Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for education

Campus network segmentation and safeguarding controls.

Educational institutions run open campus networks alongside research data, safeguarding records and financial systems. The openness that supports learning also creates cybersecurity challenges.

  • Safeguarding data risks
  • Open campus networks
  • Research data theft

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Educational networks balance openness with protection.

When a student’s personal device and the safeguarding database share one network, every compromised laptop is a potential route to the institution’s most sensitive data.

  1. Safeguarding and student data held in secured Firevault Bunkers.

  2. Access to safeguarding records needs authorisation from designated safeguarding leads, with full audit logging.

  3. Automated logging that can help support DfE cyber security standards, Ofsted safeguarding requirements and GDPR.

Challenge 1

Safeguarding data risks.

Safeguarding, SEN and child protection records need strong protection while staying accessible to authorised pastoral staff.

Answered byData held in Firevault Bunkers

Challenge 3

Research data theft.

Research in defence, pharmaceutical and technology fields is targeted by nation-state actors seeking intellectual property.

Answered byDfE and Ofsted evidence

The scenario

Scenario: university ransomware and research data theft.

An open network for learning should not be an open road to safeguarding records. Step through it, or play it through.

Step 1 of 2

The attack path

Ransomware enters through a student laptop on campus Wi-Fi and spreads across a flat network to administrative, research and student record systems.

Exam results are lost during clearing week, funded research projects are encrypted, and safeguarding records are exposed.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Separation of safeguarding records
DSL-approved
Access to safeguarding data
4
Campus zones
Logged
Evidence for DfE and Ofsted

Where each module sits

Where each Control module is deployed across staff, students, research and suppliers.

Education networks carry staff, students, research and many suppliers. Control places boundaries at the points that matter, aligned with the Jisc reference architecture.

  1. E0 to E1 linkFirebreakA physical cut between the public estate and operations.
  2. E0 to E1 and E1 to E2 linksValidateInbound traffic and identity requests are checked for origin and authority.
  3. E1 to E2 and E3 to E4 linksIsolateIdentity and research sit on separate physical fabrics, so a staff or student compromise does not reach sensitive research.
  4. E2 to E3 and E3 to E4 linksLockAccess ties to named users with the right entitlement.
  5. E3 to E4 linkTransferResearch data moves on a controlled route, with de-identification and a defined landing point.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Education

Data held in Firevault Bunkers

Safeguarding and student data held in secured Firevault Bunkers.

Education

Safeguarding access controls

Access to safeguarding records needs authorisation from designated safeguarding leads, with full audit logging.

Education

DfE and Ofsted evidence

Automated logging that can help support DfE cyber security standards, Ofsted safeguarding requirements and GDPR.

Education

Campus cellular management

Out-of-band cellular management keeps governance working independently of the campus network.

Education

Safeguarding audit trail

Every access to safeguarding data is recorded in tamper-evident logs for inspections and child protection reviews.

Education

Research data recovery

Verified configuration baselines support restoring funded project work if the campus network is compromised.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Campus network assessment

    Map all network paths between student access, research, administration and safeguarding data.

  2. 2

    Campus zone design

    Design physically separated zones for student, research, administrative and safeguarding use.

  3. 3

    Department pilot

    Deploy in a representative faculty or department with zone separation, safeguarding governance and compliance logging.

  4. 4

    Institution-wide deployment

    Roll out across the campus with verified baselines, continuous evidence and cellular management.

Questions

What teams ask first

The student network stays open for learning. Control separates it from research, administration and safeguarding, so openness in one zone does not become exposure in another.

Yes, with authorisation from designated safeguarding leads, and every access logged.

Research sits on its own physical fabric, and data leaves it only through Transfer, with de-identification and a defined landing point.

They stay in the student zone, with no path to safeguarding, research or administrative systems.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.