BYOD & Ipad Filtering / Monitoring - Particularly using Sophos XG

[CyBeRkId2002]

Morning all,

 

I am starting a new job in the next few months and my brain is already ticking over on a number of systems I haven't used before. One of these is best practice using a Sophos XG for BYOD (something we do not use in my current workplace) and iPads (which we do use). I am well versed in Safeguarding requirements and have been using a combination of Securly and Classroom.Cloud - but need to get my head around what is possible with the Sophos. Understandably the school will want and expect any changes to be as seamless and frictionless for students as possible.

 

BYOD

 

So far I have concluded my options may be:

 

• Open access on to the WiFi (obviously with locked down access to just internet / DNS / DHCP etc.) coupled with a captive portal for the Sophos where users enter AD credentials. This is possibly my preferred option.
  
• Potentially setting up 802.1x on the Wifi and passing through the authentication credentials to Sophos XG? Not sure if this is possible
  
• Some kind of MAC restriction and logging who has what IP. Seems longwinded and slightly archaic
  
• 
  

 

What are others doing and are there any other better options I have missed? Regarding the first option (if that is best), what are likely to be the areas of friction? I will want a secure connection to the Sophos for auth so suspect purchasing a certificate would be best so users do not have to install one for that purpose. Even so, I suspect a certificate would need to be installed for SSL inspection if going down this route.

 

Ipads

 

Options for these I think are similar to the above but again would love to hear what others are doing. With the captive portal option I guess I can set a timeout of inactivity for authentication. My thinking is I would probably want this shorter for iPads (possibly 15 minutes or so) which are used by multiple students, than BYOD devices which will be 1:1. I suspect with the captive portal it will be a one-size fits all though.

 

Any guidance on best practice in these scenarios would be greatly appreciated! If people have any consultants who they can recommend who really know these areas to help in best practice particularly in the education sector again, it would be much appreciated.