Student policy - less restrictive

[ryanplym]

Hey

Happy Thursday.

 

 

We had fun yesturday. One of our sixth form students decided it would be fun to run a python encription script on our server (They have been learning about python in their IT lesson.... about encyrption..) Lucky, they have limited access and was unable to encrpt anything. It looks like a pre-made script downloaded from the internet. The students are also accessing powershell to run things such as wget. ping, ipconfig etc. They have also uploaded shortcut scripts and random tools (such as a active directory browser) to their onedrive, download it on the school PC and run it. I found a text file with all the usernames. I was watching this student in realtime on Netsupport, so I blocked his account and logged him off. I have found he has uploaded portable games to his onedrive account. I was told by SMT to unlock his account as he needed it for his IT lesson....

 

 

Basically... I want to lock down access to powershell and harmful tools for the students, which I have done on group policy (looking into the onedrive upload restrictions) but the IT teacher is kicking off about allowing it in his IT room. So, I deneid the standard student group policy for his classroom, put a new policy in place, denying all other PCs other than his classroom. But he wants the students to access these tools in other unmonitored areas of the school, such as the sixth form centre. Back to square one.

 

Has anyone else managed to successfully keep the IT teacher happy and put a policy in place that allows students to access python etc but without it causing harm / allowing students to play games etc?

[6Foot2]

Could you give them access to virtual machines?

 

It's a long time ago now, but I was able to set up virtual machines where students were able to code as they liked, but they couldn't save any (potentially) harmful code back to shared drives, or their home folders (Group Policy didn't allow it)

 

Could you do something similar?

[Davit2005]

Don't allow running scripts from home drives/shares. They should be running in an isolated environment ideally. Even we should not be running scripts that we are unsure what they do in a production environment :-)

[ryanplym]

Thats not a bad idea. Thanks for the suggestion. The IT teacher wants the students to upload the py files to OneDrive\teams so he can view the files himself. I was thinking about creating virtual machines with no internet access but the students wont be able to save their files to onedrive. I am baffled on how I can do this. If I allow internet access, students can use the virtual machine to play games and download scripts etc but this will also give them the ability to download the scripts to the school computer

[PotNoodleTech]

It's not fun - but you can't be allowing scripts like that to run on any network connected PC as a) your putting all your data at risk, and b) you'll instantly fail any cybersecurity audit/best practice.

 

Most schools seem to go the virtual machine route to allow pupils to do almost whatever then want on their virtual machine.

 

It's not a quick and easy set up though and you'd need to get your IT teacher on board.

[3s-gtech]

The security of your network, protection of data on it (= safeguarding) and continuity of service all trump the easy availability of these features. Allowing them to work needs to be a secondary consideration, in that you enable them to work in an isolated and safe way or not at all.

 

That's not to go all 'no one can do anything because it's not secure', but that certainly needs to be the baseline.

[6Foot2]

Thats not a bad idea. Thanks for the suggestion. The IT teacher wants the students to upload the py files to OneDrive\teams so he can view the files himself. I was thinking about creating virtual machines with no internet access but the students wont be able to save their files to onedrive. I am baffled on how I can do this. If I allow internet access, students can use the virtual machine to play games and download scripts etc but this will also give them the ability to download the scripts to the school computer

 

Re: Saving student work/code: I created shared network folders that were visible in the virtual machines, and also visible to the tutors.

 

To counter attempts at plagiarism, I made the permissions on the folders write only so that students could save their work there, but they could not alter, copy or delete the work of other students because they could not see it. Even if they could, they did not have ownership, so they could not save over the top of work already there.

 

I suggested a naming convention for the work, which was "studentnetworkname.today'sdate" It was up to the teacher whether they followed this or not, but it's amazing how many times they came to me to say "students couldn't save their work today" When I asked what the error was, they would typically reply with "File already exists"

 

[Oaktech]

We upgraded a suite to be able to run virtualbox and set up immutable VMs they could then do as much damage as they wanted in there with immunity. Applocker etc remained firmly in place for everything attached to the domain.

[ryanplym]

The IT teacher is completely against the virtual machine idea. "Please do not go down the Virtual machine route. This will severely affect performance issues on machines.

 

Virtual machines can be exposed to network drives, but I don't think this is an appropriate solution.

 

I'd be happy to sit down with yourself, et al to discuss plans going forward for the college network before any segregation etc takes place. "

 

I agree, the sercurity comes first, but here, the teachers get what they want

[Oaktech]

The IT teacher is completely against the virtual machine idea. "Please do not go down the Virtual machine route. This will severely affect performance issues on machines.

 

Virtual machines can be exposed to network drives, but I don't think this is an appropriate solution.

 

I'd be happy to sit down with yourself, et al to discuss plans going forward for the college network before any segregation etc takes place. "

 

I agree, the sercurity comes first, but here, the teachers get what they want

 

 

Your SLT needs to back you up after the near miss with the encryption script. No mucking about, VMs or the module doesn't get taught in it's current format.

[6Foot2]

I was in a similar situation (teachers tended to get what they demanded regardless of consequences for the network)

 

I don't agree with the "performance issue" argument. I had virtual machines working on kit that has been retired for a LONG time now, and we didn't see any problems. The virtual machine is only spun up when it's required and while the students are in the virtual machine they are programming and should not need any other resources: What they do need is provided by the teacher.

 

[flyinghaggis]

I'd be happy to sit down with yourself, et al to discuss plans going forward for the college network before any segregation etc takes place. "

 

 

That's essentially the question to discuss. There needs to be a level of segregation between the live network and computers where pupils have the ability to freely run their scripts, code and applications. To me that either needs to be done with offline VM's running on the live network or you have separate "programming/development" computers (VLAN'd etc) so they're unable to communicate with other devices and computers on the network. Or you look into somekind of cloud/hosted/remote based solution like Replit/etc.

 

I guess it's a discussion to be had at SLT level as generally IT Teachers will continually push for more and more pupil freedom/access on the live network and there has to be a clear line drawn somewhere. If you have pupils able to run python encryption scripts and code/hacking tools designed to harvest AD/user information, scan systems and probe the live network (with evidence this is happening) clearly things can't be left as is.

 

We currently use VM's but our computing staff aren't really happy with the solution (lack of internet access on the VM's being the main point of contention) and keep pressing for dev/coding apps to be locally installed on computers.

Edited October 12, 2023 by flyinghaggis

[psydii]

Let’s not forget that interfering with systems you are not expressly permitted is is a violation of the computer misuse act, and one would hope, your AUP and should be resolved through disciplinary action by SLT. Your DPO should be advised of the incident, and you be steered by their review of the risk going forward.

[ryanplym]

ooo thankyou!!! I have just clicked on replit and this looks perfect. Better than the VM idea i guess

[jthompson]

Please do not go down the Virtual machine route. This will severely affect performance issues on machines. Virtual machines can be exposed to network drives, but I don't think this is an appropriate solution.

 

I think the burden of proof here is to demonstrate why VMs are not an appropriate solution. They need to be tried in earnest before any determination can be made on any performance impact. The words "severely affect perfomance" smell to me of a misconception on their part, or experience of them in a poor configuration. In my experience, prank/bad scripts running on a host can bring it to its knees and necessitate an ungraceful reboot in order for it be become usable again. If those kinds of scripts are run in a VM, the host is not at risk and can still be used normally.

 

As others have said, sandboxing things in a VM is pretty much essential. The things you've mentioned in your OP demonstrate that. Ideally VMs with no network connectivity. We use VirtualBox with immutable disks and no networking. Students home folders are shared into the VM, so that they can open/save their scripts. Scripts which can't be run on any of the host systems due to application allowlisting.

 

Similarly, the teacher use a VM to inspect and run the students' work. They can't run arbitrary scripts directly on their host machine either.

 

There's another advantage to sandboxing which I think you ought to promote. That of students feeling confident to experiment, knowing that they can't break anything, either on the host or the VM. The only risk is a student accidentally trashing their home folder contents, which is no great shakes.

[mavhc]

If letting students run code puts all your data at risk your data has already been stolen, do you not have ACLs to stop students reading files they shouldn't? Or writing to them.

[flyinghaggis]

If letting students run code puts all your data at risk your data has already been stolen, do you not have ACLs to stop students reading files they shouldn't? Or writing to them.

 

Are you suggesting there should be no restrictions in place on what applications/code pupils should be allowed to run and access on a school network beyond basic Windows ACL file permissions....?

Edited October 12, 2023 by flyinghaggis

[mavhc]

SMB/NTFS ACL for files, vlan ACL for devices, AD ACL if students are reading data you don't want from AD, firewall ACL for internet

 

I'm saying that if someone can access the wrong files and encrypt them or something similar just because they can run a script, then your network is insecure

 

Blocking exe/scripts is a second level above that

[kevin_lane]

Hell no

 

The security in place is their for a reason end off

 

if he wants to do that sort of thing, the only thing I would consider is a closed off network I.e not attached to the main network and let them run riot , if they mess it up not your prob let them fix it !

Edited October 12, 2023 by kevin_lane

[3s-gtech]

SMB/NTFS ACL for files, vlan ACL for devices, AD ACL if students are reading data you don't want from AD, firewall ACL for internet

 

I'm saying that if someone can access the wrong files and encrypt them or something similar just because they can run a script, then your network is insecure

 

Blocking exe/scripts is a second level above that

 

To an extent, but firewalls and auth do change that aspect a bit. An internal attack, or an authenticated user account on a domain joined PC will differ significantly from an external user and device. Of course, internal security should be as tight as possible too.

[jthompson]

If letting students run code puts all your data at risk your data has already been stolen, do you not have ACLs to stop students reading files they shouldn't? Or writing to them.

I'm not sure where you stand on application allowlisting, but I'm pretty sure that it's the right thing to be doing.

 

There's a nuisance aspect to this, too, which has been discussed several times in other similar threads, which it would seem reasonable to consider.

[filteringtech]

2 things.

 

1. How are you complying with https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-security-standards-for-schools-and-colleges ?

 

2. As someone always reminds me, in Sex Ed we require pupils to understand certain things about making babies, they don't have a practical class for this where they get to try it out. The same is true for some aspects of Computer Science, understanding how exploits work for example, is in the course syllabus, it doesn't mean they to get to practice on the school's "live" network.

[mavhc]

To an extent, but firewalls and auth do change that aspect a bit. An internal attack, or an authenticated user account on a domain joined PC will differ significantly from an external user and device. Of course, internal security should be as tight as possible too.

 

unplug all the network switches, 100% secure

 

It's handy if the computers can be used for lessons as well. Just watch what the kids are doing and get a free pen test.

 

Eg did you know that since Vista anyone could write to the C:\ drive by default, which causes https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-bypass-security-disaster-leverage-applocker-and-srp/

 

who's going to spend hours finding this stuff just to play a game except bored students?

[flyinghaggis]

SMB/NTFS ACL for files, vlan ACL for devices, AD ACL if students are reading data you don't want from AD, firewall ACL for internet

 

I'm saying that if someone can access the wrong files and encrypt them or something similar just because they can run a script, then your network is insecure

 

 

The issue is that Windows/Domain security alone isn't really enough IME. We actually had a security company in and they literally demonstrated that with just a Windows AD account (which all pupils have [or possibly a "friends" AD credentials]) and the ability to run scripts/code and or hacking/cracking applications unrestricted you can literally wreck havoc on a fully patched Active Directory / File server and the local Windows install even assuming restricted network access to just the AD/SMB ports/protocols alone. Like you mention Microsoft couldn't even properly secure the root of the Windows system drive on clients!

 

As others have said if pupils want to experiment with scripts and applications the school's live academic/business network isn't the place. Best options seem to be :-

 

1) Off-network Virtual Machines running on the client PCs

2) Remote/Hosted apps like Replit or cloud/hosted VMs's

3) Computers/laptops specifically for coding/development connected to a segregated network (VLAN'd / Wifi-Internet Only)

Edited October 13, 2023 by flyinghaggis

[sigma]

The trouble with replit is it hosts a lot of web proxies and as they are so prolific and regularly updated, the filters struggle to keep up.