Board Governance and Cybersecurity Risk Management with Dr. Tim Tillman of Allied Cyber Academy
Presented by:
Dr. Tim Tillman, founder of Allied Cyber Academy, joins the pod to discuss bridging the gap between school technology leaders and governing boards. The conversation examines framing cybersecurity risk, defining digital duty, establishing disaster recovery plans, and managing emerging challenges like AI and vibe coding.
Allied Cyber Academy — Organization founded by Dr. Tim Tillman to train ed tech leaders, school boards, and superintendents on cybersecurity governance and risk management.
K12 SIX — Threat intelligence sharing community focused on preventing cyber incidents in K–12 schools.
Virginia Department of Education — State education agency where Dr. Tim Tillman previously served as Chief Information Security Officer.
Transcript
Peter Frank:
Welcome to Talk Technology with Atlas, the show
Peter Frank:
that plugs you into the important topics and trends for
Peter Frank:
technology leaders, all through a unique independent school
Peter Frank:
lens. We'll hear stories from technology directors and other
Peter Frank:
special guests from the independent school community,
Peter Frank:
and provide you with focused learning and deep dive topics.
Peter Frank:
Welcome. Welcome, everyone, to Talking Technology with Atlas. I
Peter Frank:
am Peter Frank, the Senior Director of Certification and
Peter Frank:
Operations for the Association of Technology Leaders in
Peter Frank:
Independent Schools,
Bill Stites:
and I am Bill Stites, the Director of
Bill Stites:
Technology at Montclair Kimberly Academy in Montclair, New
Bill Stites:
Jersey.
Hiram Cuevas:
And I'm Hiram Cuevas, the Director of
Hiram Cuevas:
Information systems and academic technology at St. Christopher
Hiram Cuevas:
School in Richmond, Virginia.
Peter Frank:
Well, happy July, guys!
Bill Stites:
Indeed,
Hiram Cuevas:
summer's gone. Yeah,
Peter Frank:
that's what I wanted to talk about, Hiram. I'm
Peter Frank:
glad you said that because I wanted to ask. We've talked
Peter Frank:
about how the misunderstanding that some people have about oh,
Peter Frank:
your summers are light and easy, and there's nothing going on. We
Peter Frank:
talked about how that's not true whatsoever. I was curious if
Peter Frank:
there's a point though where you've stopped thinking about
Peter Frank:
last year and you turn to thinking about the next year.
Peter Frank:
Like, when does 2026, 2027 begin for each of you? Is there a
Peter Frank:
point where that happens, where it flips?
Hiram Cuevas:
I flipped on june 15, so we are already in the new
Hiram Cuevas:
academic year. It's a little bit earlier than the development
Hiram Cuevas:
office and the business office, which typically rolls over on
Hiram Cuevas:
July one. But everybody wants coms sooner. The summer schools
Hiram Cuevas:
are going on earlier, and so for them to understand that it's
Hiram Cuevas:
hard to overlap terms, we just went ahead and let's flip the
Hiram Cuevas:
switch on the 15th of June, and this way we try and keep
Hiram Cuevas:
everybody happy. Sure,
Bill Stites:
you know Hiram's talking about it from like the
Bill Stites:
technical perspective. I generally start thinking about
Bill Stites:
next summer, this summer, as I'm not getting the things done I
Bill Stites:
needed to get done this this summer, next summer, like what's
Bill Stites:
the next plan? Because part of what I end up doing a lot of
Bill Stites:
time is staging. Like you got to think, like what are the major
Bill Stites:
projects that I'm taking on this summer, and then what are the
Bill Stites:
ones that you've got to start thinking about? Whether it's
Bill Stites:
like getting bids or sending stuff out, or you know, like
Bill Stites:
doing some of the leg work or seeing what happens around the
Bill Stites:
building this summer that's going to impact your ability to
Bill Stites:
do that, but from the tech perspective, we roll on July
Bill Stites:
one. Thankfully, we're able to kind of flip that switch. So
Bill Stites:
yesterday, that's what I spent a good portion of my day doing,
Bill Stites:
just making sure that everything got moved over and and got set
Bill Stites:
up properly. And Peter, I do want to go off on a little side
Bill Stites:
note here. What? That's crazy! I can't believe it. I do. I'm
Bill Stites:
sorry. It's what I do. Surprise, surprise. But I want to give
Bill Stites:
Hiram a little bit of ammunition for the next time that he sees
Bill Stites:
my wife, because my wife, she's in a public school. You want to
Bill Stites:
talk about going the distance? She just finished on June 26th.
Bill Stites:
She just got done. So we've been out for like three weeks, and
Bill Stites:
she literally had graduation on the 25th 26th was like her last
Bill Stites:
day of meetings. But when she finished with her meeting, she
Bill Stites:
got together with her sister and sister in law, and they did a
Bill Stites:
little girls' weekend trip. So they went down to South Carolina
Bill Stites:
and they drove through Richmond twice. What? And each time I
Bill Stites:
said, "Are you going to stop and see Hiram? Because those that
Bill Stites:
know know that any time the Stites family gets in the car
Bill Stites:
and heads south, what do we do? We stop at Casa Cuevas.
Peter Frank:
Nice,
Hiram Cuevas:
absolutely.
Bill Stites:
And I mentioned it to her twice. I'm like, "He'll
Bill Stites:
hook you up, cook you a meal, do something good. So next time you
Bill Stites:
see her, Hiram, give her some grief.
Hiram Cuevas:
I have her cell phone number. I'm going to give
Hiram Cuevas:
her grief right after this podcast.
Bill Stites:
I think you should.
Peter Frank:
Goodness gracious, the things that our audience
Peter Frank:
learns about us-that's hysterical. I mean, you
Peter Frank:
mentioned school ending that recently. Then, meanwhile, my
Peter Frank:
sister and her family are visiting, and they live in
Peter Frank:
Arizona, and their kids go back in a couple weeks, their kids
Peter Frank:
start in a couple weeks.
Bill Stites:
Crazy,
Peter Frank:
yeah, these crazy school schedules. So, someone
Peter Frank:
else who knows a lot about crazy school schedules, for our avid
Peter Frank:
listeners, you know we've been talking about some guest hosts
Peter Frank:
joining us this summer. We have another guest host who's going
Peter Frank:
to lead the episode for us today, which we're really
Peter Frank:
excited about. I would like to welcome to the pod here our
Peter Frank:
guest host for today, Kevin Warenda. How are you, Kevin?
Kevin Warenda:
Yes, Peter. Thank you. It's my pleasure. I
Kevin Warenda:
appreciate the invite to move up from guest of the pod to guest
Kevin Warenda:
host this time. We will link
Peter Frank:
to your episode in the show notes, the episode upon
Peter Frank:
which you were a guest, but give our audience just a quick
Peter Frank:
refresher of who you are.
Kevin Warenda:
I'm Kevin Lorenda, director of IT services
Kevin Warenda:
at the Hotchkiss School. Been there actually 11 years. Started
Kevin Warenda:
in higher ed, did public K 12 for about a decade, and then
Kevin Warenda:
joined the Hotchkiss School 11 years ago.
Peter Frank:
Well, listen, I will hand over the reins to you,
Peter Frank:
Kevin.
Kevin Warenda:
Want. Go ahead and bring in our guest. Our
Kevin Warenda:
guest today has spent three decades in education,
Kevin Warenda:
government, and healthcare, including serving as the chief
Kevin Warenda:
information security officer for the Virginia Department of
Kevin Warenda:
Education, and as chief technology officer or chief
Kevin Warenda:
information security officer for multiple public school
Kevin Warenda:
districts. He's now the founder of Allied Cyber Academy, where
Kevin Warenda:
he trains ed tech leaders, school boards, and
Kevin Warenda:
superintendents nationally on navigating the needs of
Kevin Warenda:
cybersecurity. Please welcome Dr. Tim Tillman. Hello, good to
Kevin Warenda:
be here, Dr. Tillman. Some of us may remember an advertisement
Kevin Warenda:
from a number of years ago, where there was a group of
Kevin Warenda:
doctors and nurses and are assembled around a patient, and
Kevin Warenda:
one member of the team is issuing orders on what to do to
Kevin Warenda:
save the patient, and the second one asks, "Are you a surgeon?
Kevin Warenda:
And he responds, "No, but I did stay at the Holiday Inn Express
Kevin Warenda:
last night. I'm thinking, based on your resume, I don't think
Kevin Warenda:
your expertise comes from where you stayed last night. You hold
Kevin Warenda:
a doctorate and MBA, as well as multiple certification
Kevin Warenda:
credentials in cybersecurity. So it's wonderful to host such an
Kevin Warenda:
expert on our show today. Everyone appreciates a good
Kevin Warenda:
origin story. So, would you please tell us how your journey
Kevin Warenda:
has unfolded?
Tim Tillman:
Well, thank you for the kind words. My experience
Tim Tillman:
started as a student in high school. I was lucky enough to go
Tim Tillman:
to a high school that had one of the first networks in the state
Tim Tillman:
of Virginia running Novell Nere, and I learned to love NetWare
Tim Tillman:
and I learned to destroy network as a student. A year after I
Tim Tillman:
graduated, they hired me to come in and fix the issues that I
Tim Tillman:
created. So that started a lifetime of breaking things in
Tim Tillman:
order to learn how to use them. That then had this label of
Tim Tillman:
cybersecurity, which I didn't know at the time. But it's
Tim Tillman:
really been my love since then of trying to develop
Tim Tillman:
environments and deal with best practices around educational
Tim Tillman:
technology. Although I went into other fields and I played in
Tim Tillman:
other environments, I always my first love was always education,
Tim Tillman:
and I'm glad to be back in that. The college side of what I've
Tim Tillman:
done, I didn't go to college until my 30s because I was
Tim Tillman:
working and I was having a good time. But once a college gets
Tim Tillman:
their hooks in you, right? They they don't want to let you go,
Tim Tillman:
so they just keep piling on degrees. But it's been a
Tim Tillman:
wonderful adventure, and I'm really happy now that I'm kind
Tim Tillman:
of on the downhill slide to start sharing my knowledge and
Tim Tillman:
my mentorship with others.
Kevin Warenda:
Speaking of things breaking down and sharing
Kevin Warenda:
that expertise, my question for you to start this off is: Where
Kevin Warenda:
do most schools actually break down? Is it that governance
Kevin Warenda:
never gets defined, or is it that it gets defined and then
Kevin Warenda:
somewhere in the implementation things go off the rails?
Tim Tillman:
It has been my experience, and this is only for
Tim Tillman:
public K 12. I am sure that the independent schools act somewhat
Tim Tillman:
differently, but in public K 12 we always put up the shield, the
Tim Tillman:
armor that says we don't have money, we don't have time, and
Tim Tillman:
we don't have people. And it's honestly been my opinion that's
Tim Tillman:
not true. We don't ask for the money, we don't ask for the
Tim Tillman:
time, and we don't ask for the people, or we don't justify
Tim Tillman:
those decisions if we do ask for them. You know, we surprise
Tim Tillman:
people with, "I'm going to need a million dollars for that, and
Tim Tillman:
then they say, "Well, no, we don't have it. And well, no one
Tim Tillman:
will give me any money. So throughout my career, I have
Tim Tillman:
tried to do things differently. But a typical breakdown of a K
Tim Tillman:
12 IT department is the industry moves really fast. The
Tim Tillman:
technology departments often don't, so they always feel like
Tim Tillman:
they're behind. They always feel like they're putting out fires
Tim Tillman:
instead of planning proactively, and that is the governance
Tim Tillman:
structure. That is a top-down failure of expectation and
Tim Tillman:
holding IT departments accountable. And it's often our
Tim Tillman:
school boards, in my case, our school boards that don't get
Tim Tillman:
involved. So first of all, they don't get involved in
Tim Tillman:
operations. I get that, right? But from a governance
Tim Tillman:
standpoint, they don't get involved with expectation. They
Tim Tillman:
allow IT departments to do whatever they think is best, and
Tim Tillman:
oftentimes IT departments then put up that shield to say,
Tim Tillman:
"Well, I can't do anything more than I'm already doing. Where is
Tim Tillman:
that breakdown? It's normally in leadership and governance.
Bill Stites:
So, Tim, first off, your mention of NetWare actually
Bill Stites:
made me start to twitch. Was it good or bad? It was interesting.
Bill Stites:
It's what got me a job similar to you. I student taught here at
Bill Stites:
MKA, and when I arrived as a student teacher, they were
Bill Stites:
putting in their network and they were using NetWare and
Bill Stites:
Macs, and they hired a network manager that knew NetWare but
Bill Stites:
didn't know Macs, so that was how I kind of slid into the
Bill Stites:
role. My degree is in early childhood education. Like I came
Bill Stites:
in knowing enough about Macs to be dangerous.
Tim Tillman:
I was a beneficiary of IBM trying to assert their
Tim Tillman:
dominance in education.
Bill Stites:
Ah, yes.
Tim Tillman:
So IBM come in and say we've got this package,
Tim Tillman:
we'll put it in, and they they do it in like a month, and then
Tim Tillman:
they walk away and go, it's it's all yours now. Enjoy.
Bill Stites:
Oh yeah, yep. I remember working. Mike Lou was
Bill Stites:
his name, and I worked very closely with Mike as we tried to
Bill Stites:
get all this stuff going. It was a hodgepodge at best. But one of
Bill Stites:
the things that you're mentioning with the governance
Bill Stites:
topic, which is one that I think is incredibly important. You
Bill Stites:
mentioned like the three different areas there, but time
Bill Stites:
being, I think one of the bigger ones. I think it's just time to
Bill Stites:
get the work done, time to have the conversations about what's
Bill Stites:
going on. How do you take this topic and make the time to have
Bill Stites:
the conversations? But how do you have the conversations with
Bill Stites:
the constituency that you're talking about when they don't
Bill Stites:
necessarily have the background like we might to understand
Bill Stites:
exactly what it is that you're talking about, but you go in
Bill Stites:
with the number, and the number could be a million dollars. You
Bill Stites:
know, it could be a big number, and that number could actually
Bill Stites:
be small in comparison to what the issues are, the problems
Bill Stites:
are, the risks are. But if people don't have that context,
Bill Stites:
they'd have no idea of where the number actually sits. So, how do
Bill Stites:
you educate?
Tim Tillman:
I think it's a good question because it is something
Tim Tillman:
that I have tried to do actually just recently, like in the last
Tim Tillman:
two or three, four years, of saying I need time with our
Tim Tillman:
board members to train them and to let them know what their what
Tim Tillman:
I call digital duty is, and I start that conversation with
Tim Tillman:
fear, and it's probably not the best choice to do, but it works.
Tim Tillman:
And I say, for instance, we have a cybersecurity issue. The
Tim Tillman:
public's going to go to you and ask you what's going on, and
Tim Tillman:
you're not going to be able to answer. You're not going to have
Tim Tillman:
any idea, and you may make a mistake, and that may cost us
Tim Tillman:
money, it may cost us reputation, it may cost us
Tim Tillman:
additional risk, all of those kinds of things. So, actually,
Tim Tillman:
getting them to take cybersecurity seriously is one
Tim Tillman:
way to do that, and that requires training and those
Tim Tillman:
things, but normal day-to-day IT operations can also work that
Tim Tillman:
way because oftentimes when an IT leader says, "I need to buy
Tim Tillman:
software, "I need to buy hardware, whatever, there's
Tim Tillman:
usually no reason for that. It's just I need to do this. So it is
Tim Tillman:
not uncommon for the IT leaders that I know to just say I need
Tim Tillman:
this, let's go. I started justifying a lot of the expenses
Tim Tillman:
that I ask for, and and I do a zero-based budget every single
Tim Tillman:
year as well. I don't copy and paste last year's budget and
Tim Tillman:
move forward. I always go back and rejustify everything. I give
Tim Tillman:
a reason for this expense and an impact, and that's what I wanted
Tim Tillman:
to focus on a little bit. Was everything that we do has some
Tim Tillman:
sort of impact on either another department or a student, and the
Tim Tillman:
ones that you can say have an impact on everybody, and that
Tim Tillman:
this is being used by so much of our population, whether it be a
Tim Tillman:
percentage or a number or whatever, the more likely that
Tim Tillman:
request is going to get approved. If you don't provide
Tim Tillman:
any of that information, they get overwhelmed and said, "Well,
Tim Tillman:
I don't know what this is, but it costs a lot of money. We
Tim Tillman:
can't afford it. But if you say, "Well, I'm installing this
Tim Tillman:
application because it was requested by our curriculum
Tim Tillman:
team, and it's going to impact all fifth graders, and we expect
Tim Tillman:
that it will raise SOL scores, and I have the support of the
Tim Tillman:
CNI people, I have the support of other heads of staff or
Tim Tillman:
chiefs or whatever your organization uses as those
Tim Tillman:
people. It's usually then hard for the board or the
Tim Tillman:
superintendent to, in our case, superintendent to say no to that
Tim Tillman:
or to just blatantly say no. Oftentimes, it'll come back and
Tim Tillman:
it'll be a further conversation. But for some things, nobody
Tim Tillman:
wants to be the person who said no, and I can say next year that
Tim Tillman:
you said no. Therefore, something bad happened, and I
Tim Tillman:
don't use that as a fear tactic. That's not one of the fear
Tim Tillman:
tactics I use. I don't want to threaten anybody, but I want to
Tim Tillman:
have the evidence of that. Of I told you exactly what this
Tim Tillman:
particular piece of software would do, and you couldn't
Tim Tillman:
allocate funding to it. Now that scenario has come true, or
Tim Tillman:
because of, and I tend to focus on cybersecurity a lot because
Tim Tillman:
that's just kind of where my mind is most of the time. But in
Tim Tillman:
IT operations as well, just in normal keep the lights on
Tim Tillman:
activities, you know, your board doesn't want to hear about how
Tim Tillman:
much you're spending from Microsoft licensing. They don't
Tim Tillman:
necessarily care how much your Google environment costs, but if
Tim Tillman:
you say, "Look, they're increasing the cost of this, and
Tim Tillman:
I have no control, and quite frankly, we can't stop using it,
Tim Tillman:
so this is not an option that you can say no to. When you word
Tim Tillman:
things that way, they understand and they say, "Okay, well, I get
Tim Tillman:
it. We have to do this. We move forward. Unlike a facilities
Tim Tillman:
department, we can't do deferred maintenance.
Tim Tillman:
Our stuff has to occur, or things don't happen. And I'm
Tim Tillman:
sure a facilities director would tell you the same thing. Of
Tim Tillman:
well, our stuff has to happen too, or things start breaking.
Tim Tillman:
But deferred maintenance is a common tool. It's a common tool
Tim Tillman:
for budget maintenance. We can't really do that in IT. The
Tim Tillman:
vendors won't let us just continue with last year's
Tim Tillman:
pricing or with last year's feature set or any of those
Tim Tillman:
kinds of things.
Kevin Warenda:
Well, we see that's what's happening with AI
Kevin Warenda:
features now, right? Everyone's adding these things, whether we
Kevin Warenda:
want them or not. In some cases, we've talked a lot in my school
Kevin Warenda:
about
Bill Stites:
what
Kevin Warenda:
risk that actually provides when we're
Kevin Warenda:
being. Provided these things for quote unquote free, right? We
Kevin Warenda:
didn't actually want that, but then there's you know if these
Kevin Warenda:
are SaaS products, we are at the mercy of either a contractual
Kevin Warenda:
pricing agreement we've made with them, and they're saying,
Kevin Warenda:
well, it's costing us more to host these things and the and
Kevin Warenda:
the models, etc. And the risk is greater too, so we're adding all
Kevin Warenda:
these security things that you require of us. You have to pay
Kevin Warenda:
more. It's like, well, what if we don't want it, these aren't
Kevin Warenda:
the days of packaged software anymore, or you know,
Kevin Warenda:
individually hosted things, or even on-prem stuff anymore,
Kevin Warenda:
right? So, how does that? How are you thinking about this wave
Kevin Warenda:
of new feature sets that often is tied to then price increases
Kevin Warenda:
because of that risk you're talking about?
Tim Tillman:
Well, yeah, just like you said, 1015, years ago,
Tim Tillman:
you could just buy something and own it and run it forever. There
Tim Tillman:
was no continued annual recurring cost. There was none
Tim Tillman:
of that, unless you wanted a new version. And that's when they
Tim Tillman:
would stab you one time and say, "Oh, but our new version costs
Tim Tillman:
twice as much. But you didn't have to move to it. Now
Tim Tillman:
everything is subscription based. Everything is iterative.
Tim Tillman:
Everything gets features added that whether you want it or not,
Tim Tillman:
you're going to get it. If my district were to say, "Well,
Tim Tillman:
actually, we're not interested in AI tools; we're not going to
Tim Tillman:
use them. Oh, but all of our curriculum apps have built-in AI
Tim Tillman:
tools that we can't turn off, so we can't make that kind of
Tim Tillman:
policy, or at least if we do, it's not going to work. So
Tim Tillman:
that's another thing to explain to the powers that be: is we are
Tim Tillman:
kind of at the mercy of our vendors now in a lot of ways.
Tim Tillman:
Where 1015, 20 years ago we were not. They came to us hat in
Tim Tillman:
hand. You don't go to Microsoft, Google, Power School, or
Tim Tillman:
whatever and demand change. It just doesn't work. No matter how
Tim Tillman:
big your school district is, I've worked in fairly large
Tim Tillman:
districts and extremely tiny districts, and you get what you
Tim Tillman:
get. They might allow some contract language change, but
Tim Tillman:
you're not going to get a feature request. You're not
Tim Tillman:
going to get a special version. You're not going to get any of
Tim Tillman:
those things. So, in a way, we just have to go with the flow.
Tim Tillman:
And when we talk about money and things like that, what usually
happens is:
do we have to buy new equipment, or can we keep
happens is:
using what we use? And I just say, like, would you use a
happens is:
six-year-old computer? Would you use a six-year-old iPhone? Now,
happens is:
some people, of course, well, mine's 10 years old, but the
happens is:
majority of people will not do that because one, planned
happens is:
obsolescence is real, and two, people want the big, bright,
happens is:
shiny new stuff, and they feel hampered when they don't have
happens is:
it. They stop using technology when they feel like they had to
happens is:
wait for two seconds instead of one second. So it's all wrapped
happens is:
up in that governance structure of what are the expectations of
happens is:
the board. And I have been working bottom up to say,
happens is:
listen, you as my school board, you need to have you need to
happens is:
establish hardware replacement cycles so that I can meet your
happens is:
request. You need to establish spending limits for curriculum
happens is:
software or whatever so that I can meet your request.
happens is:
Otherwise, I'm constantly having to raise the bar, and you're
happens is:
constantly asking me why. And that relationship is just not
happens is:
palpable. It just doesn't continue to work. And I'm always
happens is:
the bad guy. I'm always the cost center, which I would be anyway.
happens is:
But I'm always a cost center. But my costs are always going to
happens is:
go up. There's no school district like, well, we want to
happens is:
use less technology. Now we are kind of seeing that now of you
happens is:
know crumble programs being reevaluated and screen time and
happens is:
all that, but I don't think we're going to spend less. I
happens is:
think we're just going to focus more.
Hiram Cuevas:
So, Tim, I think being a seasoned tech director
Hiram Cuevas:
with over 2530 years of experience, I think it may be
Hiram Cuevas:
helpful for our audience who do not have access to the table
Hiram Cuevas:
like you do to say, I need to talk to the board, and they are
Hiram Cuevas:
actually in that reactive mode on a regular basis at their
Hiram Cuevas:
schools, particularly in independent schools, because
Hiram Cuevas:
they're much smaller shops where you find out that they need
Hiram Cuevas:
managed services, and the why component becomes so essential.
Hiram Cuevas:
But you have to be part of the table in order to be able to
Hiram Cuevas:
articulate that. What would you recommend for some of our
Hiram Cuevas:
younger tech directors at some of these schools where they're
Hiram Cuevas:
not part of the table?
Tim Tillman:
Beg. No, actually, I think making it known first of
Tim Tillman:
all that you do want to have those conversations. Don't think
Tim Tillman:
that people already know. Don't think that. Oh well, if they
Tim Tillman:
wanted to talk to me, they would invite me to come talk to them.
Tim Tillman:
They don't know either. They don't know what you need, and
Tim Tillman:
not every director is going to get an audience. Not every
Tim Tillman:
leader is going to get an audience, but they should. I
Tim Tillman:
mean, I don't know why a board would turn you down. It is more
Tim Tillman:
likely that your superintendent is going to shield you from the
Tim Tillman:
board and say no, no, no. I don't want to bother them with
Tim Tillman:
that. So you have to win over a couple of audiences before you
Tim Tillman:
get to the board. You have to win over whoever your direct
Tim Tillman:
supervisor is, and probably their direct supervisor being
Tim Tillman:
the school leader, superintendent, or whoever that
Tim Tillman:
is, depending on your school setup. And you have to do the
Tim Tillman:
exact same scenario. And say, this is why I need to do this.
Tim Tillman:
This is not something I'm throwing out there as a wish
Tim Tillman:
list item. This is really something that I need in order
Tim Tillman:
to function. I need the governance structure. I want to
Tim Tillman:
be held accountable to what the board expects of me, but the
Tim Tillman:
board doesn't know what to expect of me, so I need to help
Tim Tillman:
them with that too, and then over time that relationship will
Tim Tillman:
grow, and more people on your board or as boards transition or
Tim Tillman:
whatever, will just accept it as we're supposed to establish this
Tim Tillman:
environment, and we tell them what goals to achieve. Again,
Tim Tillman:
I'm not talking about operational goals for
Tim Tillman:
technology. I'm talking about strategy, governance,
Tim Tillman:
reliability-all of those kinds of things that the board can
Tim Tillman:
come in and say, we would expect life cycles, we would expect
Tim Tillman:
frameworks, we would expect adherence to laws, we would
Tim Tillman:
expect that you are following some sort of best practice
Tim Tillman:
structure or multiple best practice structures. If the IT
Tim Tillman:
department is left to do it on their own. They don't do it in a
Tim Tillman:
lot of cases because they don't have time, people, and money.
Tim Tillman:
And even sometimes, then the technology leaders don't know
Tim Tillman:
what to do either. Again, that's kind of where I came in to say,
Tim Tillman:
okay, I can start this idea of telling boards what they should
Tim Tillman:
be aware of. Nationally, I can say, "Listen, you're a board
Tim Tillman:
member. You should be expecting these things from your IT
Tim Tillman:
department. And if you're not having these conversations with
Tim Tillman:
your new IT directors, your young IT directors, or even your
Tim Tillman:
seasoned ones, you should be having these conversations. So
Tim Tillman:
while they work from bottom up, I'm trying to work top down too.
Tim Tillman:
And if they hear that message from multiple places, maybe
Tim Tillman:
they'll start to say, "Maybe this is something we need to do.
Kevin Warenda:
You've made the perfect segue here because, as I
Kevin Warenda:
said at the top of the episode, I have experience in higher ed,
Kevin Warenda:
public K 12, and now independent schools. And what I'll say about
Kevin Warenda:
the independent school culture that I had to learn quickly, at
Kevin Warenda:
least in the school I'm at now, there is a sense of wanting to
Kevin Warenda:
rely on outside experts, even if you have the expertise inside.
Kevin Warenda:
We often get consultants to tell us things or to validate things
Kevin Warenda:
that we've done internally. So, tell us more about the Allied
Kevin Warenda:
Cyber Academy and what you're trying to do there to be that
Kevin Warenda:
strategy partner to provide resources that tech directors or
Kevin Warenda:
whomever can use to engage the board, or can they bring you in
Kevin Warenda:
to even talk to their boards? Tell us more about that work
Kevin Warenda:
you're doing because that's the connection here, right, to what
Kevin Warenda:
you're trying to do.
Tim Tillman:
That reaction is not uncommon in public K 12
Tim Tillman:
either. To say, I hear what you're saying, but I need an
Tim Tillman:
expert. They don't always trust the internal people to be the
Tim Tillman:
experts, and they will often also compare themselves to other
Tim Tillman:
school districts. So if you can find those examples and you have
Tim Tillman:
them in advance, you can say, "Well, this school district,
Tim Tillman:
this school district, this huge district, this small district,
Tim Tillman:
this one you've heard about, this one that's our neighbor-all
Tim Tillman:
of those things. If you can say they're doing it, but we're not,
Tim Tillman:
man, that's like 50 points to Griffin Door right there.
Kevin Warenda:
Well, the ironic thing is that in independent
Kevin Warenda:
schools we call ourselves independent, but we often do the
Kevin Warenda:
same thing. We're always asking what somebody else is doing, so
Kevin Warenda:
we do the same thing.
Tim Tillman:
And you look towards those models, right? Of
Tim Tillman:
what's the school that I admire? What are they doing? Because we
Tim Tillman:
want to do that too. Well, that happens in K 12 too. We always
Tim Tillman:
look to like a bigger district of well, what are they doing?
Tim Tillman:
Because they must be smarter than us. That's the attitude.
Tim Tillman:
It's like, well, no, they're not smarter than us. They may have
Tim Tillman:
moved faster than us. That's about it. But if you can develop
Tim Tillman:
that kind of case study and you can say it's not just me coming
Tim Tillman:
up with these ideas. That's what the board doesn't really care
Tim Tillman:
for. Is well, one person's telling us to do this. We're not
Tim Tillman:
going to do that. But if you can say, look, it's not me. I did
Tim Tillman:
the research. This is a national thing. This is a expectation of
Tim Tillman:
the environment in general, right? It's kind of like 20
Tim Tillman:
years ago we started doing Chromebook one to one programs.
Tim Tillman:
School system after school system after school system felt
Tim Tillman:
like dominoes because of that very effect. Of are you sure
Tim Tillman:
it's working? Are you sure that spending this money makes a
Tim Tillman:
difference? Is this really something that is nationally
Tim Tillman:
needed? There wasn't some national law that said thou
Tim Tillman:
shalt develop a one-to-one program. We just all did it. So
Tim Tillman:
it's the same kind of thing with anything else you want to do. If
Tim Tillman:
you can justify that decision, you're golden. So you know,
Tim Tillman:
about 10 years ago, I started attending conferences a lot. You
Tim Tillman:
guys have heard of K 12 six, perhaps, which is a information
Tim Tillman:
exchange, or going to some of the K 12 focused conferences
Tim Tillman:
around the country. And I also had the benefit of working for a
Tim Tillman:
vendor for a while, and I was really traveling around to a
Tim Tillman:
bunch of conferences, and I was having the same conversation
Tim Tillman:
over and over and over, and I've been having it for over a decade
Tim Tillman:
now. Of I still have conversations with tech
Tim Tillman:
directors who say, "I don't know, cybersecurity is really a
Tim Tillman:
problem. I need to think about. Like, really, you don't know?
Tim Tillman:
You haven't heard? And that sparked in me the idea of I need
Tim Tillman:
to stop having one-on-one. Carver stations and start trying
Tim Tillman:
to distribute national information. So that's where ACA
Tim Tillman:
came in, Allied Cyber Academy, and it's new right now. And so
Tim Tillman:
the website is there, acak twelve.com There are some
Tim Tillman:
publications there, that kind of thing that I've done. But
Tim Tillman:
really, what I was hoping to do was develop a system whereby I
Tim Tillman:
could speak directly to the governance leaders in a school
Tim Tillman:
district, in any school district, and I could be that
Tim Tillman:
support system for the internal director or the internal ed tech
Tim Tillman:
leader who says, "I've been trying to get in front of them,
Tim Tillman:
but they won't listen to me, or "I've been trying to ask for
Tim Tillman:
money, but they won't listen to me. They want the outside vendor
Tim Tillman:
to come in. They want the outside expert to come in, so
Tim Tillman:
I've done that for probably 20 or 30 school districts across
Tim Tillman:
the country at this point, and the board members themselves are
Tim Tillman:
the ones who afterwards have said, "I had no idea. Thank
Tim Tillman:
goodness you're here, and that usually sparks dozens and dozens
Tim Tillman:
of more conversations in the background, so I wanted to
Tim Tillman:
create this structure that was about evangelism more than
Tim Tillman:
anything else. That it was about cybersecurity in particular,
Tim Tillman:
cybersecurity evangelism, which then leads itself to just
Tim Tillman:
straight up ed tech funding and support and things like that.
Tim Tillman:
But cybersecurity is the hot topic, or it was now AI is kind
Tim Tillman:
of taking over. But cybersecurity there for about a
Tim Tillman:
decade was the hot topic that boards didn't know anything
Tim Tillman:
about, and they trusted their IT department to make decisions.
Tim Tillman:
And then the IT department would go and say, "I need money in
Tim Tillman:
order to make these decisions, and then they would refuse the
Tim Tillman:
money. So once I explain that to the board, they go, "Well, I
Tim Tillman:
wonder why we did that. Well, you did it because you didn't
Tim Tillman:
understand, so that's why I'm here. So we do things like we
Tim Tillman:
walk through tabletop exercises, we walk through how to do an
Tim Tillman:
IRP, a DRP, a BCP, a coop, all of those things, and say this is
Tim Tillman:
your responsibility to do these things. It is not the school.
Tim Tillman:
I mean, the school district has to implement it, and I don't
Tim Tillman:
mean to mistake that. Of it's not their job to write those
Tim Tillman:
policies; it's their job to demand that those policies
Tim Tillman:
exist, and to say if you don't have this done in six months,
Tim Tillman:
there will be repercussions because you can't just keep
Tim Tillman:
putting it off and putting it off and putting it off. You'd be
Tim Tillman:
surprised when I was the CISO for Department of Education. I
Tim Tillman:
did a survey of how many of my 132 school districts in Virginia
Tim Tillman:
had a DRP, a disaster recovery plan. You would be shocked to
Tim Tillman:
know that it was less than half who had no formal plan. Yes,
Tim Tillman:
they were doing disaster recovery. They were backing up
Tim Tillman:
servers. They were backing up critical data, but they didn't
Tim Tillman:
have a plan. They certainly didn't have recovery time
Tim Tillman:
objectives, recovery point objectives, all those kinds of
Tim Tillman:
things that are just standard. They didn't have those things.
Tim Tillman:
So that's why I created ACA was to say, I've been here long
Tim Tillman:
enough to know what the check boxes are. Here are all the
Tim Tillman:
check boxes that if you do all these things with your IT
Tim Tillman:
department in your district, then your IT department should
Tim Tillman:
be supercharged in order to meet those goals. But you're going to
Tim Tillman:
have to give them money as well. I preach that from the rooftops.
Tim Tillman:
You're going to have to give them money. You're going to have
Tim Tillman:
to give them people, or you're going to have to hire managed
Tim Tillman:
services to fill the gap.
Bill Stites:
You're touching on a lot of the stuff that is near
Bill Stites:
and dear because what you're describing is risk management.
Bill Stites:
When you talk about our boards or our governing bodies,
Bill Stites:
whatever they may be, more than likely they have somebody on
Bill Stites:
staff or somebody, a committee that is looking at risk and
Bill Stites:
looking at risk management, but often
Tim Tillman:
it often doesn't include technology risk.
Bill Stites:
Right, it doesn't focus on the tech side of
Bill Stites:
things, and that's where going back to the question about time
Bill Stites:
comes in and all of those other things. But you said something
Bill Stites:
very interesting that comes up often, and Hiram and I have been
Bill Stites:
having a lot of conversations about this, particularly when
Bill Stites:
our heads of schools go out or everyone goes out and they're
Bill Stites:
hearing what everyone else is doing, and they're like, "Oh,
Bill Stites:
well, this school is doing this. Well, did that school take the
Bill Stites:
time to properly vet or properly go through an exercise to look
Bill Stites:
at what the risks are before they brought that shiny new
Bill Stites:
thing on, or was it just oh we saw this shiny new thing let's
Bill Stites:
try it and they haven't even thought about it. So you've
Bill Stites:
talked about your role, the roles in schools, particularly
Bill Stites:
the CISO role, and the one thing that we often laugh about is
Bill Stites:
when we have conversations like this. You know they're like well
Bill Stites:
you know you've got your tech director and your curriculum
Bill Stites:
person who's looking at this, and your risk person, and then
Bill Stites:
this person, and we go through it all, and we're like, yeah, I
Bill Stites:
wear that hat, I wear that hat, and I wear that hat. You know,
Bill Stites:
it all falls onto one. So when you go into schools, either at
Bill Stites:
the individual schools or at the district level or with different
Bill Stites:
organizations, how do you talk to them about the structure of
Bill Stites:
risk management and the structure around needing maybe
Bill Stites:
not like a full time role, but needing either this in a part
Bill Stites:
time or this in someone's job description, and then the
Bill Stites:
professional development that needs to go into that work. So
Bill Stites:
you. Actually, know how to do
Tim Tillman:
it. Yeah, well, I think you're absolutely right.
Tim Tillman:
Like everything that I talk about is wrapped up in this risk
Tim Tillman:
management idea. Everything I've talked about today has been, oh,
Tim Tillman:
well, that's just risk management, right? The reason I
Tim Tillman:
don't say the words is what we just discussed. Of boards
Tim Tillman:
already think they know what risk management is, and risk
Tim Tillman:
management is employee risk. It is transportation risk. It's
Tim Tillman:
facilities risk. They don't think about technology risk as
Tim Tillman:
being part of that umbrella. And your risk manager, if you're
Tim Tillman:
lucky enough to have one, is probably also not thinking about
Tim Tillman:
it. They may have cybersecurity insurance, but that's it. And
Tim Tillman:
they're probably not even talking to the ed tech leader
Tim Tillman:
about the cybersecurity insurance because they're
Tim Tillman:
allowing the vendor to make those decisions. So what I try
Tim Tillman:
to do, and what I've been forming, is the idea of creating
Tim Tillman:
a cybersecurity program. So what are the artifacts that are
Tim Tillman:
involved in that program? What are the best practices? All
Tim Tillman:
these things. So we start with things like risk assessment of
Tim Tillman:
what would happen if this occurred. What has to be in
Tim Tillman:
place in order for these controls to work, or for a
Tim Tillman:
ransomware attack to not be the end of the world? And that
Tim Tillman:
usually then sparks the other conversations of, "Do you think
Tim Tillman:
we're going to have a ransomware attack? Like we can have one
Tim Tillman:
like in the next 30 seconds. So that's the world that we live
Tim Tillman:
in. Of yes, the answer is yes, but we can put up a lot of
Tim Tillman:
different layers of defense against it. That even if it does
Tim Tillman:
happen, it won't destroy everything, and that's because
Tim Tillman:
we have the governance structure. So we wrap everything
Tim Tillman:
back into that to say, if you like the match, all of these
Tim Tillman:
other things will happen, and the board gets that. They get it
Tim Tillman:
every single time, and they go, "Why didn't anybody ever explain
Tim Tillman:
this to us? Well, because you had a lot of gatekeepers that
Tim Tillman:
wouldn't let wouldn't let ed tech talk to you for one, and
Tim Tillman:
this is fairly new. The idea of doing all of this and
Tim Tillman:
structuring it like an enterprise instead of like a
Tim Tillman:
school district is new.
Hiram Cuevas:
So, Tim, we've talked a lot about policies and
Hiram Cuevas:
process and relationships. What are you seeing right now as the
Hiram Cuevas:
latest security risk that most schools aren't thinking about? I
Hiram Cuevas:
have one in mind that I want to toss out to you, but I'd be
Hiram Cuevas:
curious to know what you're thinking.
Tim Tillman:
Well, now you spared my interest. What is
Tim Tillman:
yours? Because we're probably on the same page.
Hiram Cuevas:
So I had a faculty member recently ask me for
Hiram Cuevas:
access to app scripts because he wants to start generating
Hiram Cuevas:
extensions using Vibe coding as part of a conference that he
Hiram Cuevas:
attended, and my Spidey sense started tingling, and I'm like,
Hiram Cuevas:
ah, this is a problem. We only use this internally with the
Hiram Cuevas:
tech department, and now I've had at least two requests this
Hiram Cuevas:
summer. And so I pinged Bill right away and a couple other
Hiram Cuevas:
folks, and I said, "What are you thinking about this? And
Hiram Cuevas:
everybody kind of was on the same page. This is a problem,
Hiram Cuevas:
and a lot of folks are using AI to generate code, and they're
Hiram Cuevas:
doing it within their Google domains, and it's problematic.
Tim Tillman:
I think you're absolutely right, and I would go
Tim Tillman:
up another level, and I would say that AI is starting to spark
Tim Tillman:
a renaissance in computing, and it's starting to get users
Tim Tillman:
interested in creating again. For a long time, they were just
Tim Tillman:
users, and creation meant a social media post, and now they
Tim Tillman:
have tools that make it easier to create actual content that
Tim Tillman:
didn't require the entire Adobe suite and 10 years of experience
Tim Tillman:
in order to do it. And they want to use those tools. They want to
Tim Tillman:
use them in the classroom. They want to do things like create
Tim Tillman:
their own applications, and they want to manipulate data and they
Tim Tillman:
want to do all of the great things that now they can do at
Tim Tillman:
home, but they can't do at school, and that's a problem.
Tim Tillman:
It's a huge problem because we don't have the structure and the
Tim Tillman:
controls in place to protect them when they are in our
Tim Tillman:
environment. And if they destroy their home environment-that's
Tim Tillman:
their problem, and they know that. But when they are using
Tim Tillman:
school data, when they are using school equipment, when they have
Tim Tillman:
the ability to expose dangers to others on the network, we have
Tim Tillman:
to put the controls in place. And how do you put controls in
Tim Tillman:
place for vibe coding? You just say no, right? Well, that's not
Tim Tillman:
the answer anybody wants to hear. So then you get a shadow
Tim Tillman:
IT problem of people just doing it on their own and telling
Tim Tillman:
students, "Well, you need to use this URL that I did for Replit,
Tim Tillman:
or I don't mean to focus on Replit, this one I use. Of
Tim Tillman:
saying, "Well, the school doesn't really do this. I do
Tim Tillman:
this on my own. It's my little hobby, and you guys just need to
Tim Tillman:
go to my URL and bypass the school, bypass everything that
Tim Tillman:
we have in place. So saying no used to work. Like in the late
Tim Tillman:
'90s, was just no. We would slam the curtain down and say no. Now
Tim Tillman:
it has to be a partnership. It has to be something that we say
Tim Tillman:
we know you want to do this, but you got to work with us, and you
Tim Tillman:
have to say we have to do this in a safe way. We have to do
Tim Tillman:
this in a compliant way. We have to do this basically
Tim Tillman:
understanding what the output is going to be, because you can
Tim Tillman:
literally vibe code products that will hack our network, and
Tim Tillman:
I can't stand for that. You can literally vibe code products
Tim Tillman:
that manipulate people and that manipulate content and change
Tim Tillman:
data and all of those things, and we have to have some idea
Tim Tillman:
that we're still in control, but yeah, you're right. That is the
Tim Tillman:
future of what do we do next? 10 years ago, we were worried about
Tim Tillman:
student hackers getting into grades, and that was never an
Tim Tillman:
issue. But like doing those kinds of things or focusing some
Tim Tillman:
sort of external bot network on us for a denial of service
Tim Tillman:
attack. Well, now almost all of the attacks are going to come
Tim Tillman:
internally. Of I just wanted to see what would happen if, or I
Tim Tillman:
wrote this thing and I don't know why it doesn't work, but
Tim Tillman:
all the other computers in the lab went off. So we have to be
Tim Tillman:
able to build that structure. We have to be able to build that
Tim Tillman:
perimeter, and I think there is a way to do it. I don't know
Tim Tillman:
what it is at the moment. You know, Gemini in particular,
Tim Tillman:
Google says that they have a education safe version of an
Tim Tillman:
LLM. Well, that was six months ago. What do you got today? It's
Tim Tillman:
changing too fast. It's changing too rapidly. Apple's getting
Tim Tillman:
ready to release AI on all the devices in their pockets. So,
Tim Tillman:
how do we protect against that? I don't have the answer, but
Tim Tillman:
we're going to have to get through it together. We're going
Tim Tillman:
to have to figure this out. The
Hiram Cuevas:
latest thing for me that is along that same line
Hiram Cuevas:
is when we had all of these transcription tools that started
Hiram Cuevas:
to appear in Zoom and Teams, and all of a sudden everybody was
Hiram Cuevas:
like, "Whoa, whoa, whoa! We can't have that.
Tim Tillman:
Yeah, I actually just had this conversation with
Tim Tillman:
one of my staff the other day, of when you see one of those
Tim Tillman:
bots pop into a Zoom, you don't know who allowed it in there.
Tim Tillman:
You don't know who requested it. So how do you know someone on
Tim Tillman:
the outside didn't do it? How do you know it's not just random?
Tim Tillman:
So my school district is actually in the process of
Tim Tillman:
saying we're not going to allow those kinds of bots for that
Tim Tillman:
very reason because you can't just click on the bot and say,
Tim Tillman:
"Well, who are you working on behalf of? It doesn't identify
Tim Tillman:
itself, so we can't allow any of them because typically we talk
Tim Tillman:
about student data and PII and everything else in those Zoom
Tim Tillman:
calls, or in our case, Google Meet calls. The default action
Tim Tillman:
of a user is to assume that that AI bot is there for good
Tim Tillman:
reasons, not for bad, and I have always, ever since I was a
Tim Tillman:
teenager, I have always thought about the bad side and always
Tim Tillman:
said, "What's the worst case scenario here? And how could
Tim Tillman:
this break? How can this be a problem? How could this destroy
Tim Tillman:
everything that we know and love? Right, like that's the
Tim Tillman:
thought patterns I'm always thinking about.
Bill Stites:
It's interesting too because I had a teacher, one
Bill Stites:
of our music teachers, built an app for band. Like, how did you
Bill Stites:
do it? He's like, "Oh, you basically vibe coded the whole
Bill Stites:
thing, and you know, it's a matter then of like, "All right,
Bill Stites:
well, then how can I use this then with students? Well, then
Bill Stites:
there are all the things that this person wasn't thinking
Bill Stites:
about, and maybe it doesn't even touch school data from that
Bill Stites:
perspective, but if you're going to ask a student to download it,
Bill Stites:
you didn't code it, so you don't know necessarily what you're
Bill Stites:
looking at in the code. You see that it works, but you don't
Bill Stites:
know exactly what it's doing. You don't know how easily it can
Bill Stites:
be maybe hacked or manipulated. We mentioned malware earlier.
Bill Stites:
How can that possibly go? Where is it going to be hosted. How
Bill Stites:
are you? All the things that you think about that are outside of
Bill Stites:
the cool factor of look what I just built. But okay, where does
Bill Stites:
it live? How do those are all the things that I don't think
Bill Stites:
vibe coding addresses in any way whatsoever? Just because you can
Bill Stites:
do a thing doesn't necessarily mean that you should, or have
Bill Stites:
the expectation that the school is going to adopt what you've
Bill Stites:
done just because you're proud of this thing that you built.
Tim Tillman:
Yeah, and it's awareness training as well. In
Tim Tillman:
my case, I know that my teachers don't have any particular idea
Tim Tillman:
of what they should and shouldn't be doing like that. Of
Tim Tillman:
well, what if I'm just using it for me. What if I want students
Tim Tillman:
to also access it? What if? What if? What if they don't have that
Tim Tillman:
PD that you mentioned earlier? Of there is a huge training and
Tim Tillman:
PD part of all of this new technology as well, and it is at
Tim Tillman:
least in my experience that is often the thing that gets
Tim Tillman:
overlooked every single time. And I have people on staff who
Tim Tillman:
say, "Well, no one taught me how to use it. Well, I'm not
Tim Tillman:
teaching you how to use it. I'm teaching you the responsibility
Tim Tillman:
of using it. I'm teaching you the impact of using it. I'm not
Tim Tillman:
going to teach you how to do prompting and how to actually
Tim Tillman:
structure this. Like somebody else is going to teach you that.
Tim Tillman:
But from my point of view, I'm going to teach you how to use it
Tim Tillman:
safely. What you can and can't do, or can and cannot expect to
Tim Tillman:
do, like you should not be developing an application that
Tim Tillman:
creates your own student database because it's too hard
Tim Tillman:
to use the one you use at school. Well, I only use it for
Tim Tillman:
my grades. I only use it for this. I only like all those
Tim Tillman:
things. Like I know it might be easier. It might even be
Tim Tillman:
superior, but you still can't do it. Like. That awareness
Tim Tillman:
training is critical, and I'll be the first to admit I haven't
Tim Tillman:
done it either. I know it needs to be done, but like everybody
Tim Tillman:
else, how do you get time with teachers? They don't have any
Tim Tillman:
time. You can't just create an online module that's three hours
Tim Tillman:
long and say, "Well, I hope you watched it. It's very difficult
Tim Tillman:
to do. It has to be done in small little chunks constantly
Tim Tillman:
and consistently, so that they start to get the message. That's
Tim Tillman:
how everything in the public world works. Of well, how did we
Tim Tillman:
teach people to use AI in the first place? Well, we started
Tim Tillman:
with this, and then it grew to this, and then it grew bigger
Tim Tillman:
and bigger and bigger. We have to do the same thing internally
Tim Tillman:
to say, here's something you could use in your classroom. Do
Tim Tillman:
you like it? Here's something that we vetted, and we say this
Tim Tillman:
is safe, so use this first.
Kevin Warenda:
I really like the way you framed some of these
Kevin Warenda:
issues, right? And the things that are keeping IT directors up
Kevin Warenda:
at night aren't the specific technologies per se, right? It's
Kevin Warenda:
the way in which they're used. I think probably all of us on this
Kevin Warenda:
cloud today, like we've grown up, we've probably been
Kevin Warenda:
gravitating towards technology, especially in education, because
Kevin Warenda:
we like the fact that it's been something we've all had to like
Kevin Warenda:
learn together. Learning how to use the thing is, you know, a
Kevin Warenda:
creative process. It's I got into this because I liked the
Kevin Warenda:
possibilities of what technology could do. But as you said, it's
Kevin Warenda:
the way in which the thing is used. I think for me, one of the
Kevin Warenda:
biggest challenges in today's market environment is it's
Kevin Warenda:
become almost this adversarial relationship with the vendor.
Kevin Warenda:
So, as you said back in the '90s, early 2000s, software was
Kevin Warenda:
packaged and installed. You could install and control that.
Kevin Warenda:
We don't have that control anymore. And now every vendor I
Kevin Warenda:
deal with is seemingly trying to boost adoption and engagement of
Kevin Warenda:
their products. So they just keep adding these things, and
Kevin Warenda:
then we're at odds of that. Of well, that's great. Those might
Kevin Warenda:
be great features, and we might want our user base, we might
Kevin Warenda:
want our faculty, staff, and students to be using those
Kevin Warenda:
things to benefit themselves or the school. But at the same
Kevin Warenda:
time, if we're not taking the time to really train folks on
Kevin Warenda:
the way in which you use that, you know, what data you're
Kevin Warenda:
putting into that, who owns that, where did it go? You know,
Kevin Warenda:
if we don't have the controls in place, forget it. But even if we
Kevin Warenda:
do, trying to educate people to say, "Come to the place where
Kevin Warenda:
we've created the walled garden or the what we believe is the
Kevin Warenda:
scarest possible way to use that. I like the way that you
Kevin Warenda:
frame that as a partnership. In Mike, we've been talking about
Kevin Warenda:
shadow IT for as long as I've been doing this. And the one
Kevin Warenda:
thing I say more recently to my audit and risk committee and our
Kevin Warenda:
risk management team. You know, vendor risk is at the top, as I
Kevin Warenda:
just talked about. But the shadow risk, especially shadow
Kevin Warenda:
AI now. But if we're not having the conversations with users, if
Kevin Warenda:
we're not educating them not on the use of the product, but the
Kevin Warenda:
way in which it is being used, you know, what you put into it
Kevin Warenda:
and what you're trying to get out of it, not the mechanics of
Kevin Warenda:
what buttons to push. I like the way that you frame that because
Kevin Warenda:
I think that's where we need to spend our time, especially as IT
Kevin Warenda:
leaders, building that trust with user bases for them to come
Kevin Warenda:
to us and tell us what they're doing, ask for help in that, and
Kevin Warenda:
then help educate them so that we know what they're working on,
Kevin Warenda:
what they're doing. We can help talk about the guardrails or the
Kevin Warenda:
guidelines they should be. Talk about what are you trying to
Kevin Warenda:
accomplish back to your original points about we need to justify
Kevin Warenda:
why we're doing any of this stuff, right? Especially if
Kevin Warenda:
you're going to spend money on it. Why are we putting resource
Kevin Warenda:
into that? Why are we building that app? Why are we allowing
Kevin Warenda:
people to use App Script? I've been able to have some of those
Kevin Warenda:
conversations with people and open those tools up to places
Kevin Warenda:
that I know because we've had the conversation and we built
Kevin Warenda:
partnership around that. I know what they're doing; it's
Kevin Warenda:
documented, and I know that it's making their life better. So I
Kevin Warenda:
like the way that you frame that, and I think that's an
Kevin Warenda:
important take home for all of us, especially as IT leaders, to
Kevin Warenda:
make sure that we're building enough trust that people will
Kevin Warenda:
come to us and work with us, so that we have those
Kevin Warenda:
opportunities. And it might be impromptu, it might be just in
Kevin Warenda:
time, it might be one at a time. If we can't get an entire
Kevin Warenda:
faculty or an entire staff to do a PD session, but let's utilize
Kevin Warenda:
those one-on-one conversations when people come to us with a
Kevin Warenda:
need that they want to fulfill with a piece of technology.
Kevin Warenda:
Let's utilize that opportunity, as you said, to guide them and
Kevin Warenda:
work together in that. So, thank you for sharing that framing. Is
Kevin Warenda:
that's important?
Bill Stites:
I love it. One of the last questions that I'll ask
you is:
If you had
Tim Tillman:
your wish list of things that you wanted to see a
Tim Tillman:
school doing, like I know you're doing a great job if you're
Tim Tillman:
doing X, Y, and Z things, or if you focus on these things,
Tim Tillman:
you'll really be able to set yourself up there. What would
Tim Tillman:
that be like? Just give our audience like the idea of like
Tim Tillman:
these are your top three, your top five things. You've touched
Tim Tillman:
on a number of them, but I think if you could enumerate what
Tim Tillman:
those might be, I think people would really appreciate that. So
Tim Tillman:
let's start with what I think is the easy one, which would be
Tim Tillman:
cybersecurity. So if I can talk to your superintendent or your
Tim Tillman:
head of school or your principal, whoever it is, and
Tim Tillman:
they can give me a 30-second elevator pitch about why
Tim Tillman:
cybersecurity is important in education. I think that you are
Tim Tillman:
halfway there. If I can go to a board meeting and they talk
Tim Tillman:
about cybersecurity in the public space, and they talk
Tim Tillman:
about funding cybersecurity, or they talk about an audit that
Tim Tillman:
they just had, or they talk about a penetration test that
Tim Tillman:
they just had, you are magnificent. On the other side.
Tim Tillman:
Is what I call the normal ed tech-the day-to-day operations
Tim Tillman:
and providing machines and software and services and
Tim Tillman:
internet access and all those things. I tend to focus more on
Tim Tillman:
budget and spend and an understanding of where we spend
Tim Tillman:
money and why we spend money. And I think that if you can
Tim Tillman:
really dive into what you're spending money on, then that
Tim Tillman:
shows what you're spending time on, and I can learn a lot by
Tim Tillman:
that. I can learn a lot about your district to see that most
Tim Tillman:
of your time is spent fixing printers, or most of your time
Tim Tillman:
is spent fixing aging hardware, or you have a huge budget for
Tim Tillman:
repair and replacement. That is so 1990s. I have a team right
Tim Tillman:
now that loves to fix computers, and I love to replace computers
Tim Tillman:
because I don't have time to fix them. I don't have the energy to
Tim Tillman:
fix them. I'm paying you guys too much to handle a
Tim Tillman:
screwdriver, or we should be looking at managed services to
Tim Tillman:
do that, right? So again, that's that budget thing of are we
Tim Tillman:
spending time spinning wheels on this, or have we outsourced that
Tim Tillman:
to someone who is better at it than us in the first place and
Tim Tillman:
can do it faster than us and probably for cheaper, so that we
Tim Tillman:
can focus on being knowledge workers and partnership workers
Tim Tillman:
and vendor managers in our own environment. Those are some of
Tim Tillman:
the things that I would say. Like, there is no like. If you
Tim Tillman:
have this one thing, then you're ready. It's more of attitude,
Tim Tillman:
culture, and behavior first. Too long we have thought about
Tim Tillman:
technology as just this. Oh well, it's highly advanced and
Tim Tillman:
it's hard to learn, and we have to hire specialized people. But
Tim Tillman:
it's really still just about people in general. Of we are
Tim Tillman:
building relationships, we are answering people's requests and
Tim Tillman:
their needs and their wants, and we just happen to be the ones
Tim Tillman:
who understand enough about how to put all those puzzle pieces
Tim Tillman:
together when it comes to technology. But those people are
Tim Tillman:
experts in how to put puzzle pieces together in their own
Tim Tillman:
worlds, and if we don't meet them halfway, they will do it
Tim Tillman:
themselves, and that's not what we want either. The shadow IT
Tim Tillman:
environment. I think it's a good barometer. If you were going to
Tim Tillman:
analyze a district, let's say you were going to apply for a
Tim Tillman:
job at a district, you look for these things, and you can get a
Tim Tillman:
sense of where do they stand at the moment.
Kevin Warenda:
I think that's a great place to land. If folks
Kevin Warenda:
want to learn more about Allied Cyber Academy or learn more
Kevin Warenda:
about what you're doing, how should they connect with you and
Kevin Warenda:
follow you? I have a vibe coded website, acak one two.com acak
Kevin Warenda:
twelve.com and it's pretty. That's awesome. You're a
Kevin Warenda:
professional, so I don't know. Was it five coded? All right,
Kevin Warenda:
that's Dr. Tim Tillman, founder of Allied Cyber Academy. Tim,
Kevin Warenda:
thanks for making the time today and sharing your expertise to
Kevin Warenda:
our listeners. I'm one of several guest hosts stepping in
Kevin Warenda:
this season, so if this is the first time you're hearing my
Kevin Warenda:
voice as host and not as a guest, you're not alone. Thanks
Kevin Warenda:
for sticking with the show, and we'll see you next episode.
Peter Frank:
This has been Talk Technology with Atlas, produced
Peter Frank:
by the Association of Technology Leaders in Independent Schools.
Peter Frank:
For more information about Atlas and Atlas membership, please
Peter Frank:
visit theatlas.org. If you enjoyed this discussion, please
Peter Frank:
subscribe, leave a review, and share this podcast with your
Peter Frank:
colleagues in the independent school community, thank you for
Peter Frank:
listening.
