Filtering for MAT?

[Shaun_Dark_Lord]

Hi

 

We've got a demo booked with Smoothwall next week, but I was hoping to get some recommendations on filtering systems that can scale up to protect a ~20 school MAT.

 

We're looking for something a bit cleverer than the basic whitelist/blacklist system we currently use, and obviously need to focus on safeguarding. We also need to protect student's BYOD in a way that allows monitoring without being so obtrusive that they stick to using 4G.

 

As far as the scale of the system, we'd obviously prefer not to have ~20+ bare metal installations, and would prefer to either centralise the filtering, or go cloudy.

 

Any suggestions?

[Wave9_Lee]

Hi Shaun,

 

Sure you will get inundated here : )

 

I think one of the key things when managing multiple sites is the ease of management and visibility of users/devices across the estate, plus the ability to act quickly.

 

This is what we do - we use Sophos XG and provide integrated connectivity, all fully managed or co-managed with you, so you have full visibility and control, plus ease of management. If you'd like a demo or more info, let me know.

[Shaun_Dark_Lord]

Hi Shaun,

 

Sure you will get inundated here : )

 

I think one of the key things when managing multiple sites is the ease of management and visibility of users/devices across the estate, plus the ability to act quickly.

 

This is what we do - we use Sophos XG and provide integrated connectivity, all fully managed or co-managed with you, so you have full visibility and control, plus ease of management. If you'd like a demo or more info, let me know.

 

Hi

 

We're concentrating on the filtering at the moment. I may be wrong, but from my experience of currently running Sophos UTM at home, Sophos doesn't seem to have the kind of filtering system we're looking for. If I'm mistaken, please reply with some information on how the XG would provide more than just the normal Whitelist/Blacklist/L7/keyword filtering that gets bolted on as an afterthought to most firewalls, and then targeted at schools as a viable complete solution.

 

I'm not having a go. My last school was completely happy with the filtering feature set of the Palo Alto firewall we used, but that was an all-girls school, and did not have the issues we are facing.

[Wave9_Lee]

Hi Shaun,

 

thanks for the comments. Sophos have put a lot of effort into the education market in the last couple of years, and many of the features their education partners have requested have been (or are being) incorporated into the latest XG platform. In my view, the fact that Sophos XG is foremost a security company, makes it MORE able to deal with modern cyber threats in schools than most other platforms. Appreciate your comment is about filtering - we don't see many complaints from customers about this, in fact I would guess that most users experience is that Smoothwall offers a MARGINALLY better filtering experience, but the inclusion of advanced firewall, routing, AV, management platform, application control and integration with Sophos Endpoint, makes a compelling proposition. And the filtering is improving all the time.

 

Anyway - my two pence.

 

There are plenty of opinions on here, I'm sure other contributions will give you a broader view.

[ROYH]

I would suggest looking at a cloud based solution for a dispersed MAT, where a single cloud management window controls all sites, With the option of an onsite Node where bandwidth usage is high (10Gb) and it makes sense to process data locally. Crucial to have IWF and Prevent lists and options to monitor High Risk Students. Reporting in the cloud that’s scalable to avoid vendors trying to sell you more onsite storage. Any general questions around Cloud v on premise I’m happy to help (Vendor agnostic)

[Wave9_Lee]

I agree with most of what you say Roy ref IWF etc, but would have to disagree about Cloud - what happens if the central filtering service goes down or is over-utilised? Any fault is a problem, but when it's across 20 of your sites, it becomes a drama.

[XiJ]

Are you secondary / primary of both ?

[ADMaster]

I’ve worked with a couple LEA’s and they used to have a cluster of lightspeed devices and I think another lea had a cluster of iboss devices. They have decided clustering hardware at the LEA doesn’t work well anymore and are pushing cloud.

The vender they have recommended is Securly. I have many concerns about cloud only, but will be evaluating it soon.

It would scale and be centrally managed across all of your sites.

Iboss has some sort of cloud management for multiple nodes, but I just have a single node on site so I don’t know much about it. My understanding is they are phasing out support for onsite devices and pushing cloud too.

[Ditto]

Hi

 

We've got a demo booked with Smoothwall next week, but I was hoping to get some recommendations on filtering systems that can scale up to protect a ~20 school MAT.

 

We're looking for something a bit cleverer than the basic whitelist/blacklist system we currently use, and obviously need to focus on safeguarding. We also need to protect student's BYOD in a way that allows monitoring without being so obtrusive that they stick to using 4G.

 

As far as the scale of the system, we'd obviously prefer not to have ~20+ bare metal installations, and would prefer to either centralise the filtering, or go cloudy.

 

Any suggestions?

If only to broaden your view, have a look at Securly. I have no connection with them other than we used at my last school. I was not close enough to the implementation to comment much, but I think it's well worth a look.

[HereIGoAgain2601]

We are using Sophie XG as a cloud hosted service. It took us a while initially to get the spec and performance right but it’s definitely worth it. Each site can have a customised experience of allowed / blocked sites but we can also change on all sites in one go without having to connect to multiple different filters. We have a basic XG 135 on each site with firewall only, and then license the central filter. Also helps to keep cost down. No complaints about the filtering works well blocking categories and XG has loads more features for education than Sg. Only problem for us is getting used to the new interface as knew SG like the back of our hand and this is completely different. Happy to discuss further

[ITGuyWestMidlands]

We are using Sophie XG as a cloud hosted service. It took us a while initially to get the spec and performance right but it’s definitely worth it. Each site can have a customised experience of allowed / blocked sites but we can also change on all sites in one go without having to connect to multiple different filters. We have a basic XG 135 on each site with firewall only, and then license the central filter. Also helps to keep cost down. No complaints about the filtering works well blocking categories and XG has loads more features for education than Sg. Only problem for us is getting used to the new interface as knew SG like the back of our hand and this is completely different. Happy to discuss further

How does this work please? Does each site have a VPN link to the cloud XG?

[ROYH]

I’ve worked with a couple LEA’s and they used to have a cluster of lightspeed devices and I think another lea had a cluster of iboss devices. They have decided clustering hardware at the LEA doesn’t work well anymore and are pushing cloud.

The vender they have recommended is Securly. I have many concerns about cloud only, but will be evaluating it soon.

It would scale and be centrally managed across all of your sites.

Iboss has some sort of cloud management for multiple nodes, but I just have a single node on site so I don’t know much about it. My understanding is they are phasing out support for onsite devices and pushing cloud too.

 

I would suggest speaking to all Cloud providers to the EDU sector to establish what’s right for your trust. Happy to talk if needed.

[SchoolsBroadband]

I agree with most of what you say Roy ref IWF etc, but would have to disagree about Cloud - what happens if the central filtering service goes down or is over-utilised? Any fault is a problem, but when it's across 20 of your sites, it becomes a drama.

 

 

I'll very politely disagree with you here @Wave9_Lee as you make a lot of valid comments on a lot of threads and I certainly do consider you a "good egg"

 

My view (and the general industry) is that all services are going to cloud based solutions. e.g take Office 365 email for example going from an onsite exchange server to the cloud, or MIS etc etc.

 

My view is that onsite filtering and firewalling is in exactly the same vein as this as its just another application.

 

IF a cloud hosted solution has had enough investment and is a reliable service then I and the industry as a whole agrees the service should be put in the cloud unless there's a very specific reason it needs to be onsite. The problem of course can be with the implemention of this. I'm sure you (and others) may think thats a bit rich when we had considerable issues with our hosted Lightspeed service in the past (although this wasn't directly our fault) as have some other ISP's recently which post here.

 

What I can say is that if it is done properly (and we've invested over £500,000 in our new Netsweeper platform) that a high uptime can be achieved whilst giving greater functionality than using onsite devices.

 

We have 100% uptime of our hosted Netsweeper content filtering and Fortigate UTM platform which in our opinion gives the best in class filtering and security for education and has now been running for nearly 2 years.

 

There's also a huge advantage using cloud based solutions as it gives you a single management interface to all of your sites. This is really where MAT's in particular massively benefit as they can easily push changes to all sites at a click of a button and users can move between sites and take their profiles with them. This in our experience is much more difficult and costly to do as well as providing little to no resiliency if an onsite box goes bang. Also think about upgrading the software and change control of this on 20 different boxes. Again more management overhead and the end customer will have to test this in their environment for software bugs etc, where as if its managed in the cloud the MSP does this on their behalf.

 

Also, using a cloud based scalable platform means that onsite UTM and filtering hardware doesn't need to be upgraded when faster line speeds are being introduced. With the advent of G.Fast pushing 350Mbit, FTTP running at 1Gbit and most secondary schools now taking 1Gbit leased lines our schools haven't had to upgrade any onsite devices. We just "turn up the taps" in the cloud and give them more UTM and filtering power.

 

Finally (and I'm sure you're all getting bored now!) if there are any outages in the cloud to a specific piece of kit that shouldn't matter as the high availability environment just spreads the load (we use F5 and Cisco equipment to do this) over other servers and UTM devices to take the strain. If you have a single onsite device then generally you have to wait until the next day to get a new one.

 

And another thing finally, by putting this all in the cloud a WAN is very easily made by terminating all connections into the core infrastructure rather than putting real world IP address on a customer site. This means all connections are WAN ready from day 1 so you can easily migrate to a WAN if required.

 

We've numerous MAT's of over 30 schools in total which really do benefit from our cloud platform and save a heck of a lot of resource in management time whilst centralising their IT function.

 

Positive comments always appreciated

 

Thanks

 

Dave

[Wave9_Lee]

We'll have to disagree (on some of these points) Dave : )

 

I don't propose we have a multi-page debate and bore everybody, (and these are only opinions after all) but there are pro's and con's to both approaches. The vast majority of our sites have had 100% uptime for more than 4 years and have had much more control and visibility of traffic, users, applications etc during this time than would generally be available from a cloud hosted platform.

 

I would reiterate your own point, that IF there is sufficient investment, capacity and is reliable, then this can be a good option. This isn't generally the case though, in my experience. The team at Wave 9 have (in our previous life) run some of the largest UK school networks and Grids in the way that you describe. We wouldn't do it again.

 

I actually don't think that the architecture suits the cloud-oriented direction of travel - many apps require a direct internet connection, unencumbered by double NAT, proxies, centralised infrastructure etc. Not to mention the issues you can get with having limited, aggregated internet peers (i.e. much more likely to suffer DDoS and the now common Google Captcha stuff). Appreciate that a lot of this can be mitigated, but why try to when an alternative is already there that's simple and cost-effective.

 

If was running a MAT with a number of sites, I would want to know what appliance or hardware was running my service, how it's configured, where it is and how to change it on demand. I'd want to be certain that if there was a fault, ALL my sites wouldn't be hit by the same issue (I would like to have my sites patched at different times - to suit me, so if there was an issue it's not for 100% of my sites on a Monday morning). I'd like to be certain that if I have resilient links, that they are on different networks (ideally different technology), terminate in separate equipment on different ISPs. I'd like to manage them from anywhere, have single pane of glass policy distribution when required, but also have the ability to configure each site for specific requirements, say BYOD, or specific users/applications. I'd like to be able to pull a report, the minute a safeguarding incident arises, identify the user, site, application, device or whatever. Fundamentally I would want as much control, visibility, flexibility and management as I could get.

 

Anyway - as I say, there's room for multiple approaches, pro's and cons for both.

[SchoolsBroadband]

Yeah I agree with the vast majority of that and you're right around all the positive feature points but they can now be done in the cloud. Even the different operating system bit on some virtualized utm devices.

 

Certainly a lot of the old grid ways of doing things are in both our opinions terrible architecture and don't deliver what customers want which is what youve described but we can now do this in the cloud which is why I'm very passionate about it.

 

I completely agree that an onsite box can do all of those things you mention but as with other applications if done correctly and with enough investment it can be done.

 

Doing our maths though to do it properly in the cloud you need 1000 schools to pay for it including your own ISP network and engineers and data centres which I suspect is why most msps don't want to!

 

All good though and please don't think I'm having a go at onsite sophos boxes. I quite like them just we prefer Fortinet and Netsweeper.

 

That it from me no more debating :-)

[Shaun_Dark_Lord]

iBoss certainly looks interesting. I am a bit concerned about their BYOD protection;

 

https://www.iboss.com/business/cloud-dns-protection-for-byod-and-guest-networks/

 

Surely this would only work when paired with some on-site ACL or traffic shaping? Otherwise clients would be free to set any DNS server they like and simply bypass iBoss' filtering.........

[Eappariello]

iBoss certainly looks interesting. I am a bit concerned about their BYOD protection;

 

https://www.iboss.com/business/cloud-dns-protection-for-byod-and-guest-networks/

 

Surely this would only work when paired with some on-site ACL or traffic shaping? Otherwise clients would be free to set any DNS server they like and simply bypass iBoss' filtering.........

 

 

That link is under the business website section as DNS based filtering works for corporates for a light touch approach on Guest and BYOD networks. And your quite correct needs to have ACL's so that only the cloud gateways can be used as DNS servers.

 

For Edu we recommend using GRE or IPSEC tunnels for unmanaged devices, and for managed devices the 'cloud connector' which also takes care of decryption, authentication, TLS 1.3, and the data redirection to the cloud.

 

Hope that helps.

Edited February 9, 2019 by Eappariello

[rogerdnixon]

Already mentioned - but take a look at Securly. We use this for our content filtering - so Chromebooks, PCs, Mac, BYOD onsite, Guest network and Chromebooks offsite. Easy to setup, cloud-based and not too expensive. We are planning to roll out across our Trust as we are all part of the same G Suite setup. You can deligate safeguarding stuff for specifc OU's to specifc people on each site and set policy based on G Suite OU membership. You need a local firewall - we use ClearOS - a linux distro that works very well + easy to setup. I believe they now have an O365 option as well - at least there is an O365 login button on the sign in page.

They also have a parents portal and app which our parent love which allows them to control (to an extent) the offsite filtering on their childs Chromebook.

[ADMaster]

@rogerdnixon

Have you used the securly DNS filtering and how do you find it?

I'd think it would lack alot on reports.

If I'm browsing a site once I resolve it, the DNS server shouldn't see any more traffic to it.

I'd like to have a discussion with someone who is using the Securly DNS filtering.

[rogerdnixon]

Yes, we use Securly DNS (which covers PCs, BYOD, Guest and MacOS). We are 1:1 Chromebooks staff/students - so most people are on ChromeOS. They proxy trafic to any site you don't globally allow and they also have a tool that inspects mail and Google Docs for potential safeguarding issue called Auditor. You get alerts when people try to access blocked sites, do Google searches that are flagged as potentially harmful, visit sites that while not blocked may suggest certain activity patterns or there is flagged content in Mail/Docs. You can export reports on individual activities either as pdf's or csv files. What I like is it is dead easy for people to use - i.e. safeguarding teams and they can get what they need in a couple of clicks.

 

Its not without its issues - some versions of Android don't work properly and Google Voice (which we are trialling) does not work on anything other than the guest network due to the way they inspect traffic to Google land. All being worked on apparently. Unless you force google searches to co.uk - they automatically go to .com - not a big deal - but slightly annoying. Happy to discuss it it detail if you want at some point.

[ADMaster]

Yes, I'm interested in all the details. I'll send you a PM as to not derail this thread anymore.

I have auditor setup, but it only does mail not docs. I may have to contact support.

I did see on their site about connecting it to docs, but I think that may be new / beta / need to ask for.

[Shadow_Walker]

Hi

 

We've got a demo booked with Smoothwall next week, but I was hoping to get some recommendations on filtering systems that can scale up to protect a ~20 school MAT.

 

We're looking for something a bit cleverer than the basic whitelist/blacklist system we currently use, and obviously need to focus on safeguarding. We also need to protect student's BYOD in a way that allows monitoring without being so obtrusive that they stick to using 4G.

 

As far as the scale of the system, we'd obviously prefer not to have ~20+ bare metal installations, and would prefer to either centralise the filtering, or go cloudy.

 

Any suggestions?

 

Yep our MAT 30+ schools uses smoothwall across all sites and is centrally managed. Works well and smoothwall have been brilliant with setup and ongoing changes.

[mavhc]

I'd ask them all how they're dealing with HTTP3, TLS 1.3, SNI encryption, WebRTC peer to peer connections, etc.

 

Seems like the only place that filtering will work in the future is on the client, that'll be fun.

[Shaun_Dark_Lord]

Already mentioned - but take a look at Securly. We use this for our content filtering - so Chromebooks, PCs, Mac, BYOD onsite, Guest network and Chromebooks offsite. Easy to setup, cloud-based and not too expensive. We are planning to roll out across our Trust as we are all part of the same G Suite setup. You can deligate safeguarding stuff for specifc OU's to specifc people on each site and set policy based on G Suite OU membership. You need a local firewall - we use ClearOS - a linux distro that works very well + easy to setup. I believe they now have an O365 option as well - at least there is an O365 login button on the sign in page.

They also have a parents portal and app which our parent love which allows them to control (to an extent) the offsite filtering on their childs Chromebook.

 

I'm sure they'd offer a deal, but the $6.88 per user per year is a bit pricey........

[rogerdnixon]

I'm sure they'd offer a deal, but the $6.88 per user per year is a bit pricey........

That's more like the three year price. It does depend on what options you pick.