Smoothwall Cloud - For Children at Home

[jamwatn]

I am having trouble getting my head around something.

 

We have laptops that go home with children for the majority of the time, that are on W10 and managed on the A.D..currently filtered by software that filters the machine, not just the browser, by creating what is a local proxy on the device.

 

They are locked down pretty hard and so far, we have only had a handful of kids rebuild them.

 

I am tasked to install Smoothwall Cloud, which is an extension and I am thinking this is not going to be adequate for children to use at home due to the fact there are ways around extension based filtering.

 

1. What is to prevent users running their own browser - yes I could block USB but what about the App Data folder? If I block this, users would not be able to use Teams and OneDrive if I recall?

2. Prevent shortcuts - I am aware you can create a shortcut and add your own string to the end of it to load edge with extensions disabled.. how could I prevent this?

3. What if the extension simply fails to load or crashes? The browser could continue to run un-filtered.

4. Finally, what about undiscovered vulnerabilities?

 

These are my initial findings in my limited time I have had to test.

 

Can anyone enlighten me on what they would do or if I am simply confused about what seems to be a vulnerable product?

 

Thank you.

[ibpalle]

The cloud filter is indeed just filtering for the browsers that have the extension installed. Chrome and Chromium Edge are the 2 current ones on Windows.

 

In order for it to be as effective as possible, some admin controls have to be implemented like the ability to run incognito or private modes for example. The documentation lists more examples of what needs to be disabled in order for the filtering to be more effective but at the end, only browser traffic gets filtered. Applications won't be.

 

The trade off here is ease of use and configuration for external filtering, rather than having proxy settings enforced on a system, which also could be bypassed is users have any sort of privileged access on their device.

 

You are not confused at all, the limitations you describe are real worries and needs to be addressed as much as possible. Once you have decided if the trade offs are worth it, you can decide if the cloud extension or another solution (forced proxy settings, enforced VPN etc) are better options for your use case.