Secondary School - iPad onsite and offsite filtering + alerting

[Tefters]

Afternoon all,

 

Any secondary schools out there running a 1:1 iPad scheme? If so what products are you using for your filtering and safeguard alerting solutions.

I'm ready to throw in the towel with our current provider as its just not working as advertised after 3 years.

 

Only interest in iPads, if it was a laptop or MacBook then my life would be 10000x easier with an installed agent.

[2ilent8cho]

Lightspeed. You just set the email for the device owner in the MDM, deploy the agent to the iPads with a config profile too and it's all seamless to the user. No login required by the students and you get real time safeguarding alerts. Integrates with Office 365 too so will scan their emails and OneDrives.

[Tefters]

Lightspeed. You just set the email for the device owner in the MDM, deploy the agent to the iPads with a config profile too and it's all seamless to the user. No login required by the students and you get real time safeguarding alerts. Integrates with Office 365 too so will scan their emails and OneDrives.

Funnily enough they are the ones I am looking to leave after 2 years.

The filtering works fine, the safeguard alerting, not so much...

 

Do you have an on-prem rocket filter or whatever they call it nowadays that you send the iPads through or are you using their full cloud solution?

 

I've been using their full cloud solution and the issue I have is that whenever I pull out an iPad (usually once every 3 months) and setup as a test student and start typing in such things as "how many paracetamol to overdose", "how to kill myself painlessly" or "how to slit my wrists" it is very hit and miss to whether it wants to alert or not. Every time I test I change the parameters i'm searchng for and majority of the time it misses and doesn't catch. On top of that it will only alert on anything searched via Google, use another search engine and it cannot alert.

 

When was the last time you sat down and tested in iPad against it out of curiosity?

[gbtb]

We use Securly (Filter and Aware) for our filtering and monitoring here, works across all devices from Windows to iOS. You can either push out the settings using SmartPAC to the managed devices and also DNS level filtering is available. Reporting and alerting are good, and they also offer a paid for monitoring service (On-Call) where they will monitor and alert via telephone for serious issues.

[2ilent8cho]

Funnily enough they are the ones I am looking to leave after 2 years.

The filtering works fine, the safeguard alerting, not so much...

 

Do you have an on-prem rocket filter or whatever they call it nowadays that you send the iPads through or are you using their full cloud solution?

 

When was the last time you sat down and tested in iPad against it out of curiosity?

 

We use the full cloud version, no on premise rocket. We have not tested for a while as we get that many real alerts daily, plenty of suicide ones, and today several alerts including school shootings.

[RLR]

We use our onsite filtering for students offsite. We push a PAC file to their devices that forces them to authenticate with our Fortigate firewall. This means they are filtered the same offsite and onsite. Whilst onsite they don't need to login as the traffic is coming from a specific IP. We always had issues with other offsite filtering options with iPads as Apple really limit what can be done with them. We combine our Firewall with fortianlyzer and FastVue for safeguarding.

[Tefters]

We use the full cloud version, no on premise rocket. We have not tested for a while as we get that many real alerts daily, plenty of suicide ones, and today several alerts including school shootings.

 

And you are getting these alerts through web searches and not things typed into office 365 because this sounds completely different to our experience over the last 2 years.

We've had engineers confirm everything in our setup is correct and even confirmation from their support that web searches show under the filtering but not through the alerting system.

[2ilent8cho]

And you are getting these alerts through web searches and not things typed into office 365 because this sounds completely different to our experience over the last 2 years.

We've had engineers confirm everything in our setup is correct and even confirmation from their support that web searches show under the filtering but not through the alerting system.

It says google.com/search in the source.

 

[Tefters]

If you get a chance / are able, can you do some searches around "overdose", "painless ways to die", "slit wrists" and see if you get any alerts.

[Brax]

I had a chat with smoothwall about this at BETT as I felt our solution for 1:1 iPads could be improved. Essentially you have to enforce a browser to get any kind of decent filtering along with configuring Jamf safe internet and on-prem filtering. As you say the alerting I felt wasn't great and didn't offer something like impero or similar providers do for PC's. Another issue lies in stuff they type in for other apps too due to how iPads are configured. I've now left education but before I left the school they moved internet provider and liked what filtering schools broadband offer for ipads and from what I saw of it; seemed quite good. Edited November 4, 2024 by Brax

[Tefters]

Cheers all or the input so far.

 

As far as monitoring of words in other apps on an iPad I know it's impossible except for Microsoft apps that save online to OneDrive, SharePoint or Exchange as these can be picked up via other API hook in methods so ultimately it simply boils down to web browsing.

 

Now there are many different providers and ways of doing web filtering which is the easy part. PAC file, DNS redirection and these can be utilised with a proxy app installed on the device or a captive portal when in unknown locations (off-prem).

 

Where this all falls short is the alerting and it being hit and miss or bound to only 1 search provider. Some of this is down to the provider and some is down to Apple and their restrictions on what you can do on an iPad.

 

The best I've seen and can think of is a custom web browser app which essentially logs everything you type in it and can then report on that regardless of the site.

 

Go back 2 1/2 years ago I looked at Classroom.Cloud as they were the only people offering such a thing. It was ok at the time but had limitations on no third party authentication (Azure/Entrance) so required a login from its own system which just wasn't going to work. They also offered non authentication surfing which again was a big no no. I believe this has since changed and I need to review via another trial but the price point is a little disappointing for a web browser on an iPad that is just doing safeguarding keyword logging/reporting.

I also need to fully test the product to make sure it can do what it says on the tin.

Yes the product does and can offer a lot more but only on a PC/Mac level like all the others.

 

I asked them about whether it could do web filtering also but the simple answer is only Whitelist/Blacklist so that's a non-runner especially with secondary school kids so I would need a separate filter still.

 

I'm really hating iPads with a passion at this point in this scenario as I feel it's like trying to drive a square peg into a round hole. If it was a Windows or Mac device I could just install an agent/application and be done with it all.

 

Maybe I'm being too safety conscious and web filtering is enough and alerting is not required, my major concern is that we are providing the devices for students to use externally from our 4 walls so that responsibility lies on us to proactively alert if children are trying to search up self harm even if they can't get to it?

 

Go to Google and type in "how to sleep forever" and you get plastered with Samaritans and other support group sites/numbers for the results, I can see it in the test user web filtering search results logs but do you think I get an active alert for it from my current safeguarding provider, nope!

These products are far superior on an actual computer and probably work all the time (can't comment, haven't tested) but the struggle is real to find a solution that just works on these fruit based slates.

Edited November 4, 2024 by Tefters

[DGardiner]

if you use shared ipad mode smoothwall filter is good with the right app config, login once and it follows the user with their custom browser app.

[Cat_Jam148]

Cheers all or the input so far.

Go back 2 1/2 years ago I looked at Classroom.Cloud as they were the only people offering such a thing. It was ok at the time but had limitations on no third party authentication (Azure/Entrance) so required a login from its own system which just wasn't going to work. They also offered non authentication surfing which again was a big no no. I believe this has since changed and I need to review via another trial but the price point is a little disappointing for a web browser on an iPad that is just doing safeguarding keyword logging/reporting.

 

 

I would recommend giving Classroom Cloud another go. We've been with them for 2 years now, running it on around 300 iPads and have been pretty happy with the whole package. They do have 3rd party authentication now, and the alerting is pretty good! Our DSL is very happy with the system as a whole, and with our renewal coming up, found that it still is the best for what we want to achieve with our monitoring software.

 

You'll still have to look at another provider like Securley for the filtering side, as CC only cover monitoring.

[Tefters]

I would recommend giving Classroom Cloud another go. We've been with them for 2 years now, running it on around 300 iPads and have been pretty happy with the whole package. They do have 3rd party authentication now, and the alerting is pretty good! Our DSL is very happy with the system as a whole, and with our renewal coming up, found that it still is the best for what we want to achieve with our monitoring software.

 

You'll still have to look at another provider like Securley for the filtering side, as CC only cover monitoring.

 

Cheers, that's pretty much where my head is at now.

 

Do you use your devices offsite also and if so what is the experience like? Is it captive portal or another app installed on the iPad?

 

I have a love / hate view of Lightspeed at the moment (current supplier) as I love the fact you install the app on the iPad and everything is seamless to the end user regardless of location.

 

Exa proposed an extension on my current Quantum filtering solution I use for the desktop estate to their Quantum+ which would cover devices off-prem but would involve a captive portal. Its something I am going to look into but I don't know how much i like the idea an end user experience of logging into a captive portal to surf the net and then by the sounds having to authenticate for the actual browser itself too?

 

Will be interesting to see once I get some trials and testing running.

[tom_newton]

These sorts of issues are why we reluctantly built a custom browser (on top of firefox). At least this way we can capture full URLs, and also anything typed in the browser.

[Tefters]

These sorts of issues are why we reluctantly built a custom browser (on top of firefox). At least this way we can capture full URLs, and also anything typed in the browser.

 

Morning Tom,

 

Do Smoothwall offer a full cloud solution where iPads can be both filtered as well as safeguarding alerting take place?

 

Essentially I have 3 boxes I need ticking:

 

1. I want all traffic through a cloud proxy, not coming back on-site through our internet pipe to go through an on-prem device and back out again.

2. Needs to be a competent filtering solution, not just a simple blacklist/whitelist.

3. Must be able to alert of key words/terms/phrases as mentioned above regardless of what search engine they are typed in on.

 

If you can meet all these criteria then great!

[tom_newton]

All those criteria, yes - although no proxies in the cloud. While these exist, we aren't fans - they have all the issues of regular proxies (mitm, failing sites, horrible failure modes) plus a few others (cost, sharing IPs with who knows who in who knows where). As such all of our cloud solutions work by making filter decisions on the device - so on the ipad, we build a filter into the firefox browser (or on chromebook we put it in an extension). This way, the device can always make an extremely rapid decision on block/no block, and has as much data as possible to go into that process. We then reach out to our cloud for things like "hey I need to send an alert to the DSL".

 

Feel free to drop me an email - [email protected] - and I can put you in touch with the right folks to show you this in action.

 

Tom

[Tefters]

Thanks Tom, will drop an email.

 

Just when i thought things couldn't get any worse my colleague has passed me the below screenshot as he was doing some due diligence and checking the suspicious web URL's over the last few days.

 

Apparently the Lightspeed filtering yesterday allowed this on a students iPad:

 

 

How... I mean words cannot describe my current feelings here.

 

[Brimstone]

Lightspeed. You just set the email for the device owner in the MDM, deploy the agent to the iPads with a config profile too and it's all seamless to the user. No login required by the students and you get real time safeguarding alerts. Integrates with Office 365 too so will scan their emails and OneDrives.

 

Securly Filter and Aware does the same...

[Brimstone]

All those criteria, yes - although no proxies in the cloud. While these exist, we aren't fans - they have all the issues of regular proxies (mitm, failing sites, horrible failure modes) plus a few others (cost, sharing IPs with who knows who in who knows where). As such all of our cloud solutions work by making filter decisions on the device - so on the ipad, we build a filter into the firefox browser (or on chromebook we put it in an extension). This way, the device can always make an extremely rapid decision on block/no block, and has as much data as possible to go into that process. We then reach out to our cloud for things like "hey I need to send an alert to the DSL".

 

Feel free to drop me an email - [email protected] - and I can put you in touch with the right folks to show you this in action.

 

Tom

I would not touch the browser used in this solution...Securly doesn't require the removal of Safari..

[tom_newton]

I would not touch the browser used in this solution...Securly doesn't require the removal of Safari..

 

Which is why it picks up on much less - eg this post would be picked up by Smoothwall... it's a choice.

[Tefters]

I'm with Tom on this one and I said it earlier in the thread before Tom joined in, from the last 2 years of experience, testing and investigation, unless you are using a custom web browser from a company (we are talking iPad only here) then not everything is being picked up and alerted on properly.

[CHiLL]

All those criteria, yes - although no proxies in the cloud. While these exist, we aren't fans - they have all the issues of regular proxies (mitm, failing sites, horrible failure modes) plus a few others (cost, sharing IPs with who knows who in who knows where). As such all of our cloud solutions work by making filter decisions on the device - so on the ipad, we build a filter into the firefox browser (or on chromebook we put it in an extension). This way, the device can always make an extremely rapid decision on block/no block, and has as much data as possible to go into that process. We then reach out to our cloud for things like "hey I need to send an alert to the DSL".

 

Feel free to drop me an email - [email protected] - and I can put you in touch with the right folks to show you this in action.

 

Tom

Sorry to hijack this thread, but I have a related question. We use Smoothwall Monitor on our desktops and would like to test and push your browser to our iPads, especially for the integration into MyConcern, However, our iPads are all not shared devices (they're just configured with our iPad accounts and restricted via Intune), I want to check to see if your browser can be configured to enforce user's to sign into a Microsoft account before they can access websites. We have been testing Senso's browser for this and it requires the user to sign into their school Microsoft account, which is what we want as it tracks the student's use Internet use. However, it would require us to purchase extra modules in order to utilise the logging and MyConcern integrations, so if we could achieve this within our current Smoothwall license and it operates how we want...that might solve things for us.

[Brimstone]

Which is why it picks up on much less - eg this post would be picked up by Smoothwall... it's a choice.

It doesn't pick up on less, it just depends on the sentiment being used within the search criteria you specify.

 

I'd ask the OP to check with all the teaching staff telling them that Safari will be removed from all iPads, that reaction alone should tell him/her the solution they need.

Edited November 5, 2024 by Brimstone

[Tefters]

It doesn't pick up on less, it just depends on the sentiment being used within the search criteria you specify.

 

I'd ask the OP to check with all the teaching staff telling them that Safari will be removed from all iPads, that reaction alone should tell him/her the solution they need.

To put it bluntly, the staff don't have a clue.

My staff user base are about 5 to 10 % competent power users, the rest just surf the web not having a clue what browser they are using or any of its main features.

 

If anything, iPads are the only Apple product in use within the school so using Safari competently and saving bookmarks etc... would have no benefit off device as they use Windows PC with MS Edge and Entra accounts where their bookmarks are all cloud synced so they would be better off having Edge over Safari on the iPad purely for the cloud synced features being compatible with PC's or replace every PC in the school with a Mac to utilise iCloud sync.

 

The same logic applies to the Apple mail app and when I first started I left it on iPads and made Outlook available for ease and whoever wanted it. After having so many issues with the native mail app and shared mailboxes being a PITA I removed that when it became available as option and forced Outlook mail app on iPads which is a breeze to use in comparison when using Office365 mailboxes.

 

My big concern with using a third party browser is how does that tie in with the likes of JamF teacher or even Apple Classroom apps as they offer URL blocking / Allow options and does that only translate to Safari or does it translate to any browser on an iPad as teachers do use those options on a class by class basis for control with misbehaving kids and trust me there are A LOT of those in Secondary schools.

 

Again, this is where extensive testing comes into play.

 

The smartest department in Apple is not their technology department but their marketing department. They do a fantastic job of making everyone want an Apple product and the latest one but people have no idea how to use all the functionality in them and when they also pitch their school marketing about how great for education they are but when you look at what Apple themselves offer for education in terms of controls, management, document sharing and even blocking of simple features its abysmal and left to third parties to try and clean up the mess with what little access Apple allow to iPads as they advertise them as being able to do everything and more but they are simply not a full blown computer replacement. Yes, I'm looking at you Airplane mode that you can't restrict so kids just flip this on to kill WiFi and Bluetooth so teachers can't manage them, you can individually block WiFi on/off and Bluetooth but not Airplane mode! Or even background image change, you can restrict that but then they released Focus mode which can then circumvent that. It's a nightmare.

Edited November 5, 2024 by Tefters