DavePa Posted May 12, 2017 Posted May 12, 2017 We have a lecturer who is a long time Mac user and cannot get on with the Windows laptop that we have given him (All of our desktops/laptops run Windows). He is asking that we put his personal MacBook onto the work network (not the BYOD network) which I am refusing to do - not on the grounds that it's a MacBook but the fact it's a personal device and therefore 'at risk' as far as data security, Virus, etc. He is likely to challenge this and take it to his manager and I wondered what others opinions on this are - how do you manage requests to allow personal devices onto your work network?
mavhc Posted May 12, 2017 Posted May 12, 2017 Point to your policies about data protection, tell them they can pay for a work, mac for him, and training for you, and all the software you need to protect the network from ransomware for another OS.
pcstru Posted May 12, 2017 Posted May 12, 2017 We put personal devices on our BYOD network but we would not put them on our main network. My rationale for this is that we protect endpoints on our main network via a variety of means (AV, Policy etc) and we can only do this with devices we own (and therefore have authority to configure as we require). We protect our network from malicious software which may be running on user owned devices, by only routing traffic from them out of our network.
Sydders01 Posted May 12, 2017 Posted May 12, 2017 (edited) Well,If I were you I would stand my ground. Device on the network are school owned devices. If He wants to connect to the school wifi, give him a code as a guest. Schools shared folders can only be on school devices for security reasons. He can use one drive on his Mac if he wants. I believe your there to secure and make the network reliable so Please stand your ground Edited May 12, 2017 by Sydders01
Oaktech Posted May 12, 2017 Posted May 12, 2017 (edited) Ideally, he can get over himself and just use what he's given, but as a path of least resistance I might consider puting it on the BYOD, installing RDP and telling him to use a remote dektop. Edited May 12, 2017 by Oaktech 1
Snoochieboochies Posted May 12, 2017 Posted May 12, 2017 This opens up a whole can of worms because other staff members are likely to start asking for the same thing. Guest and Network WIFI are kept separate for good reasons.
hardtailstar Posted May 12, 2017 Posted May 12, 2017 Tell him to use the windows device supplied and direct to data protection policies.
Brimstone Posted May 12, 2017 Posted May 12, 2017 I deary me...you would think someone would think outside the box here
jmak Posted May 12, 2017 Posted May 12, 2017 I deary me...you would think someone would think outside the box here Cryptic....?
DavePa Posted May 12, 2017 Author Posted May 12, 2017 (edited) Thanks all, we do have BYOD and that is what he connects to at present but he cannot access network shares or printers. I think that if I am overruled and asked by senior management to facilitate this I will bring my PC in from home and use that - it's a lot faster than my work one and I want to download some more of my Steam games...although I will quote data protection so it is very very unlikely that I will be asked to do this and I will want it in writing if they do - the email trail showing my reasons will be printed out, scanned and sent to a personal email and then stapled to the request Edited May 12, 2017 by DavePa
3s-gtech Posted May 12, 2017 Posted May 12, 2017 Our work network is strictly off limits to personally owned devices, for security. We offer BYOD, and we allow personal devices in school with no tech support or assurance as to their protection, security, etc. If a user can make a really good case for needing a different type of device (like a Mac, Chromebook, iPad etc) we will look into buying one for them if budget allows.
forkies Posted May 12, 2017 Posted May 12, 2017 Corporate network is for corporate devices. If he doesn't like using the corporate devices he can work for another corporation.
GrumbleDook Posted May 12, 2017 Posted May 12, 2017 He needs to submit his device to regular inspection (for any account held on the device), agree to have fully licensed (and running) AV software, to allow the school to dictate what software he runs whilst within schools, agree to have any monitoring agent the school requires, agrees to ensure that the device has its hard drive encrypted (a copy of the passphrase to be held by the IT Team), agrees to all traffic (on all ports, including HTTPS inspection) inbound and outbound from the device to be monitored whilst onsite and will have a dedicated account on the device (password with IT) that he uses solely for work activities whilst in the school (and when outside of work only uses *that* account for work activities). And this needs termly sign off to continue by the designated member of SLT (providing the above has been checked during that term and there are no issues) You then warn the powers that be that you can be flexible, but you may need to look into IDS and other enterprise tools that are used by large companies to manage BYOD. BYOD is scary ... but you can do things to allow it ... make it a combination of organisational and technical measures ... not purely technical limitations.
LeMarchand Posted May 12, 2017 Posted May 12, 2017 Do this, see if he can tell the difference: Transform Windows into MacOS Sierra Using Customization Pack - AskVG
Brimstone Posted May 12, 2017 Posted May 12, 2017 Corporate network is for corporate devices. If he doesn't like using the corporate devices he can work for another corporation. You're a school not a corporate network..... 1
RichCowell Posted May 12, 2017 Posted May 12, 2017 (edited) We put staff on the guest network if they want to use their own devices - if they need to access the network they can use remote access - works perfectly for us and has saved a whole lot of hassle... Edited May 12, 2017 by RichCowell
Brimstone Posted May 12, 2017 Posted May 12, 2017 (edited) He needs to submit his device to regular inspection (for any account held on the device), agree to have fully licensed (and running) AV software, to allow the school to dictate what software he runs whilst within schools, agree to have any monitoring agent the school requires, agrees to ensure that the device has its hard drive encrypted (a copy of the passphrase to be held by the IT Team), agrees to all traffic (on all ports, including HTTPS inspection) inbound and outbound from the device to be monitored whilst onsite and will have a dedicated account on the device (password with IT) that he uses solely for work activities whilst in the school (and when outside of work only uses *that* account for work activities). And this needs termly sign off to continue by the designated member of SLT (providing the above has been checked during that term and there are no issues) You then warn the powers that be that you can be flexible, but you may need to look into IDS and other enterprise tools that are used by large companies to manage BYOD. BYOD is scary ... but you can do things to allow it ... make it a combination of organisational and technical measures ... not purely technical limitations. Oh dear, oh dear, oh dear and we wonder technology in education is failing in most schools.... I have 2 primary schools with BYOD programs for mobile devices, I not saying there aren't challenges BUT there are major cost savings primarily in all the IT overheads and complicated processes outlined above. I met another school today who 6 months ago went down iOS and macOS completely not a windows device or (my new phrase) NON interactive whiteboards or Microsoft licensing anywhere in sight. The school have saved over £16,000 on printing, safeguarding systems (they have filtering) and MS Licences in the first six months. Sorry if this appears like a rant but this school I met today is WHY I work in education, you may start to hear more about this absolutely fantastic school in the press shortly. Edited May 12, 2017 by Brimstone
GrumbleDook Posted May 12, 2017 Posted May 12, 2017 Oh dear, oh dear, oh dear and we wonder technology in education is failing in most schools.... I have 2 primary schools with BYOD programs for mobile devices, I not saying there aren't challenges BUT there are major cost savings primarily in all the IT overheads and complicated processes outlined above. I met another school today who 6 months ago went down iOS and macOS completely not a windows device or (my new phrase) NON interactive whiteboards or Microsoft licensing anywhere in sight. The school have saved over £16,000 on printing, safeguarding systems (they have filtering) and MS Licences in the first six months. Sorry if this appears like a rant but this school I met today is WHY I work in education, you may start to hear more about this absolutely fantastic school in the press shortly. I work for an MDM provider so support BYOD, but there is a difference between BYOD for students and staff. If there is a BYOD network and a general network then I would not expect the general network to be set up to be protected from BYOD devices ... You have a legal duty to protect data. In this particular scenario the organisational methods of restraint are there because the technical systems aren't. Yes, the cost savings for BYOD and mobile devices can be substantial, but some reinvestment of savings is needed.
FN-GM Posted May 12, 2017 Posted May 12, 2017 You're a school not a corporate network..... The term is commonly used in IT as an equivalent to Production Network. - - - Updated - - - Just quote NHS IT problems, kill the idea! 1
forkies Posted May 12, 2017 Posted May 12, 2017 You're a school not a corporate network..... The original poster called them a lecturer which make me believe they are a university. Also all school academies are businesses which makes there networks "business networks" or as everyone I know call them "corporate networks". Either way you don't go to a job and say, I won't use any of your equipment. You adapt.
DavePa Posted May 13, 2017 Author Posted May 13, 2017 The original poster called them a lecturer which make me believe they are a university. We're a college but have both tutors and lecturers depending on the level of the course being taught. I did consider RDP but of course he's still having to use Windows. I was thinking about this yesterday evening and I might suggest that he uses OneDrive/Dropbox to save the files (data protection issues?) so he can then work on them from his MacBook and only use his Windows laptop to print them. Most other things he needs to use are web based so can be used from either. There may be a way of allowing him access to printers through the BYOD - we can allow forwarding to a single IP address (or range) and as printers are dumb devices there is little to no risk in doing so but that needs approval from higher up 1
snagrat Posted May 13, 2017 Posted May 13, 2017 We're a college but have both tutors and lecturers depending on the level of the course being taught. I did consider RDP but of course he's still having to use Windows. I was thinking about this yesterday evening and I might suggest that he uses OneDrive/Dropbox to save the files (data protection issues?) so he can then work on them from his MacBook and only use his Windows laptop to print them. Most other things he needs to use are web based so can be used from either. There may be a way of allowing him access to printers through the BYOD - we can allow forwarding to a single IP address (or range) and as printers are dumb devices there is little to no risk in doing so but that needs approval from higher up You can RDP from a Mac
DavePa Posted May 13, 2017 Author Posted May 13, 2017 You can RDP from a Mac ...but to a Windows session so at that point he still needs to use Windows It's the OS as much (or more) than the hardware!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now