BYOD/Guest WiFi - Encrypted Client Hello

[psynegy]

We've been looking on and off for months now at replacing our MSCHAPv2/PEAP/802.1x wireless network security with something like Cloudpath MPSK/DPSK enrolment. We do not currently HTTPS inspect our BYOD network.

 

We had decided to put it to bed for now due to the eyewatering licencing costs and rumoured potential merging of Ruckus One and Cloudpath, but the recent ECH (Encrypted Client Hello) email from Smoothwall has brought it back to the front of the queue. Paraphrasing slightly, but our interpretation of the information from Smoothwall was that unless you are doing HTTPS inspection - you're either going to lose access chunks of the internet (by blocking ECH) - or you're not going to be filtering/monitoring appropriately (by allowing ECH traffic).

So as far as we can tell, we have a few options:

 

1. Bye bye BYOD - very unpopular with our staff and sixth form - we have terrible phone signal here
   
2. Cloudpath enrolment SSID with certificate based enrolment, and bundle in our Smoothwall decryption cert - expensive and cumbersome to use - and impossible to use for visitors without administrative access to device(?). Lots of support calls.
   
3. Continue with PEAP, but tell people they must install the certificate from /getmitm - continued loss of access for newer devices due to MSCHAPv2/PEAP deprecation - same issues as option 2, but free. Lots of support calls.
   

Our only totally radical idea thus far has been to provide basic DNS filtering (if that's even a thing any more with DNS over TLS/HTTPS??) but only provide access with parental consent. We don't think this is a go-er due to incompatibility with DfE requirements however:

Your filtering system should be active, up to date and applied to all:

• school or college-managed devices, including those taken off-site
  
• unmanaged devices under a bring your own device (BYOD) scheme
  
• guests who have access to the school internet
  

Which brings up another question - how can we satisfy the filtering requirement for visitors who turn up with laptops that they don't have administrative access to install root certificates?

 

I have to say - the thought of installing root certificates on peoples personal devices gives me the heebie-jeebies. Think of how much money root certification authorities put into securing their private keys... there's a reason for that! I certainly don't want to have to tell parents that their children's devices all have compromised security because we got ransomwared and they took our certificate keys!

 

Is anyone using Intune for BYOD? It would certainly make deploying Wi-Fi configuration and the inspection certificates easier - does raise other concerns around privacy and security of course.

 

I don't give it long before something like this comes along and we're back to square one...

 

What are your plans for meeting these DfE and technical requirements that are seemingly at odds?

[tom_newton]

Personally, I think the DfE guidelines are broadly incompatible with BYOD. Without MiTM, there's relatively little discrimination available to filters.

 

We will be releasing an update next week which allows you to strip ECH from DNS requests. This will plug a gap and stop sites using ECH - but we have to then block DoH, which we can do, but is a bit of a whackamole.

[Primus]

We've withdrawn BYOD for students, we still allow it for staff and visitors but with a MITM certificate installed and VPNs blocked for everyone.

 

This obviously causes problems where people don't have permission to add a certificate to a device and where staff require a VPN eg. our auditors or NHS nurses running vaccinations.

[psynegy]

We will be releasing an update next week which allows you to strip ECH from DNS requests. This will plug a gap and stop sites using ECH - but we have to then block DoH, which we can do, but is a bit of a whackamole.

Will the stripping of ECH from DNS be a packet modification type affair or require us to use Smoothwall as a DNS relay?

 

This obviously causes problems where people don't have permission to add a certificate to a device and where staff require a VPN eg. our auditors or NHS nurses running vaccinations.

 

What do you do in those scenarios? "Sorry kids - no vaccinations today!" ?

Edited November 14, 2024 by psynegy

[Primus]

What do you do in those scenarios? "Sorry kids - no vaccinations today!" ?

 

They are meant to have NHS 4G hotspots they can use - not our problem. They've never not carried out vaccinations as a result.

[Boredguy]

They are meant to have NHS 4G hotspots they can use - not our problem. They've never not carried out vaccinations as a result.

 

We've had the School Nurse groups having to use their own 4/5G Hotspot as we've had VPN's blocked on our BYoD for years. Every now and then when the staff change they bring it up but have to carry on with their own WiFi (doesn't help when they get put into areas of the site where there is no signal, but for the bulk vaccinations the room has good signal)

[dmj]

They are meant to have NHS 4G hotspots they can use - not our problem. They've never not carried out vaccinations as a result.

 

Unless your Wifi system detects it and automatically sends deauth signals.....

[Primus]

Unless your Wifi system detects it and automatically sends deauth signals.....

 

We wouldn't be doing that - I think it's still unclear as to whether that's legal isn't it?

[Synkrox]

IMHO BYOD =/= Guest wifi

 

BYOD for school staff/students to use their own device if they choose to bring them in. I've had success just using explicit proxy pushed via PAC/WPAD files, but I only supported laptops and not iOS/android as half the apps wouldn't work via proxy and MITM is too involved. Phones and whether they have signal for whatsapp and tiktok is their problem TBH.

 

Guest WiFi can be a "light touch" filtering. I use a captive portal and guest login slips that expire 12 hours after first login on our firewall. External guests have no trouble connecting to their VPNs etc.

[Primus]

IMHO BYOD =/= Guest wifi

 

BYOD for school staff/students to use their own device if they choose to bring them in. I've had success just using explicit proxy pushed via PAC/WPAD files, but I only supported laptops and not iOS/android as half the apps wouldn't work via proxy and MITM is too involved. Phones and whether they have signal for whatsapp and tiktok is their problem TBH.

 

Guest WiFi can be a "light touch" filtering. I use a captive portal and guest login slips that expire 12 hours after first login on our firewall. External guests have no trouble connecting to their VPNs etc.

 

Given recent changes to DfE guidance to be more specific you may need to revisit this.

[DarkMaster]

I wonder if the DFE would like to publish how we manage all of this and pay for the upgrades for the wifi and filtering

[Synkrox]

Given recent changes to DfE guidance to be more specific you may need to revisit this.

 

I'm not so sure, the guidelines split the devices 3 way, as I have:

 

-school or college-managed devices, including those taken off-site

-unmanaged devices under a bring your own device (BYOD) scheme

-guests who have access to the school internet

 

BYOD filtering works without certificate deployment.

 

Guest WiFi- In terms of who can access this network at all it is the most tightly controlled. We still have blocks and reports in place, but not all the app-level and ssl stuff we would for students/staff. As a SEND school with many NHS/LA people coming and going on a regular basis it would be totally unrealistic to block them all from using their workplace VPN when they visit.

 

I don't think the guidance is totally exhaustive or removes the ability for the school to have a common-sense approach where necessary.

[Primus]

I'm not so sure, the guidelines split the devices 3 way, as I have:

 

-school or college-managed devices, including those taken off-site

-unmanaged devices under a bring your own device (BYOD) scheme

-guests who have access to the school internet

 

BYOD filtering works without certificate deployment.

 

Guest WiFi- In terms of who can access this network at all it is the most tightly controlled. We still have blocks and reports in place, but not all the app-level and ssl stuff we would for students/staff. As a SEND school with many NHS/LA people coming and going on a regular basis it would be totally unrealistic to block them all from using their workplace VPN when they visit.

 

I don't think the guidance is totally exhaustive or removes the ability for the school to have a common-sense approach where necessary.

 

The standard specifically mentions blocking technologies such as VPNs that can be used to get around the filtering.

Edited November 14, 2024 by Primus

[Primus]

The standard specifically mentions blocking technologies such as VPNs that can be used to get around the filtering.

 

Furthermore:

Your filtering system should be active, up to date and applied to all:

 

school or college-managed devices, including those taken off-site

unmanaged devices under a bring your own device (BYOD) scheme

guests who have access to the school internet

[timbo343]

Furthermore:

Your filtering system should be active, up to date and applied to all:

 

school or college-managed devices, including those taken off-site

unmanaged devices under a bring your own device (BYOD) scheme

guests who have access to the school internet

 

Technically BYOD / unmanaged / guests are still being filtered at DNS level, even without MitM installed.

[Synkrox]

Furthermore:

Your filtering system should be active, up to date and applied to all:

 

school or college-managed devices, including those taken off-site

unmanaged devices under a bring your own device (BYOD) scheme

guests who have access to the school internet

 

It also says it shouldn't unreasonably impact the running of the school, or something along those lines.

 

Filtering is applied, just at an appropriate level for the user.

 

I guess if you don't WANT to give guests access then by all means use it as the justification, but otherwise it's kinda nice to be able to give the people what they need and expect. (and gives you a quiet life)

 

I would say that our filtering and policies have been through OFSTED, looked at in detail by external safeguarding consultants, and my head who these decisions are made alongside is a former OFSTED inspector so I'm not sitting in a bubble being blase about it.

We've looked at it and that's our take. Anyone worried should speak to the head and make the call between what's technically possible and what the guidance suggests, as a lot of the blame lands at their door now anyway!

[Primus]

It also says it shouldn't unreasonably impact the running of the school, or something along those lines.

 

Filtering is applied, just at an appropriate level for the user.

 

I guess if you don't WANT to give guests access then by all means use it as the justification, but otherwise it's kinda nice to be able to give the people what they need and expect. (and gives you a quiet life)

 

I would say that our filtering and policies have been through OFSTED, looked at in detail by external safeguarding consultants, and my head who these decisions are made alongside is a former OFSTED inspector so I'm not sitting in a bubble being blase about it.

We've looked at it and that's our take. Anyone worried should speak to the head and make the call between what's technically possible and what the guidance suggests, as a lot of the blame lands at their door now anyway!

 

Filtering is entirely bypassed if you allow them to use a VPN...

 

- - - Updated - - -

 

Technically BYOD / unmanaged / guests are still being filtered at DNS level, even without MitM installed.

 

Not if you allow them to use a VPN.

[flyinghaggis]

Filtering is entirely bypassed if you allow them to use a VPN...

 

I suppose the question them becomes have you taken reasonable steps to prevent them from using a VPN? Or is it considerded too easy to bypass restrictions and use a VPN if they have their own device without anykind of HTTPS inspection enabled?

[Primus]

I suppose the question them becomes have you taken reasonable steps to prevent them from using a VPN? Or is it considerded too easy to bypass restrictions and use a VPN if they have their own device without anykind of HTTPS inspection enabled?

 

From comments made on this thread it doesn't appear IMHO that the people concerned have taken reasonable steps - they appear to be aware of people using their WiFi with VPNs and are happy for them to do so.

[flyinghaggis]

From comments made on this thread it doesn't appear IMHO that the people concerned have taken reasonable steps - they appear to be aware of people using their WiFi with VPNs and are happy for them to do so.

 

I suppose, being fair on people, the issue I've found is that it's not always straightforrward to prevent VPN use when you have pupils or staff with their own devices, minimal visibility on your part and you aren't necessarily able to install certiifcates/management software on them.

 

Everytime we find a method of monitoring/filtering pupil devices something else appears, like ECH, that lets them effectively bypass/prevent it. Quite honestly it feels like we're fighting against all the major platform vendors and IT Security companies when trying to implement filtering for pupils! Especially when you look at the practicallity of trying to match up DfE mandates with the Education Sector's desire for the widespread use of BYOD.

Edited November 14, 2024 by flyinghaggis

[Primus]

I suppose, being fair on people, the issue I've found is that it's not always straightforrward to prevent VPN use when you have pupils or staff with their own devices, minimal visibility on your part and you aren't necessarily able to install certiifcates/management software on them.

 

Everytime we find a method of monitoring/filtering pupil devices something else appears, like ECH, that lets them effectively bypass/prevent it. Quite honestly it feels like we're fighting against all the major platform vendors and IT Security companies when trying to implement filtering for pupils! Especially when you look at the practicallity of trying to match up DfE mandates with the Education Sector's desire for the widespread use of BYOD.

 

Very true - that isn't how I read their posts however and also once you're aware that VPNs are working you ought to be doing something about it. It may be like whack-a-mole but that doesn't mean you give up.

[Synkrox]

Filtering is entirely bypassed if you allow them to use a VPN...

 

- - - Updated - - -

 

 

 

Not if you allow them to use a VPN.

 

Just to clarify my position.... VPN/RDP/TeamViewer/VNC/Splashtop and all other traditional methods of remotely accessing an unfiltered device is only permitted for the comparatively tiny amount of guest users we have. (not BYOD or students)

 

The vast majority use a VPN for work purposes, and not for reasons that would compromise safeguarding... and therein lies the balance.

 

The people that insist on using their own connection when perfectly useable WiFi is available are the ones you should be cautious of!

[Primus]

Just to clarify my position.... VPN/RDP/TeamViewer/VNC/Splashtop and all other traditional methods of remotely accessing an unfiltered device is only permitted for the comparatively tiny amount of guest users we have. (not BYOD or students)

 

The vast majority use a VPN for work purposes, and not for reasons that would compromise safeguarding... and therein lies the balance.

 

The people that insist on using their own connection when perfectly useable WiFi is available are the ones you should be cautious of!

 

Yet by allowing this you are not following the standard which says:

Your filtering system should be active, up to date and applied to all:

school or college-managed devices, including those taken off-site

unmanaged devices under a bring your own device (BYOD) scheme

guests who have access to the school internet

 

Because you are blind to their traffic you have no evidence to support the assertion that they won't compromise safeguarding.

[psynegy]

Yet by allowing this you are not following the standard which says:

Your filtering system should be active, up to date and applied to all:

school or college-managed devices, including those taken off-site

unmanaged devices under a bring your own device (BYOD) scheme

guests who have access to the school internet

 

Because you are blind to their traffic you have no evidence to support the assertion that they won't compromise safeguarding.

 

Whilst I agree this is to the letter of the DfE standards (is it guidance or …?) there is a practical consideration that instead they just turn off WiFi and use 5G. Where students are concerned there’s a parental consent/control element that comes into play, but what if the kid stands outside of Costa on the way home and uses their WiFi?

 

I do wonder if parental consent for “Costa” style WiFi access is going to be the only sane way forward here. Any reports of abuse or credential sharing and they receive a ban. Simple, cheap and parents can choose. You could still make best efforts on filtering and monitoring, but honestly, unless you’re inspecting, you’re never going to stop a well disguised HTTPS tunnelled VPN.

 

When 5G, VPNs or WiFi from next door render the whole thing meaningless, beyond a yes/no from parents, I don’t see the point in making everyone’s lives way harder than they need to be.

[Primus]

Whilst I agree this is to the letter of the DfE standards (is it guidance or …?) there is a practical consideration that instead they just turn off WiFi and use 5G. Where students are concerned there’s a parental consent/control element that comes into play, but what if the kid stands outside of Costa on the way home and uses their WiFi?

 

I do wonder if parental consent for “Costa” style WiFi access is going to be the only sane way forward here. Any reports of abuse or credential sharing and they receive a ban. Simple, cheap and parents can choose. You could still make best efforts on filtering and monitoring, but honestly, unless you’re inspecting, you’re never going to stop a well disguised HTTPS tunnelled VPN.

 

When 5G, VPNs or WiFi from next door render the whole thing meaningless, beyond a yes/no from parents, I don’t see the point in making everyone’s lives way harder than they need to be.

 

Good luck defending yourself when you've got an issue and you're deliberately not following DfE guidance/standards.

 

Through a bit of engagement with Smoothwall we've had great success blocking VPNs on our guest network - I routinely test VPNs and I haven't been able to get any to connect in a long time now - as an aside when we were doing work on this it was several years ago and as a result of becoming aware of VPN usage by students on our WiFi to bypass our filters (something we now prevent entirely by not allowing them to use the WiFi). I was sitting in an office in one of our schools and finalising the settings etc. As I applied them I sat back and thought to myself "I wonder how long this will take to take effect", only to hear a student loudly shouting in the corridor "They've f-ing blocked our VPN!"