Esafe monitoring

[manick]

Hi all,

 

One of our SLT has asked me to look at Esafe monitoring. Before I go too far into it, I want to get a handle on cost. I've looked on their website for a sales number but can't find one, instead it's "fill out this form and well contact you", so I'm hazarding a guess they go for the hard sell (their blurb suggests that) and I want to avoid that. Is anybody using them? if so, any good? roughly how much is it (I'm aware it's per student).

 

Thank you

 

Nick

[pete]

so I'm hazarding a guess they go for the hard sell

Yup (standard "think of the children" approach that pastoral staff are susceptible to)

Is anybody using them?

Yup

if so, any good?

 

Bear in mind I'm approaching this with an IT/Data Protection hat.

 

From a technical perspective? It has problems.

 

1. The client is flaky - I can open up event logs on any PC running the client and discover Guardware services have fallen over multiple times per day.
   
2. If a staff member comes to me with "Internet problems", most of the time it's because Guardware has fallen over (it does a local proxy of web requests and a MITM for HTTPS sites).
   
3. If your proxy, antivirus and Guardware are doing MITM for HTTPS, you're going to have a bad day. Disable at least one MITM option or the Internet will grind.
   
4. It misses things that should be picked up easily (we find out because Smoothwall catches them). I can accept a bit of misses on both sides, but some of the things it's missed have been things it really should have caught.
   
5. They justify not making uninstall easy via SCCM or whatever as necessary for safeguarding, ignoring the fact that simply deleting the associated services disables their software.
   
6. They don't inform customers about new versions that fix problems. We have to chase them. A visiting sales rep admitted to our DSL last week that he actively avoided IT staff because we tend to ask difficult questions like "why did you sit on the latest release of your product when you know it fixes high cpu usage in Chrome?"
   

 

Safeguarding? Mixed

1. Compared to Smoothwall, it lacks context and so (when alerts are passed to us) it generates more work than it should.
   
2. Events are a snapshot in time, they aren't compared to what else was going on with that session. Alerts are always assumed to be the worst possible scenario rather than assessing "OK, what else was that student doing within a ~10 minute window?". For a service that uses humans to review alerts, it's....lacking
   
3. For the purposes of industrial tribunals, police or courts, the evidence is inadmissable. A school hoping to use information sourced from eSafe to justify a decision about a person will be disappointed.
   
4. Our DSL loves it, but she's aware I think the implementation is pants.
   

 

Data Protection Also mixed

1. eSafe captures everything, including things you may not want it to (Payroll, Personnel data, SIMS information). You can choose to exclude certain apps (we chose SIMS, for example, given the sensitive nature of the information).
   
2. By default, they will want to store the data long past the school's retention period to make their software more effective. State your retention times up-front.
   

 

roughly how much is it (I'm aware it's per student).

 

I want to say £2K/yr for us (~800).

 

Now, we also trialled Securus and found it more annoying than eSafe. Currently I'm interested in Visigo from Smoothwall to see how well it does in comparison.

 

My ideal system is something that can pull in Smoothwall safeguarding alerts and compare them to eSafe/whatever alerts to give more context surrounding an event. Think something like a Kibana dashboard for safeguarding.

[manick]

Hi Pete,

 

Thank you very much for this, very much appreciated. I will make a note to give that one a miss, however I am looking for information relating to Esafe monitoring from Esafe Global in Salford.

 

Cheers

 

Nick

Edited September 26, 2018 by manick

[russlp]

We use it and pretty much have the same experience as Pete. I believe Visigo from Smoothwall is cheaper, does the same thing (if not better) and when we tried it a lot easier to deploy plus a portal for IT staff to go with it so you can see it's working. Haven't managed to convince my DSL to switch just yet however!

[pete]

Hi Pete,

 

Thank you very much for this, very much appreciated. I will make a note to give that one a miss, however I am looking for information relating to Esafe monitoring from Esafe Global in Salford.

 

Cheers

 

Nick

 

Hi Nick,

 

It's the same people (unless Mark Donkersley has started yet another company beginning with "eSafe".). They use a product called Guardware to perform the service.

 

cheers

 

Pete

[manick]

Ahh, OK. I'd hazard a guess same bloke, possibly started again with a very similar name. This firm is esafeglobal based in Salford, the one you're referring to is Guardware in Bolton, and Mark Donkersley is involved in both.

 

Thanks Pete!

[Snuffkins]

We use it and pretty much have the same experience as Pete. I believe Visigo from Smoothwall is cheaper, does the same thing (if not better) and when we tried it a lot easier to deploy plus a portal for IT staff to go with it so you can see it's working. Haven't managed to convince my DSL to switch just yet however!

 

There is a portal to see client deployment info for ESafe, they just don't seem to tell anyone. Be worth asking them for access, although it doesn't tell you much, at least you can see where it's installed and what version of the client it's running or not running...

[MagicMadjeski]

Client is still 32Bit only and I've had issues with ESET thinking the eSafe client is malware and causing a headache with constant virus scans. Very good support form them though.

[ataylor]

Currently trialing Visigo here as we are fed up with esafe including all of the points from Pete, I find their support to be very condescending and have a "its your fault" attitude, they also have a policy that ICT technicians should not remove their software without their approval first.

 

So far Visigo seems to be easier to manage, more in depth reports with MUCH better context regarding issues. From my understanding all Visigo do is install a keyboard & mouse driver (no image detection). Where esafe do keylogging, image detection and ssl interception.

 

Currently we are getting more relevant reports from Visigo, one of our last reports from esafe was students searching for "Tor" after additional research checking their search history in google, they were searching for torque. Visigo did not send us this notification and if they did, you can log into their portal and see other text typed around the incident along with screenshots to give more context.

 

EDIT: Last time our rep was down, I queried if esafe was working on a portal for logging incidents similar to the function Visigo has, his suggestion was to log it all in an excel sheet or implement my OWN platform as another one of their customers has!

Edited October 10, 2018 by ataylor

[manick]

Not looking good! I think I'll recommend against it!

 

Thanks

[ataylor]

They have also tried to report me to SLT for "rogue testing" of another product approved by SLT to be tested!

[pete]

They have also tried to report me to SLT for "rogue testing" of another product approved by SLT to be tested!

 

Hold on, I've run out of popcorn...

[pete]

In fairness to eSafe they have started to proactively ring around customers who're running older versions of the client to let them know updates are available and (if you twist their arm) they'll even send you the release notes (not terribly in depth, but contains the major bugs they've fixed).

 

The support rep I spoke to acknowledged that this is a recent thing (I expressed surprise) and that they could have done better in the past (I paraphrase).

[nikaso]

Bit of a thread resurrection but have any eSafe users had a problem with Chrome not liking the Guardware certificate? We are getting the 'Your connection is not private' page and its the Guardware certificate that is being deemed to be invalid?

[ataylor]

Are you using Smoothwall? Had an issue for a while where there was an old certificate deployed from Smoothwall that was causing conflicts with esafe as it didn't meet correct certificate standards.

[nikaso]

No, we use Fortigate for a FW and Surfprotect Quantum for filtering.

[YozYoz]

Noticed some of you are using esafe with smoothwall. Ive come across a problem with smoothwall not showing the live traffic graph reports for any of the wired computers on our network, only shows our BYOD wireless devices. Smoothwall support have assumed this is because we are using esafe. have any of you come accross the same issue with your setup?

[t3ckn1k]

We use Esafe with FG, might be worth getting them to check your system. I've had a lot of hit and miss issues with esafe from not running correctly to not working at all.

 

Are you running the latest software. 4.4.0.77 or 4.5.1.11

[YozYoz]

We're running 4.4.0.65 so i may ask them for the updated files. TBH i'm trying to convince my school to get rid of it. It dramatically slows down internet access, and prevents alot of websites from working properly. I'm not entirely convinced Esafe is the reason that smoothwall is not showing the live traffic graphs properly, but its the reason theyve given.

[t3ckn1k]

I was pushed to go to 4.4.0.77 as a matter of urgency, although I still had a few older versions installed on some computers as the update function is pants. The uninstallers never work properly and the normal solution to upgrade fail.

 

I find the notification of updates to be appauling.

 

I'd get the update first, But i wouldnt be surprised if it was causing your issue. Apparently if your a school you get the 4.5.1.11