Bye bye Replit

[dmj]

Their argument was that whatever VM solution we implement use it'll be more awkward for the pupils to login, save work, print, access the internet, etc than it otherwise would be if the apps were directly installed on domain connected workstations. We currently use VirtualBox VMs for coding/web/database/development which can't be covered using Replit and the computing staff aren't happy with it as a solution for the above reasons. Plus, any hosted solution will potentially be expensive whereas installing the software onto client PCs is a no-cost option in terms of their departmental budget.

 

Essentially they've refused to consider it as they want the software installed on client devices now that Replit is no longer usable.

 

That's an incredibly hard ask. Will they accept network isolation or are they genuinely suggesting that any pupil can run any random code they choose to on the same network?

[jthompson]

Really? Printing?!

 

Our VirtualBox VMs use the shared folders feature, such that whatever files they create in the VM are going to live in their regular home folders anyway, so no barrier to printing. Mild simplification of sending something to a printer is no reason at all to argue for arbitrary code execution. If you're not sandboxing in some way, then you're doing it wrong IMHO.

 

I appreciate that that's not addressing your actual question, but hey, I wanted to vent

[mavhc]

But printing on Windows is the best way to have arbitrary code execution, on the print server!

[flyinghaggis]

Will they accept network isolation or are they genuinely suggesting that any pupil can run any random code they choose to on the same network?

 

No. Unfortunately at the moment they're demanding exactly that and aren't prepared to negotiate

 

Our VirtualBox VMs use the shared folders feature, such that whatever files they create in the VM are going to live in their regular home folders anyway, so no barrier to printing. Mild simplification of sending something to a printer is no reason at all to argue for arbitrary code execution. If you're not sandboxing in some way, then you're doing it wrong IMHO.

 

Our Virtualbox image is setup the exact same way using shared folders mapped to the user's home drive. Allegedly, having to use a VM and copy a file back/forth is too complicated for the younger (11-13 y/o) pupils when learning programming.

 

That's why we're trying to investigate if there are viable methods to reliably secure the school's business network if we’re forced to allow users to run/compile their own code and apps using locally installed programming IDE's like Visual Studio.........

Edited December 14, 2023 by flyinghaggis

[dmj]

No. Unfortunately at the moment they're demanding exactly that and aren't prepared to negotiate

 

 

Crazy situation. Does your contract have a clause about network security? If it does it's effectively constructive dismissal IMO. Could you get a union rep or someone from the LA or trust involved to perhaps educate them about what they are asking you to do.

[dhicks]

But printing on Windows is the best way to have arbitrary code execution, on the print server!

 

Actually, PostSript is Turing-complete, you should be able to compute anything that is computable on the printer itself...

 

For network security, does your managed WiFi system have a guest network feature that provides users with a network-isolated internet connection - they can connect to the internet, but not other devices on the network? Might that be the easiest-to-manage solution?

[flyinghaggis]

For network security, does your managed WiFi system have a guest network feature that provides users with a network-isolated internet connection - they can connect to the internet, but not other devices on the network? Might that be the easiest-to-manage solution?

 

We also suggested, if a VM wasn't an option, that computing staff could run programming apps on laptops connected to an isolated (Guest/BYOD type) network but they're unwilling to consider it since it means they'd require separately managed devices/logins, pupils wouldn't have access to their network home drives/etc.

 

Basically, they've cited several other similar/nearby schools who do run programming/development apps on the school's networked computers. The argument being that if other schools are doing it then why can't you? They've also bolstered their argument with a list of requirements from the exam board to suggest that running applications directly on school computers is the only viable solution. Tellingly, I suspect, none of those schools were willing to discuss with me what steps they'd taken to secure the computers on the domain running programming IDEs though? They all replied along the lines of "we don't discuss network security/config" or "The 'school' felt the risk was low/tolerable".

 

The problem being, as things stand, I'm not convinced there actually is a way to adequately mitigate the risk of allowing pupils to freely run code on the domain connected Windows computers and the computing department aren't willing to move on their demand for it.

 

That's why we're looking for suggestions to secure the above scenario......

Edited December 15, 2023 by flyinghaggis

[mavhc]

If the pupils can hack you, the hackers definitely can

[jthompson]

How about some kind of compromise? Retain the VM as a full-fat option, but locally installed python has various libraries blocked out by filesystem privileges to prevent abuse of subprocess, etc.

 

With kids of that age, I'd reckon the most likely risk is infinite loops spawing calc.exe, stuff like that, which will prompt ungraceful shutdowns of hosts.

 

Worth throwing in an argument for a sandbox vm being more conducive to students' confidence to try things out without the risk of 'breaking' the computer.

Edited December 15, 2023 by jthompson

[msi_school]

To be honest this is the schools network, I would make sure the SLT and DPO are aware of my concerns, ask them to put this in the risk register update the Disaster recovery plan and then do as they ask.

 

It is a big security hole and it would concern me as it does you however, it looks like you will not win this and you are in danger of alienating the teaching staff making your life much harder in future when they go looking for shadow IT.

[mavhc]

Does https://sandboxie-plus.com/ help?

[flyinghaggis]

How about some kind of compromise? Retain the VM as a full-fat option, but locally installed python has various libraries blocked out by filesystem privileges to prevent abuse of subprocess, etc.

 

With kids of that age, I'd reckon the most likely risk is infinite loops spawing calc.exe, stuff like that, which will prompt ungraceful shutdowns of hosts.

 

I guess my main concern wasn't so much that they could cause issues with the local host computers but that they'd run network scanning/probing applications/scripts and connect to servers/Active Directory/3rd party servers/devices/etc which could cause networking problems and impact other users and systems.

 

How would that work in terms of setup? Putting NTFS permissions on specific lib file? Maybe if we could restrict Python/IDE's/etc apps from being able to communicate over the network somehow that might be an partial solution. I'm not familiar with how the Python compiler?/interpreter? links into the IDE so could be tricky to establish exactly which apps/exe's need to be blocked. Plus, it may generate complaints if I start restricting things and it prevents the IDE application from saving files to their home folder/etc. I can imagine sandboxing an exe would work well for many apps but it seems like it would be a much more difficult thing to setup when dealing with programming IDEs/interpreters and users running their own scripts and code.

 

To be honest this is the schools network, I would make sure the SLT and DPO are aware of my concerns, ask them to put this in the risk register update the Disaster recovery plan and then do as they ask.

 

It is a big security hole and it would concern me as it does you however, it looks like you will not win this and you are in danger of alienating the teaching staff making your life much harder in future when they go looking for shadow IT.

 

That's probably the solution ultimately as I doubt I'll ever be absolutely confident that pupil's running code/applications freely on the school network can be entirely risk free if the school insists on it.

Edited December 15, 2023 by flyinghaggis

[mavhc]

When someone starts DOS'ing other computers, notice due to logs, and see who it is and get them arrested

[jthompson]

You can also get some AppLocker rules set up that would give the the ability to allow python (or whatever) to be executed only by members of a particular security group. You can then restrict that membership just to the students who need it (if that's meaningful) and also gives you a ban hammer to wield in case anyone prats about. "Blocked.. VM only for you!".

[jthompson]

How would that work in terms of setup? Putting NTFS permissions on specific lib file?

 

That's what I was thinking, yes. It might break it's utility too much in terms of classroom tasks, I don't know, but worth exploring I guess.

[flyinghaggis]

You can also get some AppLocker rules set up that would give the the ability to allow python (or whatever) to be executed only by members of a particular security group. You can then restrict that membership just to the students who need it (if that's meaningful) and also gives you a ban hammer to wield in case anyone prats about. "Blocked.. VM only for you!".

 

That's definitely an option as there's potentially quite a small subset of pupils who require access to computing/programming apps especially at certificate level year groups.

[dmj]

Restricting python from accessing the network seems to be the best way forward (as the school have already discounted solutions that will actually work).

 

How would it work with access to students network shares though?

It's not going to be very long until a student works out the INode limit on the server hosting their files and suddenly the whole shared drive is out of action for everyone as some kid written a one liner that writes 5bn empty files and crashes the filesystem. Perhaps you could get a demo together for SLT. An example of LogoFail would be a good one!

Edited December 15, 2023 by dmj

[dhicks]

If it's any help, the company we have examining our network security (which then feeds in to what we get charged for cyber insurance) don't seem to have flagged workstation-installed IDEs and code executation as being a problem. Our pupil machines in the ICT Room running IDEs (a local Python install along with Idle, plus PyCharm) are Macs and are using Google Workspace logins, so not quite the same setup as others described on this thread. We also monitor the incoming / outgoing internet traffic for unusual activity, we would (hopefully) spot a dodgy script prertty quickly, and our pupils are quite closly supervised when in the ICT Room.

 

Restricting python from accessing the network seems to be the best way forward

 

This is the approach taken by PythonAnywhere for their free accounts - users can sign up, run applications, access the internet for things like Python repositories and a few well-known services, but network traffic to other sites is blocked.

[flyinghaggis]

Restricting python from accessing the network seems to be the best way forward (as the school have already discounted solutions that will actually work).

 

How would it work with access to students network shares though?

 

That does seem like the best option though I'm still a bit unsure how best to achieve it. Contemplating using the Windows Firewall or our AV software to block the "python.exe" somehow? Or is there a better way of achieving this?

 

Though I'm not sure if I'll be able to block it completely from the network as the IDE will still need to be able to read/write files on the pupils network share plus potentially access the server for printing. If I simply block network connectivity completely it'll likely break those features. Though possibly Python.exe is separate from the Pycharm/VisualStudio IDE's executable? Or will the IDE create a separate program executable/process once compiled code is executed?

 

[jthompson]

Presumably, as long as python can access the local filesystem, then a script would be able to work with mapped network drives, without needing to perform any networking in and of itself.

[dmj]

That does seem like the best option though I'm still a bit unsure how best to achieve it. Contemplating using the Windows Firewall or our AV software to block the "python.exe" somehow? Or is there a better way of achieving this?

 

Though I'm not sure if I'll be able to block it completely from the network as the IDE will still need to be able to read/write files on the pupils network share plus potentially access the server for printing. If I simply block network connectivity completely it'll likely break those features. Though possibly Python.exe is separate from the Pycharm/VisualStudio IDE's executable? Or will the IDE create a separate program executable/process once compiled code is executed?

 

 

It looks like (in VSCode at least) that the IDE invokes the python binary so specifically blocking python from network access should work.

You'll need to check if the exam board spec requires anything like access to databases or websites.

 

Presumably, as long as python can access the local filesystem, then a script would be able to work with mapped network drives, without needing to perform any networking in and of itself.

Yes this would work if the drives are already mounted.

[flyinghaggis]

It looks like (in VSCode at least) that the IDE invokes the python binary so specifically blocking python from network access should work.

You'll need to check if the exam board spec requires anything like access to databases or websites.

 

Tried this and with our IDE (Pycharm) it also launches the Python binary so blocking network connectivity for Python using the client Firewall could be an option. Providing the computing department aren't using scripts/programs which try to connect to websites or read/write files as part of them.

Edited December 19, 2023 by flyinghaggis

[dmj]

Tried this and with our IDE (Pycharm) it also launches the Python binary so blocking network connectivity for Python using the client Firewall could be an option. Providing the computing department aren't using scripts/programs which try to connect to websites or read/write files as part of them.

Cool glad you got a workable solution.

 

The irony is that the likes of Jupyter notebooks are just so straightforward to deploy and use.

These computing teachers really need to learn a bit about IT like it's not the early 2000's!

[flyinghaggis]

I noticed today that the DfE guidance explicitly states that Schools should be running unknown code/applications in a sandboxed enviromnent if anyone else is being pushed to install coding apps directly onto school computers following the demise of Replit.

 

https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-security-standards-for-schools-and-colleges

 

"Technical requirements to meet the standard

 

The IT service provider should approve all code and applications that are deployed and make sure they do not pose a security risk. They should do this in the best way possible given available resources.

 

Best practice is to maintain a current list of approved applications. Applications with invalid or no digital signatures should not be installed or used.

 

You could search the internet to check the reputation of the application and the hosting site, or run unknown applications or code within a sandbox environment."

Edited January 29, 2024 by flyinghaggis

[Ditto]

In DfE speak, 'must' is a legal requirement, 'should' recommended. I would expect if you can demonstrate the appropriate protections, I expect other approaches are fine. Besides, what are the inspection process here - I can't see Ofsted checking. None of which should stop you guiding your school in your preferred direction of course!