Vlans

[uccert]

Good morning. I'm sure I'll get a pasting again here but I'm a big boy. Yes....implement those vlan's but you'll need to implement some form of access control (ACL, DMZ) to stop inter-vlan routing between your Pupil VLAN and others. Is your firewall beefy enough to move your L3 interfaces off your network switches and onto the firewall to give you greater granularity of control between your subnets/VLAN's?

 

There is some great content on the Mitre website which gives a high level view of what steps you can take to improve your posture.

 

https://attack.mitre.org/mitigations/M1030/

[localzuk]

Good morning. I'm sure I'll get a pasting again here but I'm a big boy. Yes....implement those vlan's but you'll need to implement some form of access control (ACL, DMZ) to stop inter-vlan routing between your Pupil VLAN and others. Is your firewall beefy enough to move your L3 interfaces off your network switches and onto the firewall to give you greater granularity of control between your subnets/VLAN's?

 

There is some great content on the Mitre website which gives a high level view of what steps you can take to improve your posture.

 

https://attack.mitre.org/mitigations/M1030/

 

This is only really any use if you have a hard and fast divide between what counts as "pupil" or not. To do this could potentially require a rethink of server setups (eg. do you use the same Windows shared storage for pupil drives as you do for staff?), it could also be impossible in some areas due to devices being used by both staff and pupils (this is the case across many schools these days as they don't have the funds to provide enough devices for all staff, so some staff will log in on pupil machines - especially the case when training is done with groups and the IT suites get used by staff).

[uccert]

This is only really any use if you have a hard and fast divide between what counts as "pupil" or not. To do this could potentially require a rethink of server setups (eg. do you use the same Windows shared storage for pupil drives as you do for staff?), it could also be impossible in some areas due to devices being used by both staff and pupils (this is the case across many schools these days as they don't have the funds to provide enough devices for all staff, so some staff will log in on pupil machines - especially the case when training is done with groups and the IT suites get used by staff).

 

A small price to pay to redesign and repurpose than deal with the consequences of a breach. You've mentioned using pupil machines for training a couple of times now. Wouldn't take much to drop those machines in the relevant VLAN for training purposes then revert back?

[localzuk]

A small price to pay to redesign and repurpose than deal with the consequences of a breach. You've mentioned using pupil machines for training a couple of times now. Wouldn't take much to drop those machines in the relevant VLAN for training purposes then revert back?

It would take a lot of work to change the systems - eg. Change VLAN, install relevant software, do training, remove software, change VLAN. That's quite a lot of work all in all. It also ignores the wider staff use of pupil machines.

 

I have a question for you - have you ever worked directly in a school at all? From your posts, you seem to lack any direct knowledge of how schools operate.

 

You say making these changes would be a small price to pay? Except for many they wouldn't. Lots of schools still have a single server running everything. So, your idea would require a significant investment in new kit and time to set it up, plus then staffing to manage it all.

 

TCO for IT would increase quite steeply.

[Jimmer3568]

I guess we're lucky here: all teachers have their own laptops, so the suites are not used much for staff training. For other staff (Admin, Site Team etc) who occasionally need to do some training, most/all of that is done online anyway.

 

We have 3 separate VM's as file servers: Staff Shared, Staff Home Drives, and Student Home Drives so having these VM's on different VLAN's is no biggie. (Student Home drives will soon be disappearing to OneDrive anyway).

 

The only VM with significant overlap is the Print (PaperCut) Server.

 

So one-size may not fit all, but for us, separating off the students in principal seems like a decent option.

 

Thanks for the comments - keep 'em coming.

[Boredguy]

I guess we're lucky here: all teachers have their own laptops, so the suites are not used much for staff training. For other staff (Admin, Site Team etc) who occasionally need to do some training, most/all of that is done online anyway.

 

We have 3 separate VM's as file servers: Staff Shared, Staff Home Drives, and Student Home Drives so having these VM's on different VLAN's is no biggie. (Student Home drives will soon be disappearing to OneDrive anyway).

 

The only VM with significant overlap is the Print (PaperCut) Server.

 

So one-size may not fit all, but for us, separating off the students in principal seems like a decent option.

 

Thanks for the comments - keep 'em coming.

Don't forget that if you do separate out pupil and staff devices, that if you have classroom management software to make sure that it works over the vlans as otherwise it's a bit useless. Whether you need to ensure the server or the specific teacher workstation is configured for each vlan could depend on the system you are using

[Jimmer3568]

We use Senso, for classroom management which (apart from the client) is all online....I'll double check with them, just for be on the safe side.

Cheers Boredguy.

[uccert]

Good Morning Tony - have I ever worked directly in a school - no. I get it that schools are time and money constrained but you can't call into judgement my knowledge of how schools operate because I've never worked in a school as a direct employee.

 

I work extensively within schools and MAT's as a trusted advisor concerning their networks and have done for over a decade and continue to do so. I take what I've learnt and experienced in a commercial/enterprise world and apply that knowledge within the edu sector.

[kennysarmy]

Each physical block is in it's own vLAN (9 no.) , plus separate ones for Servers and four for WiFi networks.

[slugshead]

1 - Default VLAN

5 - PCs/Servers/College owned device Wifi with certificate auth

11 - VOIP

13 - Guest Wifi - Walled Garden with Ruckus "Guest Passes"

19 - BYOD Wifi - Everything BYOD related

 

Future VLAN Maybes

 

21 - Access Control

23 - CCTV

25 - Fire panels

[psydii]

I'm just going to leave this thought here:

 

Putting SIMS server onto its own subnet, and then configure acls to only allow access via an Remote Desktop Server (and obviously ACLS to allow SIMS Server<->AD + Management platform) could be a relatively low cost, quick-win for improving security, though obviously does nothing to address bad-guys with DA privileges.

 

To our new member with little in-school experience: the money available in schools for IT going through Academisation, or new build/refurbs is not indicative of the investment everywhere else. Schools that went through BSF ten+ years ago will likely still have a great core network design (with multiple MSTP domains, load balancing and strong ACLs), but these schools would unlikely to be able to replicate that should they have to replace it today.

 

IT expenditure in schools is <10% per FTE of an equivalent sized 'knowledge worker' based business. Just look at colleagues gnashing their teeth because in order to get enough devices each year they forwent TPMs and now are locked out of Windows 11.

[Boredguy]

I'm just going to leave this thought here:

 

Putting SIMS server onto its own subnet, and then configure acls to only allow access via an Remote Desktop Server (and obviously ACLS to allow SIMS Server<->AD + Management platform) could be a relatively low cost, quick-win for improving security, though obviously does nothing to address bad-guys with DA privileges.

.

That would depend if you have RDS licences in your agreement already, otherwise it could be a large cost (plus if you have a suitable server with enough resources to run the multiple instances of SIMS)

[Jimmer3568]

IT expenditure in schools is <10% per FTE of an equivalent sized 'knowledge worker' based business. Just look at colleagues gnashing their teeth because in order to get enough devices each year they forwent TPMs and now are locked out of Windows 11.

 

That's a great stat @psydii - before I start broadcasting it, do you know where it's from?

[localzuk]

Good Morning Tony - have I ever worked directly in a school - no. I get it that schools are time and money constrained but you can't call into judgement my knowledge of how schools operate because I've never worked in a school as a direct employee.

 

I really can make that judgment, having worked directly for schools for 15 years now. You lack direct experience of working in a school day to day. That affects your decision making processes and means you don't know an awful lot of what we as direct employees have to deal with.

I work extensively within schools and MAT's as a trusted advisor concerning their networks and have done for over a decade and continue to do so. I take what I've learnt and experienced in a commercial/enterprise world and apply that knowledge within the edu sector.

Consultants do not see the full picture - it is impossible for them to do so. If you have not experienced a member of school leadership making a snap decision and expecting it to be in place same or next day, counter to considerations of security etc..., then you are not experienced enough in education to make rather flippant remarks regarding things being a "small price to pay"...

 

Your comments are valid from a purely technical point of view, but also need to be taken into context of the very real world we experience each day, taking into account immediate costs, ongoing costs, staff time and experience and expertise to deal with these sorts of changes. I'd hazard that the majority of primary schools would not have the funding, expertise or time to make many of these changes. Trusts and larger schools, sure, but even then it would still be a question of viability. Put it this way - average IT spend in the UK in 18/19 was £59 per pupil. There's loads of 130ish pupil schools out there... Not a lot you can do with less than £8k a year in your budget for IT.

Edited June 28, 2021 by localzuk

[psydii]

That's a great stat @psydii - before I start broadcasting it, do you know where it's from?

Attributable to "Psydii talking down the pub to mates who run bigger things out side of education", sorry.

 

 

Consider this though the implantation costs of the functional equivalent of SIMS in the charity sector is £1.5M+ and that E3 for 100 users is closer to 300,000 than the 30K it costs for a largish secondary school.

 

Hardware costs are comparable, but business will often buy fancier toys.

[Jimmer3568]

Attributable to "Psydii talking down the pub to mates who run bigger things out side of education", sorry.

 

Fair enough. I totally believe you anyway.

[TechMonkey]

Attributable to "Psydii talking down the pub to mates who run bigger things out side of education", sorry.

 

 

Consider this though the implantation costs of the functional equivalent of SIMS in the charity sector is £1.5M+ and that E3 for 100 users is closer to 300,000 than the 30K it costs for a largish secondary school.

 

Hardware costs are comparable, but business will often buy fancier toys.

 

I'm sure there was a report done recently (so with my brain, actually probably within the last 10 years!!) that worked out the average tech budget of schools and compared it to industry. I'll see if I can find it.