area provides an exciting opportunity for us to take radical action in order to open up a wide range of opportunities and benefits for the children, young people and communities of Argyll and Bute. We know that digital developments such as AI and use of data are evolving at a fast pace and therefore it is vital that our network can facilitate opportunities for all learners to develop key skills in these areas. Pedagogical approaches that rely on a robust digital network such as gamification can break down barriers to learning and provide multiple alternative paths to attainment and achievement for all learners. 3.2. The Education ICT Network in its current design can no longer support the future delivery of the education digital learning strategy. It needs a transformative technology upgrade, improved security, and reconfiguration to support in-school and at home learning. The current network was designed to support learning styles applicable to a pre-pandemic in-school service only. There are increased security threats and risks to both the corporate and education networks by retaining the network in its present state. 3.3. This report outlines the challenges and investment required to transform and modernise the education network to deliver the national and local education strategies for digital learning and improve service delivery. It sets out the key technical issues and security risks that need to be addressed to ensure excellence and equity in digital learning and deliver a flexible, secure education network fit for the future. 4.0 DETAIL 4.1. Background 4.1.1. In its present configuration, Argyll and Bute Council’s education ICT network environment does not have the capacity or flexibility to accommodate the council’s strategic plan for digital learning over the next five years, or the requirements of the Scottish Government’s vision for digital access. 4.1.2. There has been an exponential increase in the level of cyber attacks and ransomware threats targeting UK education establishments that are considered by cyber criminal organisations to present a higher level of security vulnerabilities and 3 Improvement Service: Delivering a future for Scottish local authorities: the challenges they face, the questions that need asking and a model for the future
Page 6
therefore more criminal opportunities due to general lack of cybersecurity investment, the type of personal data held locally, poor password controls, decentralised local device and network management arrangements. In 2022, the UK education sector was hit by a far greater share of ransomware attacks than many other European countries. The National Cyber Security Centre (NCSC), part of GCHQ, has issued notices that the probability of a major cyber incident in education sector is now very high, as evidenced by the increasing number of blocked threats on the education network this council has successfully defended so far. Prioritising enhanced security measures and strong access controls is therefore critical to protecting against such ransomware and malware attacks, such as that recently suffered by Western Isles Council 4.1.3. In addition, the number and variety of internet connected learning devices in schools has grown significantly in the last four years and especially emerging from the pandemic. There has been a major shift towards the use of GLOW, the national digital learning platform, and other digital learning resources requiring an ‘always-on’ connection, which impacts available bandwidth, and requires suitable device and content security protection. 4.1.4. The Scottish Government has undertaken to provide access to a device for every learner. It remains unclear what the government’s commitment will consist of or when, or indeed if, it will be delivered during the lifetime of this parliament. For this reason, cognisance is taken of this potential commitment and the next iteration of the service’s Digital Learning Strategy which anticipates requiring a next generation network. 4.2. Key Objectives and Benefits In the context of the local and national strategies, the Education Service aims to deliver enhanced learning experiences and improved outcomes for children and young people through delivery of the following objectives and benefits, which also carry risks and challenges that need to be addressed: • learning devices can be safely used in school and at home, without compromising the security of the council’s network and data; • Teaching staff have the same level of flexibility of movement across school sites and offices as corporate staff do for professional learning and leadership, without the inconvenience of reconfiguring laptops; • The widening of the curriculum is open to all learners via digital means, ensuring network performance and availability is maintained for all education network users; this would enable an increased offer of pathways and courses for example NPA games design or cyber security. • A robust network for digital learning is capable of supporting new and emerging technologies and new ways of learning such as augmented reality, virtual reality, artificial intelligence and Internet of Things; and be agile enough to adapt to the evolving digital education landscape and expectations of a digitally connected society; • Secure access to both corporate and education applications is available on demand through use of affordable and sustainable alternative technologies,
Page 7
without impacting on performance and productivity or compromising corporate security. • Creating opportunities for learners to develop a wider skill set, taking cognisance of the fact that there is an aging demographic across Argyll and Bute and therefore it is essential that our young people are equipped with up to date employability skills which will enable them to contribute to and sustain their own local industries and communities. • Enabling establishments to deliver relevant and high quality experiences that would equip learners for the future world of work, this in turn could have a positive impact on our own local industries and communities. 4.3. Key Issues 4.3.1. Argyll and Bute schools and pupils do not have the same equity of digital provision and subject choice as many other local authorities do, primarily due to the geographical spread of schools across the council area; lack of national digital infrastructure and high cost of connection; and a shortage of specialist teaching staff and accommodation in rural and island locations. 4.3.2. Recent investment in virtual learning technology and audio-visual equipment has enabled a higher level of learning choices, but puts pressure onto the network, affecting other school user’s ability to access business and education applications and other network resources. Investment in bandwidth expansion to fibre where available, and consideration of alternative connection technologies such as satellite broadband and 4g mobile broadband, are therefore necessary to ensure parity of opportunity and maintain organisational productivity levels. 4.3.3. The target minimum bandwidth forecast to support delivery of the objectives in the Digital Learning strategy is estimated at 30Mbps for schools with approximately 20 pupils or less; and otherwise an allocation of approximately 1Mbps per pupil, where technically and commercially viable. Schools with 1000 pupils or more would have bandwidth of 1Gbps. In the current climate, these targets are aspirational only, given that our suppliers cannot currently provide this level of bandwidth. Costs to increase bandwidth have been prohibitively expensive due to the lack of BT infrastructure but will be reviewed following negotiations with BT in relation to the SWAN2 contract and consideration of alternative emerging technologies . 4.3.4. It has long been this council’s aspiration for digital provision that every learner has a device that can be used both within school and at home on a completely flexible basis. As a result, every device will require to have internet filtering security software which works equally in school and at home. 4.3.5. Corporate users enjoy a level of autonomy of network access with seamless connection regardless of location. This is not yet available to teaching staff across the school estate when going to another location. A greater number of teachers and leadership staff are now working across several establishments and this arrangement is often restrictive, where seamless network access is not available. 4.3.6. Practitioners have indicated that they seek internet filtering solutions which are specifically designed for educational use – allowing differentiation between what is
Page 8
filtered in school and at home. Such software will filter internet content to ensure that devices cannot be used to access material which is inappropriate, but is required to be used in conjunction with additional and broader security infrastructure to stop other security risks such as malware and ransomware attacks. 4.3.7 Schools have invested significant sums on classroom based interactive panels. Education has an ambition to connect panels directly to the education network where compatible with security management software. An upgraded network would provide a prime opportunity to maximise the functionality of these panels and optimise investment. 4.4. Education Network Review 4.4.1. Insight UK Ltd was commissioned in April 2021 to undertake a discovery session to determine which networking changes and technologies were required to support a new, secure “post pandemic” hybrid working environment addressing the key issues and delivering the service’s aspirations for digital learning. It was subsequently expanded to look at the implications on the network, systems, and support, of allocating a device for every child should this government commitment be delivered. 4.4.2. Summary of Discovery session • The network is designed to make best use of very limited available bandwidth and it acts as a secure environment where managed devices can connect directly in school or, in limited cases, over a VPN connection from home. Devices therefore currently operate within a secure enclosed Education network. • The network in its current configuration, along with associated security systems and device management software, is currently not agile enough nor capable of supporting delivery of the education service’s strategic vision for digital learning. • To mitigate these risks to our data and protect our young persons and staff, and support the aspiration for hybrid learning (devices used at school and home), investment in ‘zero trust’ network security technology in conjunction with network traffic decentralisation and improved device management processes is necessary. • A new hybrid environment requires a considerably more flexible setup where devices can be used at school or on home networks without the limitations associated with connecting via a central on-premise based management system, but without compromising security of our data and our young persons. This increased flexibility introduces additional risk and the Insight recommendations cover three key technology recommendations on how this risk can be managed: 1. Short Term device management requirements: – the need to address immediate issues in the way devices are currently used, protected and managed 2. Medium term device management and protection: – to ensure devices can be used by a student or teacher working in any location in such a way that the device, wider network, and all stakeholders are suitably protected. 3. Next generation network: Network redesign for the long term:– the network not only needs more bandwidth, it also needs a complete redesign with improved segmentation of education internet traffic from corporate applications, and perimeter security solutions to deliver 1. and 2. above and
Page 9
to support a hybrid workstyle. Insight UK recommends redesign and investment in combined network and security cloud based traffic management solutions (SD WAN/Direct Internet Access/Secure Access Service Edge [SASE]) to make the most of the available bandwidth without impacting on performance and productivity. 4.4.3. The external implementation costs for the network redesign and segmentation project at £961.5k (£713k plus £248.5k) did not provide for the ongoing management of the new network which is expected to require two senior engineering resources. The new environment will be considerably more complex and resource intensive than the current network to maintain. However advancing recruitment of engineering resources will enable ICT to undertake all the installation, implementation and maintenance in-house. 4.4.4. ICT does not have the resource or capacity to undertake a transformation of this scale and complexity without these additional engineering resources in place from commencement of the project. It is anticipated a programme of works could take up to two years to fully deliver and therefore must be structured to prioritise the core infrastructure and security recommendations to mitigate known risks and provide sound foundations for growth. 4.5. Technology Conclusions and proposals 4.5.1. Short Term Requirements- Device Management and Protection • There is a mandatory requirement to keep all devices up-to-date with security patches and software updates. IPads and Chromebooks are the device of choice for online learning across a high percentage of schools. All schools also use Windows devices offering pupils a broad range of digital skills and device interfaces in readiness for entering the world of work, and for specialist subjects such as business studies and graphic communications. • In many secondary schools devices are not currently adequately protected and managed to the same standards as corporate devices presenting a high risk as the council moves towards a single MS365 tenancy arrangement. Whilst the longer term management issues are covered in this report, an immediate requirement is to ensure basic protection on all devices is maintained through the deployment and maintenance of an anti-virus system for Windows devices and ensuring ipads and chromebook updates are promptly installed. The latter devices are managed centrally via a Mobile Device Management solution, Jamf for ipads and Google Admin Console for Chromebooks. • A caching solution downloads the update onto a site based device which then cascades the update to individual computers across the local area network. This prevents the network from becoming saturated with updates sourced unilaterally by users from the device manufacturers. Immediate actions • A local caching solution is recommended by Apple, using a macmini device on every site using ipads. Capital spend will be in the region of £69,000, with renewal required every five years.
Page 10
• ICT provides Sophos anti virus software management across all school Windows devices. Conditional access policies will be developed to only allow Windows devices to connect to the network and MS365 tenancy where the anti virus software is up to date. • Maintaining device security requires teachers and school technicians to ensure devices are available and in a state of readiness to receive security updates, and to ensure Windows devices OS versions are kept current and anti virus software updated. • A further immediate action is to enforce strong password policies for all education staff to match that of corporate. It is an accepted risk that class accounts are used by all primary pupils on all devices for quick connection and minimising lesson disruption. 4.5.2. Longer Term Device Management and Protection: Chromebooks and iPads – Endpoint Security • A secure access service edge (SASE) is a technology used to deliver wide area network and security controls as a cloud computing service directly to the source of connection (user, device, Internet of things (IoT) device, or edge computing location) rather than a data centre. Security is based on digital identity, real-time context, and company and regulatory compliance policies. • Insight has recommended we implement a new managed SASE service. This should be a DNS (secure routing system) + VPN based SASE solution such as Cisco Umbrella or Zscaler. Such a system will secure “Content filtering” but also put a full security “Wrap” around the device much like a traditional VPN but with even greater security functionality and flexibility, allowing the device to connect to any network but always be managed and protected. In order to ensure that these products offer the flexibility required in an Education context, a further proof of concept will be piloted in one of our larger primary schools. • The practice of routing all WAN (wide area network) traffic to corporate data centres to access security systems adds network latency (a delay) when users and their applications are dispersed and working from home, rather than in- school. As the number of devices increase and the resulting network traffic continues to grow, we are seeing evidence of network bottlenecks as traffic attempts to get back to the data centres – Oban High School’s recent network issues are an example of this. A SASE service secures the end user device in such a way that the user can go direct to their required application without being redirected through the Council data centre. It is recognised as the only way devices can be as usable as they need to be whilst still properly secured such that the risks to the council’s other services are minimised. • Zscaler and Cisco Umbrella are the two leaders in the SASE field. Costs vary but we can expect to pay £275k to £600k per annum respectively depending on the system selected. Cost estimates provided in this paper for option 1 are based on Zscaler but subject to a procurement evaluation exercise and consideration of newly available license bundles. • In addition to the SASE solution, Insight agreed that Lightspeed could be considered for an education setting for additional content filtering alongside Zscaler. Lightspeed Filter software is widely used in other authority Education
Page 11
establishments but serves as a content filter only as it does not offer the required device management or security wrap. A proof of concept exercise is being investigated but would not be necessary if funding for Cisco Umbrella was secured. 4.5.3. Network Redesign for the long term: Redesign and segmentation of network; upgrade network equipment • The current Education network is not capable of supporting the digital learning aspirations and hybrid environment. It sits on a mixture of medium speed 100Mbps circuits and low speed DSL connections running at 8Mbps. The network is limited by the availability of superfast broadband across Argyll and Bute. As the telecoms suppliers make fibre services available, bandwidth upgrades are considered. • Bandwidth upgrades alone are not enough to support the new hybrid environment. Insight has recommended the replacement of existing WAN/LAN hardware in all schools as it found the existing WAN/LAN hardware does not have the required specification to accomplish the security objectives. ICT has long term plans to upgrade networking equipment but these would need to be accelerated through the capital programme to meet the required specification for the new network. • Estimated costs for upgraded network equipment capable of supporting layer 3 segmentation is estimated at £724,500 purchase cost plus £248,500 installation and deployment. Insight has additionally indicated the following actions are required to deliver network user flexibility and improved security: • Implement improved wireless security in schools through 802.1x authentication (pre preparation is underway for wired devices in schools but work and equipment required for wireless) • Development of a segmentation policy • Implement network segmentation at layer 2/ Layer 3 level (Secure the traditional Windows “domain” from non “domain devices”) 4.5.4. Recent changes to Cisco Umbrella SASE solution product packaging and pricing has allowed ICT networks to undertake a proof of concept exercise on this market leading technology. Testing in selected education environments indicates Cisco offers a robust and more economically sustainable option requiring less equipment, licensing and engineering resources than option 1 and Option 2.is the preferred technology solution. A successful test has taken place on Ipads and Chromebooks and a further test with Cisco has been arranged where we will install Umbrella across a larger primary and test against the Lightspeed requirements/criteria. 4.6. Outline Costs Initial estimates provided by Insight UK in 2022 have been adjusted for inflationary increases. Refer to Appendix 1 for a breakdown of technology solutions proposed, and the benefits/outcomes to be realised. The 5 year cost projection for the education network infrastructure and security upgrade programme based on Option 2 is estimated at £1,908,716. This comprises
Page 12
Initial capital cost: £327,050 Annual revenue: £295,000 year 1 Refer to Appendix 2 for 5 year cost table. Description OPTION 1. Based on Zscaler OPTION 2. Based on Cisco Estimated Costs Capital Revenue Capital Revenue Network redesign, segregation, equipment upgrade -Network Equipment purchase/upgrade £724,500.00 £250,000.00 -Equipment installation external £248,400.00 £0.00 -Segmentation Policy £8,050.00 £8,050.00 -Segmented network Installation work £713,000.00 £0.00 SASE solution licensing and cloud services £299,000.00 £180,000.00 Engineering resource [1] £172,500.00 £115,000.00 Specialist content filtering software £80,500.00 iPAD Caching solution (80x£800) £69,000.00 £69,000.00 TOTAL £1,762,950.00 £552,000.00 £327,050.00 £295,000.00 ICT CAPITAL PROGRAMME CONTRIBUTION [2] £81,500.00 £81,500.00 FUNDING REQUIRED [2] £245,550.00 £295.000.00 Notes 4.6.1. Resource options considered Two options have been identified to implement the infrastructure improvement programme: Option 1: Insight UK to deliver the installation, configuration and implementation work packages based on Zscaler solutions at a cost of £961,500. [1] However additional ICT engineering resources (3 x senior engineers) would still be necessary to support and maintain this more complex environment once implemented. Option 2: An opportunity exists to cover both the implementation costs and on-going staffing resource requirements by employing two new ICT Senior Engineers at a cost of £57.5k each (£115k per annum) as a day 1 requirement. This addition to the existing ICT team would mean all of the £961.5k implementation costs could be covered by an internal team and would mean the new network could continue to be managed in-house. In the first year alone the council would be saving £846,400 against the implementation cost projected by Insight. ICT has partnered with Cisco for many years and its core networks are designed around this technology. These skills synergies and shared learning reduces the resource required.
Page 13
Option 2 is therefore the recommended approach as it represents a best value and more sustainable option for ICT to directly recruit engineering resources to undertake the initial installation and implementation and retain the knowledge and skills in- house. 4.6.2. Funding Sources ICT has identified a contribution of £81,500 [2] from the ICT capital budget allocated to replace red risk education network equipment between 2024/25 and 2025/26 as higher specification equipment would be necessary. A further capital investment of £245,550 is therefore required to fund option 2 which may be wholly covered from identified education earmarked reserves. Education service has identified a contribution of £460,000 from earmarked reserves pertaining to covid related education fund [£310,000], underspend from Skype for Business for education [£10,000], and education transformation fund [£140,000]. The revenue model would require an ongoing cost and demand pressure for 2 x senior engineers of £115,000; and to education services £180,000 in 2025-26 and 2026-27, rising to £233,000 from 2027-28 onwards for additional specialist software licensing to deliver the required level of secure flexibility. 5.0 CONCLUSION 5.1. In line with national digital learning policy, Argyll and Bute Council is committed to the development of digital technologies to enhance learning experiences and improve outcomes for children and young people. It will ensure that digital technology plays a key role in ensuring the best start in life for Argyll and Bute’s children and young people, that they have equity of choices and opportunities, and that they are equipped with the skills and attributes to achieve success and fulfilment in their lives. 5.2. In Argyll and Bute, significant progress has been made towards an embedded and productive role for digital learning through the effective collaboration of ICT and Education services. 5.3. In order for us to realise our vision for digital learning and teaching in Argyll and Bute, we have identified a set of key ambitions for our network: • A network that is safe, secure, reliable and fit for the future • A network that is capable of supporting 1:1, new and emerging technologies and new ways of learning such as augmented reality, virtual reality, artificial intelligence and Internet of Things etc • Devices are able to be used securely at home and in school • Maximising functionality of interactive panels through connection to the network. • A solution to update software on iPads and Chromebooks • A seamless internet content filter that has flexibility to be specific to education needs • Teaching staff have the same level of flexibility of movement across school sites and offices as corporate staff
Page 14
5.4. Significant investment in security technologies and resources is necessary to redesign the education network. The education network in its current state cannot effectively or safely deliver the future strategic objectives for equity, achievement and opportunities that the education service has committed to, without increasing the overall security risk to the council. 6.0 IMPLICATIONS 6.1 Policy Scottish Government Strategy: Digital Learning and Teaching Strategy A&B Corporate Improvement Plan, Education Service Strategic Plan 6.2 Financial: Additional estimated capital funding of £245,550 and additional annual revenue funding of £295,000 6.3 Legal None 6.4 HR ; two additional ICT senior engineers to be recruited. 6.5 Fairer Scotland Duty: 6.5.1 Equalities - protected characteristics- none 6.5.2 Socio-economic Duty none 6.5.3 Islands: equity of curriculum choice for island schools improved through use of innovative digital learning solutions 6.6 Climate Change: none 6.7 Risk: if funding is not provided the cybersecurity risk to the councils corporate and education network remains unacceptably high, delivery of the digital learning strategy cannot be fully achieved and parity of connectivity between corporate and education for teaching staff cannot be delivered 6.8. Risk: UNCRC is now enshrined in Scottish Law, our children and young people are being educationally disadvantaged by the current limitations of the network and infrastructure. 6.9. Customer Service: none Executive Director with responsibility for Education Executive Director with responsibility for Customer Support Services Policy Lead: Councillor Audrey Forrest July 2024 For further information contact: Wendy Brownlie, Head of Education: wendy.brownlie@argyll-bute.gov.uk Gerry Wilson, ICT and Digital Manager: Gerry.wilson@argyll-bute.gov.uk Gary Clark, Digital Lead, Education. Gary.clark@argyll-bute.gov.uk
Page 15
Brendan Docherty, Education Manager Brendan.Docherty@Argyll-bute.gov.uk APPENDICES Appendix 1 Summary of Required Actions, Benefits and estimated costings Appendix 2 5 year investment profile
Page 16
EDUCATION NETWORK : ISSUES, BENEFITS AND RECOMMENDATIONS Appendix 1: Issues, Solutions and Benefits Detailed breakdown Education’s requirement is for a modern, secure and flexible network that can support its digital learning aspirations, and the Scottish Government’s 1:1 device commitment should that be delivered. • The network requires to be redesigned to provide improved security and flexibility • The network does not currently have the capacity to allow the education service to achieve the ambition of a device for every learner (1:1 deployment) • In addition to investment in bandwidth, device management and protection, there is a requirement to upgrade network hardware in all schools to efficiently manage network traffic. To future proof the network and ensure that Education can deliver on the statutory duty, there are a number of required network upgrades which are detailed below. Timescale Issues/Impact Recommendation/proposed solution Benefits Estimated cost Network re-design, segregation and equipment Based on Option 2 – All installation work carried out by ICT Short Term 12-18 months • A complete redesign of the education network is required to modernise and future proof the infrastructure. This upgrade is required to ensure that Education can deliver on their statutory duty and to introduce the ability for school devices to be used at home on the Internet. • Segregation of network traffic is recommended to separate admin data (e.g. SEEMiS) and learning and teaching data. • Networking equipment in schools is at or nearing end of life, this impacts on performance and overall user experience. This equipment must be upgraded with a higher specification of equipment (to support the new segmented network) as part of the network re-design. • Implement 802.1x authentication for improved wireless network security (Underway for wired devices in schools but work required for wireless) • Implement network segmentation at layer 2/ Layer 3 level (Secure the traditional Windows “domain” from non “domain devices”) • Capital is earmarked to replace current obsolete equipment over the next 5 years. However, this will not be sufficient to upgrade the equipment to the required • Will provide improved access to the internet and greater flexibility for learners. • Improved speed and functionality resulting in improved user experience. • Improved network security. • Improved user experience for practitioners and learners. • All network devices and the new segregated network will be fully supported by ICT • Clear support matrix in place • Support provided to practitioners and learners will be timely and will improve user experience • Minimisation of any device downtime/impact on learners. Full network re- design and segmentation project c.£8000 to develop a segmentation policy. Install by ICT Engineers 2 new ICT Senior engineers at a cost of £57.5k each - £115k per annum. £250k equipment upgrade purchase
Page 17
• New environment will be considerably more complex and resource intensive than the current network. • A substantial increase in the numbers of networked devices will have an impact on the various teams supporting them. standard to support more than double the number of devices. • Opportunity exists to cover both the implementation costs and on-going staffing resource requirements through option 2: • IT Network Engineering Resource: employing 2 new ICT Senior engineers Education currently makes an annual budget contribution of £38,000 to IT for technical support and file and print servers. SASE Solution (bandwidth mitigation) Short Term 12-18 months • Number of devices increase resulting network traffic continues to grow, we are seeing evidence of network bottlenecks as traffic attempts to get back to the data centres – Tiree and Oban High School’s recent network issues are an example of this. • This results in poor user experience, slowing pace of lessons and activities • Procure SASE solution • A SASE service secures the end user device in such a way that the user can go direct to their required application without being redirected through the Council data centre • Currently all internet traffic is sent to a Council data centre (Kilmory or John Street). A SASE solution bypasses the data centre by taking traffic directly out to the internet and improves the network connection speed. This will also improve the user experience whilst bandwidth upgrades are in progress. • It is recognised as the only way devices can be as usable whilst still properly secured such that the risks to the council’s other services are minimised. Cisco Umbrella £180k per annum Caching Solution Short- Medium Term • Requirement to keep all devices up- to-date with security patches and software updates. • Procure caching servers for each establishment or cluster with ipads • The caching solution downloads the update onto a device which then cascades the update to individual computers across the Capital spend will be in the region of £70,000, with
Page 18
network (reducing load on school bandwidth). renewal required every five years. Internet Content Filter Short Term 12-18 months • Council’s digital learning ambition includes the aspiration for every pupil to have a device, accessible both in learning establishments and at home. This will require appropriate and necessary device management and security internet content filtering software. • Current product is suitable for Windows devices but not flexible enough to provide an acceptable user experience for iPads or Chromebooks due to the repeated authentication pop ups which significantly disrupt teaching and learning, and have a negative effect on pace of learning and attainment of pupils. • Call Scotland has expressed concerns that the internet content filter is disadvantaging pupils with additional support needs due to limiting access to accessibility features and also multiple password prompts. • Procure a content filter which is learner friendly and provides a seamless experience on iPads and Chromebooks. • Improved content filter would minimise requirement for repeated authentication therefore greatly improving user experience. • A hybrid working environment will help to address digital inequity when pupils are outside of school. • A modern flexible internet content filter will provide improved access to in built device accessibility tools. • Ability to customise the Internet content filter based on age and location of learners. Internet content filter incorporated within Cisco Umbrella solution. [Option 1 proposed £80,000 per annum (Lightspeed)]
Page 19
ADDITIONAL CONSIDERATIONS Bandwidth Short term (12-18 months) • 28 schools have bandwidth connections of 10mb or less. • Increased level of online learning adds significant additional pressure on the Council’s already stretched education network connection. • Under-provision of bandwidth impacts learners’ experiences and creates issues with online content buffering and delayed loading times. This results negatively on pace of lessons and activities and therefore significantly impacts on learners’ experiences. • Network capability is limited by the availability of superfast broadband across Argyll and Bute but, as the suppliers make services available, bandwidth upgrades are considered. • Long delays from infrastructure improvements and order to delivery are typical of the industry and we should expect any longer term bandwidth upgrade project to be a slow drawn-out process. However, it is imperative that this is progressed as improvements become available. • Target minimum bandwidth forecast to support delivery of the objectives in the Digital Learning strategy is estimated at 30Mbps for schools with approximately 20 pupils or less; and otherwise an allocation of approximately 1Mbps per pupil, where technically and commercially viable. Schools with 1000 pupils or more would have bandwidth of 1Gbps. • IT has some budget available to upgrade schools to a better connection. However, it does not have sufficient budget to provide connection speeds that support Education Dept future vision and aspirations. • Alternative connection methods will be explored and tested, in conjunction with traffic management solutions for bandwidth optimisation • Provision of fast Internet connections across all education establishments to provide robust connections to online learning platforms such as GLOW (including access to all Google and Microsoft productivity tools). • Commonality of timetable approaches will ensure individual learners’ needs are met through enhanced curriculum choice and better equity of access to broader learning opportunities. • Increased personalisation and choice within learner pathways, more options in terms of subjects and levels, wider access to college, and other national courses. Subject to separate options appraisal following conclusions of negotiations with BT in relation to SWAN2 contract. Consideration of alternative technologies where commercially and technically viable e.g. Starlink satellite technology.
Page 20
Appendix 2: 5 Year investment profile. Based on Option 2 recommendation. RECOMMENDED OPTION 2 CAPITAL/ONE OFF Year 1 Year 2 Year 3 Year 4 Year 5 Total 5 years Assumption/Note Network Equipment and services Network equipment upgrade £250,000 £250,000.00 5 [tbd] year equipment replacement policy Equipment Installation Services £0.00 £0.00 Subsumed into line 16 Segregation policy £8,050.00 £8,050.00 External consultancy Caching solution -non Windows devices £69,000.00 £69,000.00 5 [tbd] year equipment replacement policy TOTAL CAPITAL EQUIPMENT AND SERVICES £327,050.00 £0.00 £0.00 £327,050.00 Less ICT Capital Contribution -£81,500.00 -£81,500 Less Education Earmarking Contribution (£460k total) -£245,550.00 -£245,550.00 Leaves balance of £214,450 Capital BALANCE REQUIRED £0.00 £0.00 REVENUE Software licensing and support SASE solution licensing and cloud services £180,000.00 £180,000.00 £180,000.00 £180,000.00 £180,000.00 £900,000.00 Based on Cisco Umbrella Subject to repricing and contract terms Network Equipment licencing £53,333 £53,333 £106,666 Engineering Resources Senior engineers x 2 £115,000.00 £115,000.00 £115,000.00 £115,000.00 £115,000.00 £575,000.00 Pay uplifts will be included as part of the routine salary budget setting process SOFTWARE AND SERVICES REVENUE £295,000.00 £295,000.00 £295,000.00 £348,333.00 £348,333.00 £1,581,666.00 Less Education Earmarking Contribution (from £214k balance) -£214,450.00 -£214,450.00 Revenue BALANCE REQUIRED £80,550.00 £295,000.00 £295,000.00 £348,333.00 £348,333.00 £1,367,216.00 TOTAL CAPITAL AND REVENUE 5 Year Cost £622,050.00 £295,000.00 £295,000.00 £348,333.00 £348,333.00 £1,908,716.00