Secure Every
Campus Endpoint
From computer labs to administrative offices, CtrlLayer protects student data, manages shared workstations, and meets FERPA requirements — all at education-friendly pricing.
FERPA Compliance for Student Data
The Family Educational Rights and Privacy Act (20 U.S.C. §1232g; 34 CFR Part 99) requires educational institutions receiving federal funding to protect student education records. Endpoint security is a foundational element of FERPA compliance.
Legitimate Educational Interest
FERPA permits disclosure of education records to school officials with a "legitimate educational interest." CtrlLayer's role-based elevation ensures that only staff with legitimate need can access SIS applications (PowerSchool, Banner, PeopleSoft) containing student records. Access is tied to job function, not workstation location.
Contractor Access Control
Third-party service providers with access to student data must be under direct institutional control. CtrlLayer monitors and controls contractor workstation access, providing the audit evidence that demonstrates institutional oversight required by the "school official" exception.
Re-Disclosure Prevention
FERPA prohibits re-disclosure of student records without consent. CtrlLayer's USB controls and network monitoring prevent unauthorized export or transmission of student data from administrative workstations. If someone tries to copy a student roster to a thumb drive, it is blocked and logged.
Data Security Best Practices
The Privacy Technical Assistance Center (PTAC) recommends access controls, audit logging, and encryption as core data security measures for educational institutions. CtrlLayer implements all three at the endpoint level, directly addressing PTAC's data security checklist.
Faculty/Staff vs. Student Access
Educational institutions need dramatically different access levels for different user populations — all on the same physical workstations. A professor in a computer lab needs different access than a freshman in the same lab, and both need different access than the IT technician who maintains the lab.
- Students: Locked to approved applications. No software installation. No system settings. USB restricted to read-only or blocked entirely. Network access limited to educational resources.
- Faculty: Elevated access for teaching software. Can install course-required applications with policy approval. USB access for course materials. Administrative tools locked.
- Staff: Role-based access to SIS, LMS, and HR systems. Elevation for administrative software. Network access to departmental resources.
- IT Administrators: Full elevation with audit logging. Can manage workstation configurations. Break-glass access for emergency situations. All actions recorded.
Access Level Hierarchy
Campus Network Threat Monitoring
Campus networks are uniquely challenging — thousands of devices, open WiFi requirements, research traffic that looks anomalous by design, and a user population that experiments with technology as part of the learning process.
Ransomware Detection
Educational institutions are the most targeted sector for ransomware attacks. CtrlLayer's endpoint network monitoring detects ransomware command-and-control communications, file encryption patterns, and lateral movement attempts — catching attacks before they propagate from a single compromised lab workstation to administrative systems.
Student Network Behavior
Distinguish between a computer science student running a legitimate port scanner for a class assignment and a compromised workstation conducting network reconnaissance. CtrlLayer baselines expected behavior per workstation class and alerts on true anomalies, reducing false positives that plague campus security teams.
Segmentation Monitoring
Verify that network segmentation between student, faculty, administrative, and research networks remains intact. Detect when a compromised endpoint attempts to bridge segments — a critical protection for keeping student records isolated from student-accessible networks.
CIPA Compliance Support
The Children's Internet Protection Act (47 U.S.C. §254(h)(5)) requires K-12 schools and libraries receiving E-Rate funding to implement internet safety policies and technology protection measures. While CtrlLayer is not a content filter, it provides critical complementary controls.
- Application control prevents students from installing VPNs, proxy tools, or alternative browsers designed to bypass content filtering
- USB lockdown prevents students from booting alternative operating systems that circumvent filtering software
- Network monitoring detects filter bypass attempts — encrypted tunnels, DNS-over-HTTPS configurations, and Tor network connections
- Audit logging supports CIPA's requirement for monitoring online activities of minors
- Elevation controls ensure that only authorized IT staff can modify or disable filtering configurations
CIPA Complementary Controls
Budget-Friendly Per-Device Pricing
Education budgets are tight. CtrlLayer's per-device pricing model is designed for educational institutions — no per-user licensing complexity, no surprise overages from student accounts, no separate charges for shared workstations.
Per-Device Model
One price per managed endpoint. A 30-seat computer lab costs the same whether 10 students or 500 students use it throughout the semester.
Education Discount
Qualifying K-12 schools, community colleges, and non-profit universities receive education pricing. Contact us for details.
No Seat Counting
No need to track user licenses. Shared workstations, rotating lab schedules, and guest lecturers do not increase your cost.
Secure Your Campus
See how CtrlLayer protects educational environments — from elementary schools to research universities.