F.A.O. All ICT Managers / Technicians

[Mitch]

yes i agree but that is for just google, the task would be massive, the way i do it is similar but its totaly automated i can fully report on a schools 1000+ users in 24hours since birth of the server.

 

For example you do me a report of all users, all sites, for the the past 5years of all internet misuse upon your network.

 

covering my eairlier post of violations

covering any pupil using french german, spanish or english

 

Including the ability to identify the user

in easy to read format

 

This is what i can do

 

the last school i produced over 10,000 pages of reports and i have 1,000 of urls that in my opinion the ISP's of schools should block.

 

How i do it really isnt the point

Protecting the Pupils, Schools, Headmasters, Governors, LEA's, ISP's is

Most of all the Kids

 

Wouldnt you all agree

[Ric_]

@Mitch: Like I said in a previous post, the service you offer is no doubt of benefit as long as you can guarantee the accuracy of your results and that occurances aren't missed due to user settings, etc. being wiped.

 

The example I stated above was in reply to your question. Simply run a search across the proxy log and pull each line that contains the keywords. These line then contain the username, date, time, URL and PC.

 

I know that this would be time consuming and would undoubtably omit many potential areas of abuse. This is where your service comes in... as long as you can guarantee that it will work on heterogeneous networks comprising of Windows, Apple, *nix, etc. and including thin and fat client architectures.

 

Please don't take this as me 'slagging off' your service - this is simply what I would be asking for before employing you or recommending your service to any schools.

[GrumbleDook]

@mitch:

 

Just come back from a few days off and I'm picking up on this ...

 

Could you explain to me a few things?

 

1. Do you run a client on the local machine as part of this collection of activities or is it through existing logs and files?

 

2. How do you deal with non-windows systems?

 

3. There are already several similar systems on the market... what makes this different to things like Securus, etc?

 

4. There are certain requirements set out by BECTa and DfES as to connectivity in schools, one of these being filtering of internet access. Do you see your solution as an addition or a replacement of a content filtering system in schools?

[Dos_Box]

I do see a need for services such as these, but only in context. If a school has a competant network manager\technician then there should be no problems at all as a suitable logging and filtering system will be in place. If a school has no such persons or systems in place then this kind of service can be of great help, but only if:

 

It records actual sites sucessfully visited, not attempted. I couldn't give a damm what they want to get to, so long as they don't get there. Trying to prevent 1000 pupils all in the throws of puberty from accessing unscholerly material on the internet is a hard job at the best of times and logging evey attempt to access a website then reviewing them is a waste of valuble time.

 

I have had previous experience of this kind of service being 'thrust' upon schools. In my region a certain company tried scare tactics to get us to allow them into schools. They told us of a school in which masses of pornographic material had been found on PC's and in user areas. They would not tell us which school, how the materials had got there or any other relevent information. In the end we sent them packing.

 

You may be offering it as a school security audit type service, but I would advise you also try and market yourself as a service schools can use in a more informal come-to-our-assembly-and-tell-the-kids-just-what-gets-recorded kind of way. Many school techies would be more tahn happy to see the kids getting a good lecture on the subject, even if no audit took place.

 

These are just my thoughts. Thanks for the PM's Mitch. I will reply tomorrow.

[ajbritton]

EduGeek regulars will know that I'm a pedantic SOB, so here goes.

 

Mitch, the service must by definition be a log analyser of some form. If detection is 'post-occurence' as you have stated, then the information must be retrievable after the event. The information must therefore be logged somewhere (wether it be in proxy logs, event logs or a database of some kind). Your service must be accessing this data and performing analysis/reporting upon it. QED - Log file analysis.

 

If your service can retrieve information which has not been stored then maybe you can also solve the Black Hole Information Loss problem

[webman]

How can you guarantee that it will produce a report of every URL accesses "on the network" since "the server"'s lifetime began? What if the school doesn't have a logging proxy at all and student profile's are wiped - then surely there won't be any logs to analyse?

[russdev]

also we often reimage machines every so often so wont pick that

 

also if we reset a user profiles this deletes all users setiings incuding history etc and then recreates user..

 

 

 

russ

[ZeroHour]

Sadly this seems like a person doing what ISA + Webspy does.

And once you buy webspy you dont need to bother paying anymore.

And it can be done at anytime

[Mitch]

@ZeroHour

 

No not like the products you mentioned.

 

@All

 

This is the kind of feedback i want, Lots of questions have been asked, I will look at them tonight as im @ work now. and will reply to you all.

 

Quickly though my software is just not IE based, compatible with the other main Surfing applications.

 

Will post later

 

Mitch

[Mitch]

@ Russ

 

Ghosting does not affect my results on a network

 

@Webman

@Russ

 

I see where you are both coming from, I dont go nowhere near logging proxy so it dont matter if a school dont use them.

If the students profiles are wiped i can still do it (bit harder but possible)

 

@ajbritton

 

The Black Hole (i think ill start working on that one next year)

[russdev]

but what about if we reset user profile as basicly assuimg you are looking at user profile then if we reset there profile then it would wipe any data..

 

Russ

[Mitch]

Anyone available at the weekend so i can show a report, and go through the concept with them, then report back on here

 

im in Leeds

 

Mitch

[ajbritton]

Anyone available at the weekend so i can show a report, and go through the concept with them, then report back on here

 

im in Leeds

 

Mitch

 

Go through the concept with us here and now if it really exists. I'm beginning to seriously doubt it though.

 

So far you have given us nothing about how the product works. Either it is very clever, in which case revealing a little about how it works will not really do any harm as it will still be marketable, or it is extremely simple, in which case you would obviously not want to talk about it on a forum of experts who, between them, have probably more knowledge of computer networks than yourself and are not likely to be impressed.

 

It's not my intention to offend, but 'put up or shut up'.

[Mitch]

@Russ

 

Yes your right but i can also look for data sector by sector parsind it even if it has been wiped.

 

@ajbritton

I can see exactly what you are saying, a number of people are also involved with me so i will have to talk with them first.

 

I am more than happy to give you a full concept but i will have to talk to the other parties, and see their views.

 

send us a pm if poss with your contact details

 

Mitch

[russdev]

Anyone available at the weekend so i can show a report, and go through the concept with them, then report back on here

 

im in Leeds

 

Mitch

 

mitch how about doing a screencast for us record outut of screen give us all a demo to look at..

 

or other option do a one to one demo with me using gotomeeting and skype and then I will record it my end and upload it here for people to look at

 

russ

[GrumbleDook]

Hi Mitch ... do you have any response to my queries? It sounds interesting ... I would like to know a bit more.

[webman]

I'd be interested to see what parts of the system this service gets its data from ...

[russdev]

Hi

 

Just have had a word with Mitch on phone basically I've got bit on idea of where he is coming from and some of features do send unique he was basically bit worried that turn into flame war type thing...

 

He is willing to travel to any place to come and demo it he just wants feedback..

 

I explained biggest problem is for feed to happen people need to see it

 

Im sure if you provide number who ill ring you and talk to you will try answer questions...

 

I understand his position of not want to give process away... but certainly guy sounds legit and basically just to improve safety of youngsters in schools...

 

Certainly it is unique as it is whole package service...

 

saw who about few of you offer a telenumber and get him down to come and demo it and will go from there...

 

 

 

 

Russ

[Mitch]

Thank you Russ

 

GrumbleDook

 

Yes i do will post them later as im at work now

 

Regards

 

Mitch

[kevinmcaleer]

Hi Mitch,

I've got to admit I'm a little confused about what your product/service does/how it does it.

 

I think there is nothing wrong with a company selling a service to schools that uses a logfile analyser to track usage, then for a report to be sent to that school informing them of the abuses. If this is what the product does, then you should clearly state that it is a logfile analyser.

 

Mitigating risk is very important to schools, if they can pay an outside agency/company to look after internet misusage, it will be a useful service.

 

As an ex-Network Manager I understand that collecting the data is the easy part, policing the network is the hard part. I would have gladly paid a company to deal with any misuse issues.

 

For the product to be marketable and successful it has to be clear, to customers, what it is and what it does. Mitigating risk, that is transfering the risk to another entity is a marketable property, as is the service element.

 

I am concerned, though that it may be too heavy handed. Many a time I was asked to investigate misuse of our system, and it wasn't always the child whose user account was used to commit the act that was responcible. The child was often unaware that someone had used their account. In this case if a letter was sent to the childs parents, who phone the school, who meet with the head and your company, and later get to the bottom of the mystery, it will be both the school (headteacher) and your company left with egg on faces. It would only take one incident of this kind of thing for loss of confidence in the service and possibly cancellation of contacts.

 

Network Management is a grey art, its not black and white. Misuse can not always be detected and handled so easily, as there are many variables in play.

 

I'm also concerned that you state your product prevents access to sites on the internet, yet the product only detects misuse after the fact. This is confusing if not a little misleading. If you give a network manager a 10,000 page report with over 1000 urls to block, I don't think they would be to pleased. If your software/product automatically added these urls to my internet filter, it would be of more use, but that would require a lot of effort on your part as there are hundreds or internet content filtering applications out there. As for retrieving data sector by sector, I think your clutching at straws. Although it is technical possible to retrieve some data (assuming its not been over written), it takes a long time (even automatically) and does not provide very reliable results. In short its not commercially viable to do this in a school environment.

 

Your product also appears to be able to do everything; it must have some limitations, it must only work on certain platforms and under certain circumstances. This again isn't a fault of the product, but is a natural part of any product, its specifications. If you clearly state how the product works, people can understand how it will work for them. If the product scans for cookies or analyses logfiles, the network manager knows that he/she must keep these to enable the product to work.

 

You obviously have a useful product and an interesting service to offer schools. I think you need to consider how your going to inform your potential customers what it does, as if your try to conseal its workings you will only face scepticism. It should do exactly what it says on the tin. As you've seen from the previous posts, network managers like to know how something works and what it does before they'll let it anywhere near their network.

 

It might be worth you paying a marketing company to help you with product development & launching. They'll help you describe the product and (or) service, so that customers can quickly understand why its of benefit to them and how it achieves this.

 

Athough you have developed this service, you might not be the best person to sell it. May companies use ex-teachers to sell educational products, as they best understand how to communicate with schools.

 

Hope this feedback is of use.

-Kevin McAleer

Managing Director

Advice Factory Ltd

[alan-d]

So basically you use Data recovery software (The type used by Police forces and the MoD) to produce a list of data files from which you interrogate to produce a list of files and sites from specific folders containing words or phrases you wish to pick up?

 

Quite a bit of work to do that, and to run it on our network I would insist on full access to the data recovered. I'm sure you will understand that Data Protection is paramount.

 

I'd still be interested in seeing it and a look at the whole package you mentioned at some point.

[Marcus]

Hello all

As an introduction, I am a collegue of Mitch's and happy to be here

 

In reply to a few questions, raised by some members.

 

The application we have designed is a bespoke collection application, which is run on a client pc over a network or the server at the time of the visit.

 

The required data is automatically generated by the Microsoft operating system, the benefit are as follows.

 

• Data files cannot be altered by a 3rd party

• Accuracy is paramount as deletion of sites visited isn’t possible

• Data can not be “misread” or assumptions made as its Microsoft itself generates the data.

• There is no hardware or software installed on your network which can interfere with system performance, require maintainance or break down.

 

At the moment we have concentrated on Windows based systems as they are by far the most common.

 

We are able to extract data from the following browsers

 

Internet Explorer Version 3, 4, 5, 6, 7

MAC IE Browser

Netscape communicator / Navigator upto 4.80

Apple Mac Netscape Bookmark

Netscape 6,7,8

Mozilla

FireFox

AOL

MAC Safari Opera

 

As for the analysis of the data, yes there are systems on the market that will produce reports outlining the same kind of information, once you have the data, but as kevinmcaleer says “but that would require a lot of effort.” The UNIQUE aspect of or application is that the COMPLETE history of EVERY user can be collected within a typical 2-3 hr visit.

Another point raised was “how do we prevent access if we only detect misuse after the event”. Qite simply, the answer is, the pupils know that ANY misuse WILL be detected without fail. During our pilots we addressed the pupils as part of a special assembly, as well as discussing the dangers of the internet, and chat rooms, etc a member of staff informed the school that future checks would be taking place and any indiscretions after the initial “amnesty” period would be dealt with. At the school we piloted ( a reference from which can be transcripted here) just this alone reduced the misuse within 6 months by 97%. Another unexpected result of this was the “word of mouth” warnings given by siblings and friends ( ie “don’t play games in lessontimes or they’ll get you”)

 

Part of the package presented to the school on completion is a file comprising of all the URL’s which we believe need to be blocked by the Filter Company. Our intention is not to replace Filter Companies but to work alongside, enhance and complement them.

On a month by month, day by day basis filter companies “guess” what sites to block, after every report we can give them the actual sites children are viewing. This is a benefit to the school in particular and also any other school served by that filter.

 

Prior to any data being collected, ie at the time of the order, a Data Protection Agreement is signed by both parties one aspect of which is the assurance that on completion all data retrieved will be destroyed.

We also have a “Schools Internet Policy” available drawn up by a solicitor, the sole aim was to be able to provide a school with a document which WILL protect the school (parents, governors, teachers, headmasters and pupils). This was done after we visited a number of schools and were made aware of the policies used presently, which are either drafted by unqualified people, uninformed people, or contain unnecessary or irrelevant clauses, that is if any policy existed at all. It is our intention to have a download area on our website for an updated version of this policy available every 3-6 months or when technological advances renders it necessary for inclusion.

 

As for the query regarding Usernames and Passwords being “hijacked” by other pupils, as our method looks at the overall activity of a user and doesn’t just highlight misuse we can build up a picture of what that pupils was doing at the time of any questionable activity. Ie. A pupils attempt is blocked and logged for attempting to access local escorts, however prior to that he was searching for Ford Escorts, Escort owners clubs, etc. As you and other members will know disreputable companies design websites to be stumbled upon during quite innocent searches, and we would not want a pupil caught out by these methods to be reprimanded in the same manner as a serial offender of active searches. This is addressed during the assembly in more detail.

 

I apologise if this post is a little longwinded but I can appreciate that a lot of questions have arisen on this board and needed to be addressed.

[GrumbleDook]

Hi everyone.

 

Had a bit of a chat with Mitch and given him a bit more feedback.

 

What they are now looking for are a school or two that use Roaming Profiles to give it a try and report on how it works with them.

 

Please remember that irregardless of how the information is secured about user activities it is also a follow up service that builds on user education. The idea is to make users aware that whatever they do can be checked, it can also to help pinpoint problem areas with existing filters and pinpoint particular things that students are attempting to access.

 

I hope this gives a bit more background.

[ajbritton]

Question - What if a user delete's his/her own temp internet files and history?

[russdev]

impresion i got that it use some kind of methord to be able to still get at these but then i maybe wrong..

 

russ