NAACE Discussion

[GrumbleDook]

This discussion has started on the NAACE Advisory list and I have said to the OP that I will summarise our response.

 

Please feel free to add your tuppenceworth, but be as constructive as you can, with examples of good / bad practice.

 

Colleagues,

 

I need to make contact with people who can advise on best approaches to security of LA and school networks - this is becoming a big issue for a couple of things I am working on.

 

The sort of problems that are rearing their head are:

 

- the fact that LAs in the North East have specifically decided to prohibit inter-connect between the LAs in the region, so that a school from Newcastle demonstrating to schools in Middlesborough was unable to connect back into its school network in Newcastle.

 

- the fact that some content providers are finding that certain regions cannot use their products, because in the way the networks are configured certain functionality that the software needs to use online is prohibited.

 

- some schools that have locked their networks down so thoroughly that training materials used by one of the qualifications bodies, using readers that are in widespread use, would not run.

 

- some schools that are wanting to implement their own statements of requirement for learning platforms, being prohibited from integrating these with the NEN connections the LA provides.

 

 

All of these things are impacting on teaching and learning and I think it is time we painted the picture of how Regions, LAs and schools can all achieve what each needs most, while still being able to inter-work properly.

 

And it is security issues which are being used as the reason for the policies that are causing these problems.

 

If you can help please drop me a note off-list, or on-list if you have reflections to offer on these kinds of issues that others might appreciate seeing.

 

Regards

 

Roger Broadie,

Director,

Broadie Associates Ltd.

 

And let the discussion commence.

[Geoff]

I suspect there's a couple of issues here:

 

1) Blocked ports. Some ports (Windows networking for example) get blocked to stop the propagation of viruses between schools. I have had first hand experience of this with Sims + Slammer.

 

2) No direct Internet access. This is mainly done to enforce filtering and block P2P etc.

 

Now I think this defacto situation is acceptable when the school has no permanent on site technical support (Primary schools basically).

 

I also think these things should be the default setup when a school first comes on-line.

 

However I think it should be possible to 'opt out' of these restrictions provided that the school demonstrates they have competent network security arrangements.

[GrumbleDook]

So you think that the Standard Network Build should be means tested for each school? Perhaps different levels of the Standard Network Build?

 

How does that fit in with the BECTA ICT Infrastructure Framework? or RBC developments (particularily in the North East ... an NE members like to comment? PM if you think you need to remain anonymous!)

[Geoff]

So you think that the Standard Network Build should be means tested for each school? Perhaps different levels of the Standard Network Build?

 

I think that if the school chooses to opt out of some/all of the services offered by the LA/RBC they need to demonstrate that they can replace the services they have opted out of with equivelent or better systems.

 

Perhaps different levels of the Standard Network Build?

 

I have no problem with LA/RBC's labelling specific configurations up as 'packages' as long as there is the flexibiity there for the schools who want it. I just don't think the current one size fits all mentality works.

 

How does that fit in with the BECTA ICT Infrastructure Framework?

 

I think it can be shoe horned in. The Infrastructure framework outlines all the overarching key requirements for a schools connectivity. However some services (obvious example is Internet Filtering) that are labeled as a LEA/RBC level service could be opted out at a school level. I don't think the requirements should be watered down as a result though.

 

RBC developments

 

Lancs/CLEO has no interest in moving in this direction AFAIK. Despite schools repeatedly asking for a more open and flexible system. They've been badly burned by virus/email spam outbreaks in the past. So I don't blame them.

[CyberNerd]

- the fact that LAs in the North East have specifically decided to prohibit inter-connect between the LAs in the region, so that a school from Newcastle demonstrating to schools in Middlesborough was unable to connect back into its school network in Newcastle.

 

 

Janet Videoconference service intemediate services between schools and universities for videolinks. Ultimately local schools should have access to other schools VLE through shibboleth authentication. I see no reason why http couldn't be opened between schools via a web service?

 

the fact that some content providers are finding that certain regions cannot use their products, because in the way the networks are configured certain functionality that the software needs to use online is prohibited.

If content providers stick to open file formats they wouldn't have this problem as the content would be viewable using eg browers that will work regardless of operating system/network setup. Content providers should be aware of acceptable non-proprietry file formats as determined by Becta's technical specification

 

- some schools that have locked their networks down so thoroughly that training materials used by one of the qualifications bodies, using readers that are in widespread use, would not run.

sounds a bit overkill, but again are the qualification bodies releasing materials in formats that are acceptable according to Becta's tech spec (ODF). probably not.

[CyberNerd]

- some schools that are wanting to implement their own statements of requirement for learning platforms, being prohibited from integrating these with the NEN connections the LA provides.

 

Understandable, Moodle isn't on the list but I don't see why its not able to integrate into NEN - just let the LA open http.