Need some advise

- Is Drupal is the right platform to develop this school system?

Based on the information given, any solution can be right, including WordPress, Joomla, custom PHP, or other technologies. What will differentiate these solutions as the correct solution for you, will be the details of the original [business] problem to be resolved. That is, how the school management processes are intended and designed to work for people, using what information. (Rather than the solution technology that is chosen before the [business] problem is understood in detail.)

This is very much a question of how, in the context of the school, people interact with processes and information. The correct technology solution will support that interaction at minimal operational, maintenance, security, and financial cost.

2- Is Drupal secure to handle the security for our data?

This depends upon how you want your data secured; and only if used in a secure manner. See this post: https://www.drupal.org/node/2423459#comment-9616909

3- Can you provide me any advise that will make my project successful? [Sic]

Postpone selecting the solution technology (i.e., Drupal, WordPress, Joomla, et al) until you've defined the [business] problem in terms of process functionality and performance, and information. The "[business] problem" is the attributes and characteristics of the functions and performance of the "school system management" processes and information. Note that this is entirely independent of any particular technology solution (although "online" is presumed); but is wholly dependent upon how you want to run the school management processes, and with what information. Once this is understood (and documented), you are then in a position to screen out the various technology solution alternatives to get to the correct technology platform.

Note that the "correct" technology platform is that platform that meets your [business] requirements for the school management system, including lowest operational, maintenance, security, and financial cost.

Here is general information regarding how systems (such as a school management system) are developed and implemented: https://en.wikipedia.org/wiki/Systems_Development_Life_Cycle. From this perspective, the selection of the particular technology solution should not occur until the [business] design is complete; else, that technology selection prejudices the development of the system.

If you are not familiar with defining the [business] solution in preparation to selecting technology solutions, then I suggest that you first obtain outside help from a second party to define the school management processes and information, and fully document this information. This should result in producing a set of design requirement documents, which may be used as the basis for evaluating and procuring the technology solution.

Then as a next step, use the documented results as a (contract, agreement, etc.) basis to procure the technology solutions from competing third-party solution providers (such as Drupal, Joomla, WordPress developers).

The arrangement with the selected third-party solution provider will then be the provider's ability to deliver a system that meets your design requirements. Although this approach requires much more work on the front end, you will be better positioned to get a solution that meets your needs at the back end.

4- Do I need other security extensions or firewalls to be installed ?

The security solutions will be driven by the requirements of the school management system and its information: what information must be protected, and to what extent? This question will be answered as a result of progressing through the first phases of the systems development life cycle.

In closing, is Drupal "right" for the school management system? Only if the particular Drupal solution meets your school's (people, process, information) needs; and understanding those needs (i.e., requirements) is critical for determining whether any technology solution is the correct solution.

As an alternative, short of defining those needs, you can try any mainstream content management system and see what works best over time; Drupal included. This will result in a lot of trial and error; but, you can eventually get to your preferred solution.

I'd say that Drupal is the right solution for this, as I'm building a school management system in Drupal right now that does most of those things (and actually, I may incorporate some of the things you've mentioned into the system). But other systems could do it as well.

I've successfully used Drupal's Organic Groups subsystem to manage access to individual students' data. Each student is actually a group, and may have parents, teachers and admins associated with it, with various levels of CRUD permissions on the various content types attached to the Student.
It got me most of what I needed, but required some custom module development to meet some of the finer requirements.

I my experience, the Drupal API is better documented and more flexible than others I've used, so if your project is at all ambitious, and you have access to qualified Drupal development help, it can certainly get you pretty much anywhere you need to go.

Yes Drupal is the right Platform. You can go ahead. If you learned Drupal well, you can do it. You will also get a strong support from this community. For Contrib Modules and themes, you have to check the code status for the security that it is vulnerable or not.