+ Post New Thread
Results 1 to 14 of 14
Windows Thread, Do you stop students from saving *.JS files in their H:\ drives ? in Technical; I'm just doing an audit on security. Students in ICT seem to be saving *.js files - could these pose ...
  1. #1
    kennysarmy's Avatar
    Join Date
    Oct 2005
    Location
    UK
    Posts
    1,401
    Thank Post
    93
    Thanked 48 Times in 34 Posts
    Rep Power
    31

    Do you stop students from saving *.JS files in their H:\ drives ?

    I'm just doing an audit on security.

    Students in ICT seem to be saving *.js files - could these pose a security risk?

    Cheers

  2. #2

    DaveP's Avatar
    Join Date
    Oct 2006
    Location
    Can't talk now: The mother-ship is calling!
    Posts
    9,377
    Thank Post
    354
    Thanked 1,349 Times in 927 Posts
    Blog Entries
    4
    Rep Power
    1203
    Yes we prevent students saving *.js and some other file types. We use FSRM [File Server Resource Manager] to enforce these settings.

  3. #3


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,706
    Thank Post
    354
    Thanked 807 Times in 722 Posts
    Rep Power
    348
    FSRM is the king here and easy to set up.

  4. #4
    kennysarmy's Avatar
    Join Date
    Oct 2005
    Location
    UK
    Posts
    1,401
    Thank Post
    93
    Thanked 48 Times in 34 Posts
    Rep Power
    31
    But do *.js files actually pose a threat to network security?

    I need some proof before I annoy the IT teaching staff ....

  5. #5
    kennysarmy's Avatar
    Join Date
    Oct 2005
    Location
    UK
    Posts
    1,401
    Thank Post
    93
    Thanked 48 Times in 34 Posts
    Rep Power
    31
    Anyone?

  6. #6
    gmonks's Avatar
    Join Date
    Oct 2012
    Location
    Bedfordshire
    Posts
    203
    Thank Post
    112
    Thanked 24 Times in 17 Posts
    Rep Power
    11
    Quote Originally Posted by kennysarmy View Post
    But do *.js files actually pose a threat to network security?

    I need some proof before I annoy the IT teaching staff ....
    We've never had any problems with .js files, neither did we in the previous school I worked in.

  7. #7
    SovietRussia's Avatar
    Join Date
    Mar 2013
    Location
    Powys, Wales
    Posts
    708
    Thank Post
    77
    Thanked 159 Times in 124 Posts
    Rep Power
    49
    I doubt you could take over the network with them.

  8. #8

    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,584
    Thank Post
    59
    Thanked 371 Times in 287 Posts
    Blog Entries
    7
    Rep Power
    134
    Quote Originally Posted by kennysarmy View Post
    But do *.js files actually pose a threat to network security?

    I need some proof before I annoy the IT teaching staff ....
    I'd say no more or no less than a BAT, VBS, PS1, JAR or CMD file personally.

    What's actually in theses JS files? Have you examined them?

  9. #9


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,033 Times in 813 Posts
    Rep Power
    341
    Quote Originally Posted by SovietRussia View Post
    I doubt you could take over the network with them.
    I bet no-one could write a bruteforce script in javascript and point it at my SIMS server.
    Safe in the knowledge that what I don't know wont hurt me.

  10. #10

    Join Date
    Jan 2007
    Location
    Nottinghamshire
    Posts
    531
    Thank Post
    2
    Thanked 84 Times in 58 Posts
    Rep Power
    39
    Side a) if a program can break your network, your network is broken, why aren't you blocking multiple connection attempts, or using QoS to stop networks being overloaded
    Side b) who has time for that, someone's asked how to use the shift key again.

  11. #11
    kennysarmy's Avatar
    Join Date
    Oct 2005
    Location
    UK
    Posts
    1,401
    Thank Post
    93
    Thanked 48 Times in 34 Posts
    Rep Power
    31
    Quote Originally Posted by Norphy View Post
    I'd say no more or no less than a BAT, VBS, PS1, JAR or CMD file personally.

    What's actually in theses JS files? Have you examined them?
    Yes, mostly they look safe enough and are being used in IT lessons - website design by the looks.
    However, it's not the ones that look safe I'm worried about - it's the ones that some little kid brings in to school and saves on the network that CAN do harm....

  12. #12

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,529
    Thank Post
    527
    Thanked 2,648 Times in 2,049 Posts
    Blog Entries
    24
    Rep Power
    925
    Quote Originally Posted by CyberNerd View Post
    I bet no-one could write a bruteforce script in javascript and point it at my SIMS server.
    Safe in the knowledge that what I don't know wont hurt me.
    Could do that in Excel with macros, or live in a browser via sites like jsfiddle.

    Kinda pointless blocking javascript files if you allow web browsers.

  13. #13

    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,584
    Thank Post
    59
    Thanked 371 Times in 287 Posts
    Blog Entries
    7
    Rep Power
    134
    Quote Originally Posted by kennysarmy View Post
    Yes, mostly they look safe enough and are being used in IT lessons - website design by the looks.
    However, it's not the ones that look safe I'm worried about - it's the ones that some little kid brings in to school and saves on the network that CAN do harm....
    You're never going to solve that problem. If it's not a JS file, it's a SWF instead. Or an Excel Macro. Or an SWF called by an Excel Macro. Or a PDF file. There are a million and one file formats out there which may potentially cause harm, the only thing you can do is to mitigate that risk as much as possible. Perhaps a software restriction policy is in order here, only allow executable files to be run from approved locations. If the javascript files are being used for web development that shouldn't hurt.

  14. #14
    kennysarmy's Avatar
    Join Date
    Oct 2005
    Location
    UK
    Posts
    1,401
    Thank Post
    93
    Thanked 48 Times in 34 Posts
    Rep Power
    31
    Quote Originally Posted by Norphy View Post
    You're never going to solve that problem. If it's not a JS file, it's a SWF instead. Or an Excel Macro. Or an SWF called by an Excel Macro. Or a PDF file. There are a million and one file formats out there which may potentially cause harm, the only thing you can do is to mitigate that risk as much as possible. Perhaps a software restriction policy is in order here, only allow executable files to be run from approved locations. If the javascript files are being used for web development that shouldn't hurt.
    Yep, SRP is in place.
    Was just looking at if we should tighten further but think we are going to let *.JS files stay



SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 5
    Last Post: 15th January 2013, 01:13 PM
  2. How do you stop synchronisation on an ex networked PC
    By speckytecky in forum How do you do....it?
    Replies: 5
    Last Post: 24th August 2008, 11:15 AM
  3. how do you stop kids from running exe from IE.
    By timbo343 in forum Windows
    Replies: 15
    Last Post: 8th January 2008, 03:14 PM
  4. What speed Internet do you get provided from your LEA
    By mattpant in forum Wireless Networks
    Replies: 60
    Last Post: 20th March 2007, 09:38 AM
  5. How do you stop kids saving tons of jpgs?
    By woody in forum How do you do....it?
    Replies: 8
    Last Post: 6th December 2006, 12:47 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •