Flat Networks

[Tiger]

Hi all,

just wondered what the general thoughts were on combining administration network with curriculum network hence creating a 'flat network' across a school.

We kept two network so that SQL or Port 80 on admin servers are kept isoated from the curriculum PCs. What specifically bothers me is the fact that we even have adult evening classes in IT and I am rather concerned who may get access to the whole network.

What prompted this that the head wants teachers accessing admin servers from class rooms for attendance registration. But I think there is a serious data security risks here with sensitive pupils information becoming vulnerable and hence certainly infringing Data Protection Act etc...

I presume I am in a minority for keeping isolated networks, but I wondered whether there were any other schools in a similar situation.

[FN-GM]

We have a flat network here with no problems, if it is all secured properly you shouldn't have any problems.

Z

[GrumbleDook]

A single or integrated domain structure is increasingly common in schools.

This could be for a variety of reasons. A simpler structure to support, more flexibility of resources, greater benefit to T&L or to administration of the school.

Security reasons not to do it? Actually ... very few now. DPA is not an issue really as most teachers will keep some information on students on their home areas (mark sheets, SEN info) and so if they walk away from a logged in machine it makes no difference whether you are on a single domain or on separate admin / curriculum.

There are many ways to skin this cat though ... here are a few ideas.

Firstly ... a single domain in a single forest is one thing ... but you can now form trusts between domains and forests with ease (ok ... maybe not with ease but it is not the arcane art is has previously been ... no goats or chickens will lose their life).

Secondly ... you can look at alternative methods of accessing the MIS to perform tasks such as register marking, report writing ... web-based plug-ins to learning platforms ... remote access to the admin systems (MS Terminal Servers coupled with Sun's Secure Global Desktop is a nice one).

Thirdly ... the use of virtual machines on staff laptops could be an option. A W2K Pro install on Virtual PC or VMWare that is hooked to the admin domain (the desktop / laptop is on the curriculum domain) could be handy and save on machines.

Just a few ideas.

[jcollings]

I agree with Zak - as long as you secure it properly it's fine.

We have too much crossover between curriculum and admin staff and data to keep it seperate. We've had a single network for 7 years and (touch wood) haven't had any issues.

[Oops_my_bad]

Don't worry.. old school will be along shortly to burn you all down for having a single network

(single network here, using ipsec between SIMS/finance server and sims clients)

[Oops_my_bad]

and teachers know in no uncertain terms they will loose several fingers if they leave a SIMS PC unlocked

PS why cant you edit your own posts in this forum? That's just crazy.

[EduTech]

@ teddy - u can edit ur own posts in this forum mate.. top right of ur post button saying edit

and i agree as long as its secured you shouldn't have any problems

Regards
James

p.s. i like that ''teachers know in no uncertain terms they will loose several fingers if they leave a SIMS PC unlocked''

[EduTech]

oopps sorry i take that back now you can't... **goes all red with embarracement** lol i thought you could

James

[rrichmond]

Not sure if this is exaclty related as it seems you are using a Microsoft network?

We have student Machines on a different LAN to Teachers PCs, which is different again for Admin, Wireless, etc.....

We use around 16 different LANS. It makes security alot easier.

[rrichmond]

And furthermore, It looks like this post is set up so you can't edit.... I can edit on other posts.....

[enjay]

oopps sorry i take that back now you can't... **goes all red with embarracement** lol i thought you could

You did used to be able to edit them...

Anyhoo - as others have said, a well-secured single network is not a security risk. A poorly-secured one is, but then so is a poorly-secured two network system since, as Tony points out, teachers have all sorts of stuff in their home areas anyway.

As with all network security, the biggest hole is your users - the ones who share passwords, write passwords in their planners, leave computers logged in over break/lunch because logging back on afterwards "takes too long". You can put every security measure you want in place to protect your data, but what MI5 don't leave in a taxi, the Government will lose in the post.

[GrumbleDook]

Moved to the Windows forum (as this is a Windows design question really). This should also fix edit permissions on posts too.

[cookie_monster]

TeddyKGB

Do you have ipsec enabled just to your MIS server? Is that just from admin stations to that server?

[djm968]

Not sure if this is exaclty related as it seems you are using a Microsoft network?

We have student Machines on a different LAN to Teachers PCs, which is different again for Admin, Wireless, etc.....

We use around 16 different LANS. It makes security alot easier.

Do you mean VLANS?

VLANS are a good idea if you are worried abouth security.

[Geoff]

VLANs are not an effective security measure.