Do you stop students from saving *.JS files in their H:\ drives ?

[kennysarmy]

I'm just doing an audit on security.

 

Students in ICT seem to be saving *.js files - could these pose a security risk?

 

Cheers

[6Foot2]

Yes we prevent students saving *.js and some other file types. We use FSRM [File Server Resource Manager] to enforce these settings.

[kmount]

FSRM is the king here and easy to set up.

[kennysarmy]

But do *.js files actually pose a threat to network security?

 

I need some proof before I annoy the IT teaching staff ....

[kennysarmy]

Anyone?

[gmonks]

But do *.js files actually pose a threat to network security?

 

I need some proof before I annoy the IT teaching staff ....

 

We've never had any problems with .js files, neither did we in the previous school I worked in.

[SovietRussia]

I doubt you could take over the network with them.

[Norphy]

But do *.js files actually pose a threat to network security?

 

I need some proof before I annoy the IT teaching staff ....

 

I'd say no more or no less than a BAT, VBS, PS1, JAR or CMD file personally.

 

What's actually in theses JS files? Have you examined them?

[CyberNerd]

I doubt you could take over the network with them.

 

I bet no-one could write a bruteforce script in javascript and point it at my SIMS server.

Safe in the knowledge that what I don't know wont hurt me.

[mavhc]

Side a) if a program can break your network, your network is broken, why aren't you blocking multiple connection attempts, or using QoS to stop networks being overloaded

Side b) who has time for that, someone's asked how to use the shift key again.

[kennysarmy]

I'd say no more or no less than a BAT, VBS, PS1, JAR or CMD file personally.

 

What's actually in theses JS files? Have you examined them?

 

Yes, mostly they look safe enough and are being used in IT lessons - website design by the looks.

However, it's not the ones that look safe I'm worried about - it's the ones that some little kid brings in to school and saves on the network that CAN do harm....

[localzuk]

I bet no-one could write a bruteforce script in javascript and point it at my SIMS server.

Safe in the knowledge that what I don't know wont hurt me.

 

Could do that in Excel with macros, or live in a browser via sites like jsfiddle.

 

Kinda pointless blocking javascript files if you allow web browsers.

[Norphy]

Yes, mostly they look safe enough and are being used in IT lessons - website design by the looks.

However, it's not the ones that look safe I'm worried about - it's the ones that some little kid brings in to school and saves on the network that CAN do harm....

 

You're never going to solve that problem. If it's not a JS file, it's a SWF instead. Or an Excel Macro. Or an SWF called by an Excel Macro. Or a PDF file. There are a million and one file formats out there which may potentially cause harm, the only thing you can do is to mitigate that risk as much as possible. Perhaps a software restriction policy is in order here, only allow executable files to be run from approved locations. If the javascript files are being used for web development that shouldn't hurt.

[kennysarmy]

You're never going to solve that problem. If it's not a JS file, it's a SWF instead. Or an Excel Macro. Or an SWF called by an Excel Macro. Or a PDF file. There are a million and one file formats out there which may potentially cause harm, the only thing you can do is to mitigate that risk as much as possible. Perhaps a software restriction policy is in order here, only allow executable files to be run from approved locations. If the javascript files are being used for web development that shouldn't hurt.

 

Yep, SRP is in place.

Was just looking at if we should tighten further but think we are going to let *.JS files stay