Allowing Student's Personal Devices (BYOD) - for/against

[sonofsanta]

The inevitable has happened, and an SM has said that a student was using an iPad in a lesson and mentioned that it was very limiting without an internet connection. Said SM then came to ask if it could be added to the network and lo and behold, the worms were crawling out of the can and getting all over the office and everything.

 

I suspect this is an unstoppable trend anyway, and something that we will end up supporting at some point in the next three years, although I'd rather wait at least one more year simply because we're so busy this year with setting up 2k8R2 and testing Win7 and I don't have time to get into VLANning and what have you. I said I'd draw up a list of benefits and disadvantages for SMT to discuss at tonight's meeting, though, and this is what I've got so far. Can anyone add anything else? (in either column - I'm not deliberately trying to make it look bad, it's just genuinely come out this unbalanced!)

 

Background: at present, students are not allowed personal devices in school for accessing the internet. However there is an increasing trend towards possession of portable computing devices such as iPads, laptops etc. and many students now include such devices as part of their normal workflow, particularly in specialist subjects such as art or music that might have specific tools available on these platforms. These devices, if brought in, are currently limited by not being connected to the internet.

 

Proposal: such devices could, after suitable preparations, be allowed access to the internet. The connection available would be filtered in line with current KS5 levels, and the option would only be available to sixth formers.

 

Benefits:

• Greater availability of IT at low cost to us

• Greater flexibility for students who want to use personal resources

• May better engage students

 

Disadvantages:

• Would require the instigation of a technical project that would certainly involve a significant investment of time, and potentially budget.

• Work would be saved in a single location rather than on the network; therefore if students forget their device their work will be completely unavailable and there will be no regular backup of their work. Despite warnings of these limitations students are likely to favour working on personal devices still.

• Danger of loss of expensive personal equipment (particularly on public transport to and from school)

• Possibly lead to poorer students feeling excluded

• May offer a greater distraction to students, as personal devices are likely to have personal data (e.g. photos) and possibly games available.

• Should personal devices be allowed, IT Support will be unable to support them to prevent abuse of our services and prevent strain on our time supporting a large number of myriad devices.

• If popular, would likely require investment in improving our wireless coverage, ideally with a managed (intelligent) system (5 figure cost).

• Security risk from viruses – steps can be taken to mitigate this but there will always be a risk from zero-day exploits that haven’t been seen before

 

As I say, I will do this eventually anyway (if only ever for KS5), but it's interesting how many downsides there seem to be against the possible upsides so far!

[featured_spectre]

I am against it unless the students and parents sign an AUP saying that there is absolutely no chance if you repairing any damage to the machines or fixing any faults that develop, and not installing any software etc, and they get KS3 level filtered internet. Might make them think twice!!

[RabbieBurns]

we already had a full wireless in place, so we allow them on. 1 device per person, ipad or laptop only, we dont allow non-productive devices like phones or ipods or whatever. It all goes through our filter and they use ntlm to login so it identifies them.

 

They know that we dont support the device, we have over 1000 laptops that we provide that they could be using, so if they lose their work or save it in a format incompatible with the school systems for printing etc, thats their problem not ours.

[plexer]

Any student or other personal device connection to your network should be seggreated from the main school network to avoid impacting on the business use of said network, thus the students could access their home folders if you had a vpn type system in operation alternatively they would either be employing local storage of content on the device itself or they would be making use of a cloud based storage service, ideally one that is also accessible from school computers in case of personal device being left at home.

 

Ben

[RabbieBurns]

just to add to my post all students have a Skydrive as part of their live@edu, and they can also access their network share through moodle. And the student wireless is seperated and locked down to port 80 only

[sonofsanta]

If we went for it properly, I'd VLAN off a segment specifically for use with guest devices, with the Smoothwall set to transparent filtering. KS5 web access should be fine given that only KS5 and above will have access, and we'll never tell anyone the password, we'll add devices ourselves to stop other bits and pieces finding their way on.

 

And there would be no way in the seven hells I'd support equipment, otherwise people would bring a laptop in on Tuesday jsut so they could bring it back on Thursday and get us to fix it for free. There are computer shops in town for that; your device, your responsibility. With the number of KS5 students we would easily be facing a 50% increase in number of devices to support.

 

 

My biggest concern is that they will be saving locally instead of to the network (no matter how much cloud storage you offer them etc.) - so there will be no backups and they will forever be leaving work at home. It'll be the worst of educational ICT again.

 

Any of you who've implemented this already found any other positives or negatives on top of what I had listed above? I'd like it to be as complete a feasibility study as possible.

[NikChillin]

We have a separate VLan wireless system in place. They are filteres through the primary county filtering so no problem there. If they want to save their work on their device it is their responsibility to back it up. We offer NO support for their devices although we might assist with connectivity problems. As for accessing other undesireable internet content, if they have 3g devices or dongles they can access whatever they like anyway. We don't get involved in that as it isn't accessed through our connection. We don't have many problems and it seems to work well.

[glennda]

The problem with not telling them the password is Win 7 now allows you to view a key. Therefore removing the point in it being secret as they can just share with each other. I tend to look through logs and block ipods etc via mac address.

 

We have all our sixth formers on the wireless if they want it - don't have any problems with it and i've put on the school website a page which downloads a .rdp connection file so students can work on a terminal server inside school from there personal device.

[NikChillin]

The problem with not telling them the password is Win 7 now allows you to view a key. Therefore removing the point in it being secret as they can just share with each other. I tend to look through logs and block ipods etc via mac address.

 

We have all our sixth formers on the wireless if they want it - don't have any problems with it and i've put on the school website a page which downloads a .rdp connection file so students can work on a terminal server inside school from there personal device.

Aren't the licences for those connections expensive?

[FN-GM]

I think its a good idea. Setup a separate vLan with an open WIFI. Once you open your browser you are presented with a login screen. They enter the network credentials and your away. The connection will be monitored and you can even set different filtering levels based on the credentials used.

 

What we do at my place (a bank not a school) is we have an open WIFI and as soon as you connect and open your browser you taken to the Citrix login screen then you can use the Citrix apps and then get a full screen desktop into the terminal servers.

[theriver]

I'd have thought bets were off re: Internet filtering?

 

Various phones these days operate as wireless hotspots, so if you've got one of these you can hook your tablet or laptop up to the Internet wherever you are.

 

SMT should not sign up to this on the assumption that all Internet access within the site will be through the filter.

[sonofsanta]

I'd have thought bets were off re: Internet filtering?

 

Various phones these days operate as wireless hotspots, so if you've got one of these you can hook your tablet or laptop up to the Internet wherever you are.

 

SMT should not sign up to this on the assumption that all Internet access within the site will be through the filter.

 

Mercifully the thick walls in this old building combined with our rural loveliness means 3G signal is awful, so no-one has really tried this yet. However I would have thought that offering an easy to use, free and fast connection that is filtered would dissuade most students from faffing about with expensive and dodgy 3G connections. Some might still try and go down that route but that will happen regardless of what wireless service we do or don't offer.

 

 

Just to clarify for the sake of the thread as well: theoretically I am all for the idea and don't need convincing, I would just prefer to wait a year for reasons of current workload. I was just wondering what the other positives/negatives were that people had come across or could think up for me to present to SMT later.

[glennda]

Aren't the licences for those connections expensive?

 

Per user Cal's are needed

[sonofsanta]

The problem with not telling them the password is Win 7 now allows you to view a key. Therefore removing the point in it being secret as they can just share with each other. I tend to look through logs and block ipods etc via mac address.

 

Just confirmed that on a Win7 netbook here - that is completely stupid. Why would you allow that? Who ever thought that was a good idea? Now we're going to have to faff about with MAC white/blacklisting and that is a gigantic PITA, not to mention a bottleneck on the wireless.

 

Bloody Microsoft.

[glennda]

could you not use radius?

[sonofsanta]

could you not use radius?

 

Could do I suppose... and what starts out as a simple problem becomes ever more complex to set up gotta love jumping down the rabbit hole on all these issues.

[maark]

fairly cheap way:

setup vlans - isolate guest wireless from rest of network

use smoothwall as a transparent proxy for guest wireless - license is not much and you can use old low spec kit

run dhcp on one server for the guest scope allowing any device to connect

run dhcp for rest of network on a different server but use whitelist of mac addresses - this can be done through microsoft DHCP server - see other threads - this only allows approved devices to get an address on your main network

[round2it]

PAT Tested?

[sonofsanta]

PAT Tested?

 

It's my understanding, having previously queried this regarding staff laptops, that equipment does not need PAT testing so long as it is only used by the owner.

[round2it]

i would ask the question again to make sure i have seen the state of some of our kids equipment (chargers etc) fire hazzard is not the word

[glennda]

Pat testing is NOT a legal requirement.

[RabbieBurns]

Just confirmed that on a Win7 netbook here - that is completely stupid. Why would you allow that? Who ever thought that was a good idea? Now we're going to have to faff about with MAC white/blacklisting and that is a gigantic PITA, not to mention a bottleneck on the wireless.

 

Bloody Microsoft.

 

you could do this in XP too. Not as easily. But possible.

[garethEds]

@sonofsanta - Thanks for asking the questions. I'd been considering the same thing as it's in the plans I have been putting together for the next year.

 

Our LEA provide a third domain called GuestNet - this allows pupils the opportunity to use their personal learning devices when the need arises. I'd not thought of an AUP until I read your post - but have now asked the LEA if they have one.

 

Our LEA are linked to Aruba Networking and it is their kit we will be using. A central controller is connected to satellite controllers in the schools. All seems to work from what I've discussed with other schools in Swansea.

 

Gareth

[bossman]

@sonofsanta:

 

Certain managed wireless systems allow channels to be layered so that one channel can be used as a dirty network with a centralised mac filtering system which can be used in conjuction with transparent authentication on Smoothwall box for web filtering.

 

RDP protocol can be used to access TS for curriculum files and resources without touching the school curriculum network with virus etc.

 

This is the way we are looking which will also allow for other wireless devices to use the clean channels for curriculum use with IPads. IPods, android tablets, smartphones etc etc.

 

All this after a risk analysis is looked at for every device.

 

Although we already have certain parts of the school open to wireless APs under mac filtering and encrypted key access it will be a new managed system from one of the top suppliers after much deliberation and trials.

[CyberNerd]

I posted a couple of things about user owned devices here if you search my posts. We have about 140 on site at any one time. Many are phones which a couple of people from SLT now are keen to get rid of.!?

I'll try and go over some of your points

 

Disadvantages:

• Would require the instigation of a technical project that would certainly involve a significant investment of time, and potentially budget.

 

 

Thats a given, there's always going to be time and money needed for 'progress'. All you need to do is outline the infrastructure costs to SLT (wireless, running remote apps and bandwidth)

 

• Work would be saved in a single location rather than on the network; therefore if students forget their device their work will be completely unavailable and there will be no regular backup of their work. Despite warnings of these limitations students are likely to favour working on personal devices still.

 

Provide the method of working via the network, again SLT need to know the options and costs of making this possible. thinking along the lines of google apps (next to nothing), citrix (expensive)

 

• Danger of loss of expensive personal equipment (particularly on public transport to and from school)

 

Don't dwell on it, an AUP will have this covered

 

• Possibly lead to poorer students feeling excluded

 

This is probably the biggest hurdle. We've recycled a load of old staff laptops with linux for this purpose. We'll never have enough though.

 

• May offer a greater distraction to students, as personal devices are likely to have personal data (e.g. photos) and possibly games available.

 

Again, don't dwell on it. If teachers don't want personal devices in their lessons then they'll tell the kids not to use them. Teachers can see if kids are working on ipads if they're sharing their documents.

 

• Should personal devices be allowed, IT Support will be unable to support them to prevent abuse of our services and prevent strain on our time supporting a large number of myriad devices.

 

only if you have a dinosaur network. Ultimately your going to be supporting a large number of browsers in my experience it isn't really a big deal. If the kids want their devices connected they will work out how to do it and share it with their friends, ICT learning in progress

 

• If popular, would likely require investment in improving our wireless coverage, ideally with a managed (intelligent) system (5 figure cost).

 

don't launch it unless you can support it. write the proposal and get SLT acceptance. Don't forget you'll need more bandwidth on you internet connection.

 

• Security risk from viruses – steps can be taken to mitigate this but there will always be a risk from zero-day exploits that haven’t been seen before

 

firewall the internal network. http(s) access only.

Edited November 7, 2011 by CyberNerd
addition