Balancing Safeguarding with HE VPS access?

[pdparry]

Hi everyone,

 

I’m looking for advice or examples from other institutions on how you’ve managed safeguarding compliance while providing adult learners with access to cloud-hosted resources like VPSs.

 

In our institution, we’ve been using a hosting provider to give HE students (19+ adults) individual VPS instances for building and hosting their projects (e.g., databases, C# web apps, and frontends). These VPSs have been invaluable for their learning, especially as many students study part-time and need remote access.

 

However, a concern has been raised by our IT Services team about these VPSs being outside the college’s filtering and monitoring systems. They’re worried this breaches safeguarding policies such as Prevent and Keeping Children Safe in Education (KCSIE). As a result, we’re at a standstill, and the students have temporarily lost access to their VPSs, which has disrupted their work.

 

We fully understand the importance of safeguarding, but we also want to ensure our adult learners receive a quality experience and the skills they need for the workplace. Has anyone else faced a similar challenge? How have you ensured compliance while still meeting the needs of fee-paying adult learners?

 

We’re exploring ideas like routing VPS traffic through a college-managed VPN or using more centralized solutions like Azure or AWS. If you’ve implemented a solution (technical or policy-based), I’d love to hear about it!

 

Thanks in advance for your advice,

 

Peter

[Steve21]

You may want to check with your own safeguarding team what requirements you need to meet for adult learners, as my understanding was KCSIE only applies to under 18s

 

It sets out the legal duties you must follow to safeguard and promote the welfare of children and young people under the age of 18 in schools and colleges.

 

On the Prevent side of things HE generally also have some different rules for free speech/research etc etc due to the nature of their courses

 

Steve

[Tefters]

I'm with Steve on this one, they are adults therefore the Safeguarding requirements are a little more lenient.

 

When I have done similar exercises for teachers and younger learners I have had the teacher draft up a letter of consent for the parents detailing what / how is being taught and that some safeguarding controls are unavailable due to XYZ reasons, this is then proofed by the deputy or head and sent home to parents for them to agree to and sign so they accept the risks of what we are doing.

 

Safeguarding in IT is always a "best as possible" in my eyes, sometimes students need further access for learning and with that comes risks however we either manage, communicate and educate or simply don't at all and everyone loses out.

Edited December 13, 2024 by Tefters

[pete]

They're adults. From a content POV we filter them the same way we do the staff.

 

If they're adults working remotely, they have their own Internet connection to get up to odd things. "I'll shell into the college-provided third-party VPS and then start looking at odd things" is a weak argument.

 

I'll also echo the "KCSIE doesn't apply" comment.

 

Someone (probably whoever raised this issue in December rather than considering it in the planning stages) needs to wind their neck in.

[psydii]

What HE's obligations currently are is outside of my scope of expertise. BUT...

 

Increase duty of care towards its students is certainly on the agenda.

 

https://hansard.parliament.uk/commons/2023-06-05/debates/9BA59E93-4342-4AD6-BA94-379DCA6A24E0/HigherEducationStudentsStatutoryDutyOfCare

 

 

Prevent certainly applies, and then the are the general content filters you should expect a workplace to provide to minimise the risk of exposure to offensive and harmful materials (from a HR/Liability perspective).

 

So the question might not be quite so off kilter, and KCSIE isn't the worst starting place for thinking about what steps an institution hosting people who months ago were legally children should be considering.

[mavhc]

Also remind them they can be kicked off the course if they can't be trusted

[pdparry]

Thanks all. It's gone up to our Executive Leadership Team now, via Safeguarding. Lord knows what will come out of the other end!

[PotNoodleTech]

Regardless of the politics side of it it sounds like the only way to get this working exactly as you (they) want would be to host the virtual server instances in house so that they will inherit all of your filtering and monitoring. That, or somehow apply the exact same filtering monitoring to the external virtual servers? Would probably be easier to host in house?

[mavhc]

Getting any coding stuff working with proxies is a nightmare though

[msi_school]

Coders that have never had to work with proxies and non admin accounts produce code with is a pain to deploy.

[mavhc]

Coders that have never had to work with proxies and non admin accounts produce code with is a pain to deploy.

 

Getting your app to use proxies is a different problem to getting your development environment to use proxies, that's someone else's app. If you're trying to make an easy to use system for students to write code, having to go on a side quest to make it work with proxies is a waste of time. I just end up removing https inspection from github, python package index, node.js packages, debian packages.

 

Let's see, first you have to import the CA cert, into a different place for each program, then if you also need to send credentials, where and how are you storing those?

[msi_school]

Getting your app to use proxies is a different problem to getting your development environment to use proxies, that's someone else's app. If you're trying to make an easy to use system for students to write code, having to go on a side quest to make it work with proxies is a waste of time. I just end up removing https inspection from github, python package index, node.js packages, debian packages.

 

Let's see, first you have to import the CA cert, into a different place for each program, then if you also need to send credentials, where and how are you storing those?

 

I believe this is proving my point. If coders had to actually work with in the limitations that the users do they would think more about how to make it easy to set up.

[psydii]

Coders that have never had to work with proxies and non admin accounts produce code with is a pain to deploy.

 

And when coders had to work within those limitations, we got per-user vpns and applications that 'install' into AppData.... and also why everything is now web based and the power of the personal computer and applications are diminished, replaced with the anchor of subscription based pricing on a per department/user level.

[mavhc]

I believe this is proving my point. If coders had to actually work within the limitations that the users do they would think more about how to make it easy to set up.

 

The coders of the software users use, or programmers use?

 

Often they're on another OS or cross platform, so although the admin of the Windows machine might have installed a CA that's often not referenced by the remote server they're using. If as the admin of the network you want to setup pip and node and apt etc to all use the right CAs, and have the users authenticate with the domain and pass through the credentials (or have your chrome extension magically now work from the command line), fair enough, but in practise it'll fail, there's no cross platform standards that work, and that's before you start pinning certificates. Proxies are pretty dead, as evidenced by the on device filtering now needing to be installed by smoothwall etc

[pdparry]

While we're waiting for the gods to decide (no rush, it's not like the second semester isn't starting early next year...) I had a chat with our senior network admin, and he's finally coming round to the idea of giving our Computing department our own Azure tenancy. The £4K we spend on the hosted VPSs might be better spent there?

[nicholab]

While we're waiting for the gods to decide (no rush, it's not like the second semester isn't starting early next year...) I had a chat with our senior network admin, and he's finally coming round to the idea of giving our Computing department our own Azure tenancy. The £4K we spend on the hosted VPSs might be better spent there?

 

Does your ISP support Azure express route. A company I used to work for used this to have a single firewall egress point for cloud and office network traffic. You could also do this with a VPN or a filtering software on the AVD boxes.