BYOD Considerations - What is required?

[MrPARRman]

Hi All,

 

I have been asked to look into a BYOD scheme for the school I work in and want to ensure that I have all my bases covered and have a full understanding of what is required before committing to a timescale. I have searched around at the way that other people on here have done it but not being all that high end technical a lot of it goes over my head. (I more so manage my site and technicians)

 

I have spoken with our higher end techs and they have said that realistically the best way of achieving this and keeping the network secure would be to VLAN a BYOD wireless network and then use WPAD/Transparent proxy and have students use Home Access + for there network files which sounds simple enough, until you look at a cab and see the previous ICT never labeled the ports so working out what runs where is always a time consuming exercise.

 

We are split over 3 separate buildings, with one building not having a managed solution. (Standard standalone POE APs) - Would I be right in thinking this would need to be replaced to make BYOD a reality?

 

Other glaringly obvious questions are:

 

How would I give students the ability to print? Is this even possible?

How would I be able to track which user is browsing which website to ensure child safeguarding?

 

Really I would like to know in a more simplistic explaining how your sites are currently achieving this, what technologies you are using, and in which effective way they are being used. :-)

 

Thank you for any help/insight you can provide.

[pete]

H

I have spoken with our higher end techs and they have said that realistically the best way of achieving this and keeping the network secure would be to VLAN a BYOD wireless network and then use WPAD/Transparent proxy and have students use Home Access + for there network files which sounds simple enough, until you look at a cab and see the previous ICT never labeled the ports so working out what runs where is always a time consuming exercise.

 

If you want to VLAN (you do), you'll have to bite the bullet and work out what goes where. At the very least you'll need to discover which ports your APs are connected to. You should be able to get a lot of that info using CDP on your switches:

 

Show what's connected to all ports:

show cdp neighbours

 

In more detail:

show cdp neighbours detail

 

For a specific port:

show cdp neighbours InterfaceNumber detail

 

Note that the info isn't infallible, but it makes verifying much faster.

 

We are split over 3 separate buildings, with one building not having a managed solution. (Standard standalone POE APs) - Would I be right in thinking this would need to be replaced to make BYOD a reality?

 

If your managed wireless and the standalones are going to ask a RADIUS server or other central source of truth to see if a device or end-user is allowed access, not necessarily, but it would probably be easier to implement.

 

How would I give students the ability to print? Is this even possible?

 

Print over http/https. Your print management solution may already support it (Papercut does, for example). @CyberNerd on here uses it IIRC

 

How would I be able to track which user is browsing which website to ensure child safeguarding?

 

How will students authenticate before they can access the BYOD network? Using their normal credentials? Let's assume so.

 

A student might connect to BYOD Wifi and get redirected to a captive portal that asks them to identify themselves before they get any further. They provide appropriate credentials and then they're allowed access to the BYOD vlan which gives access to web printing, VLE for file access and the Internet. If your captive portal can pass those credentials or a notification (user X is on IP.AD.DR.ESS) onto your proxy server then you need to do nothing else. Having an IP/User match on two different systems would work, but would make investigating things more annoying.

 

If it can't pass those credentials on, you'll need to configure your proxy server to prompt for credentials if it gets requests from the BYOD vlan.

 

In addition, you probably want your capitve portal (Microsoft's NAC or open-source PacketFence, for example) to eyeball BYOD clients for anything dodgy before you let them on the network and kick them off if shenanigans are detected. You may wish to configure it so students credentials can only be tied to one device initially to deter them from logging in as another student. For those students with N+1 devices, they can ask IT for additional allocations.

Edited August 16, 2013 by pete

[Ephelyon]

Bear in mind that if a child has a data plan on a smartphone or tablet, and has signal, there's nothing you can do about inappropriate browsing or texting while they're not using your WiFi.

[Web-Help-Desk-Software]

Bear in mind that if a child has a data plan on a smartphone or tablet, and has signal, there's nothing you can do about inappropriate browsing or texting while they're not using your WiFi.

 

I've struggled with this one myself....for student AND faculty. Yes, the downside is that they can do inappropriate browsing. However, they shouldn't be able to to anything malicious or accidental to the school's IT / network infrastructure. If they are off the network (and on their own plan), they shouldn't be able to do anything dodgy. Yes?

 

As for students looking at inappropriate websites (on their own network), I think that goes into the "nudey magazine hiding in the math book" file and falls under teacher / parent disciplinary actions. It should not impact anything IT related.

 

Am I looking at this through the correct prism?

[Ephelyon]

You still can't obviate the risk of cyberbullying by text, but this is an issue for the Safeguarding Lead, not the IT Manager. They are therefore the person who should be apprised (don't skimp on it).

[IrritableTech]

There are two sides here... The technical implications and the safety/educational use/policy side of things.

 

I talk in brief about both sides on my blog. Perhaps it'll answer some of your questions, but feel free to ask here if I can help further.

http://irritabletech.co.uk/tag/byod/

[twin--turbo]

We simply give them secure access to our VDI.

 

one client can't even talk to another on the wifi ( preventing pupils atacking each other via our system )

the BYOD device firewalls all connections, a captive portal lets registerd users access VDI and only VDI.

 

they get the same desktop , lockdowns etc as using one of our PC's.

 

so they are subject to the same security as normal.

 

 

they can't be bothered to use BYOD as the can't use it as a way to get un-filtered internet.

 

out of 300 possible 6fm user. 8 signed up , 1 used it.

 

Rob

[Ephelyon]

We apply subnet rules, such that the only device that can be accessed is the Internet gateway. That provides effective isolation without actually configuring isolation...

[MatthewL]

As regards printing there is other options to PaperCut, drop me a PM if you are interested.