steve_forbes

Hi everyone, Does anyone here work in a school within one of these areas? Or does anyone know if there is a large IT provider/Local Authority service in these areas that cover a lot of schools? Thanks Steve

Apologies I've just seen the updates on this post - if I can be of any help (as a Nominet employee) then please do let me know and I'll be happy to try and sort it - although sounds more like a Microsoft issue from the mail perspective?

Thank you - that's useful as I think that constitutes a pretty big security risk!

Hi all, I'm doing some more research for the National Cyber Security Centre on secure cloud configurations with a focus on Google Workspace for Education and Office 365. I'm hoping the collective mind within Edugeek can help validate my statements below: The majority of schools now have one or both of these services but they may have been configured some time ago and not necessarily by an expert, therefore they may be insecure There are still cases where brand new cloud tenancies are created for migrations etc Even if setting up a new tenant today, the default configurations are not sufficient to ensure the school's data is secure Does anyone have any thoughts on the above statements, any additional information would be very useful. If there is a proven need then I am hoping to get some NCSC and Microsoft/Google approved configuration guidelines that include options for additional security if licences have been purchased. If there are areas that could be improved by changing default settings then we can also lobby the cloud provider to do so. Thanks Steve

Hi, let me ask my colleagues here at Nominet and find out if there were any restrictions.

Hi, Steve Forbes (RM) here, self-service firewall is currently in development for RM Broadband customers so you won't need to request changes - you will be able to make changes yourself using the same portal as RM SafetyNet. As you are an existing RM Broadband and RM Unify customer it might be worth just trying it out to see if it meets your needs - it won't cost you anything extra and could save a fair bit of money on replacing hardware. I won't get into the whole cloud vs local thing, ultimately it needs to be what is best for your school. Thanks Steve

Hi there, I'm the Product Manager for RM SafetyNet (and RM Buzz). Thanks for your feedback, I'm going to investigate and will come back to you on the issues you raise here. If you have any specific support call numbers that might help then please let me know. Also really interested in my other feedback you have in general about either products.

Yup, they've openly said that both G Suite and Apple have the same issues. Therefore leaving schools with little choice on OS or cloud suites!

Hi, Steve Forbes here and I'm the Product Manager for SafetyNet. Apologies I'm late to the thread. As @Boredguy said, if you log a support call they can arrange for you to get the AD sync agent and enable User Based Filtering as long as your contract includes it. Transparent User Based filtering is now available to SWGfL customers and many others, again a support call can get this enabled for you - it will soon be self-enabled through the admin console. Lastly, we haven't just updated our support pages so if you login to the admin console and go to the support pages you will see all new articles to help you with the new features. There is also a home page where we are announcing new features etc. Hopefully that will mean no-one feels any new features are hidden from them again! Let me know if you have any questions or feedback.

RM SafetyNet is now available to anyone, regardless of who provides the line, just in case you weren't aware of that.

Hi, Here's the full list of proxys available on SWGfL: Default Proxy These proxy addresses provide filtering based on the schools default policy sslfilter.proxy.swgfl.org.uk:8080 - recommended standard proxy with ssl filtering proxy.swgfl.org.uk:8080 - standard proxy without ssl filtering proxy.[school domain name]:8080 - This is typically a CNAME which points to the standard proxy.swgfl.org.uk. These are no longer created but can continue to be used if SSL filtering is not required. User Based Proxy These proxy addresses provide customisable user based filtering based on active directory authentication sslfilter.userproxy.swgfl.org.uk:8080 - recommended user proxy with ssl filtering nosslfilter.userproxy.swgfl.org.uk:8080 - user proxy without ssl filtering Clearly you need to subscribe to User Based Filtering to be able to use this functionality. Coming soon: Over the next month we will be enabling new functionality to provide more flexible filtering for schools who cannot use user based filtering Custom Proxy Addresses These provide schools with the ability to provide differentiated filtering to different sets of devices using different proxy addresses sslfilter.policy1.proxy.swgfl.org.uk:8080 sslfilter.policy2.proxy.swgfl.org.uk:8080 sslfilter.policy3.proxy.swgfl.org.uk:8080 sslfilter.policy4.proxy.swgfl.org.uk:8080 "nosslfilter" versions of the above will also be available which use the same policy without ssl filtering IP Based Filtering Custom policies for specific IP addresses/ranges on your network, these will take precedence over the default policy when using the default proxy address. Legacy SWGfL Proxy Addresses These are historical proxy types whose functionality has been or is in the process of being replaced by the addresses listed above. These should no longer be required. Other proxies staffproxy.swgfl.org.uk is a legacy proxy type that allows unfiltered access for authenticated users. Users of this should consider using Safetynet User Based Filtering which allows AD authentication and custom policies to be configured for different users or user groups. updateproxy.swgfl.org.uk - Provides the same functionality as the standard proxy and will shortly be repointed to proxy.swgfl.org.uk smartcache.proxy.swgfl.org.uk / smoothwall.proxy.swgfl.org.uk - Upstream proxy for onsite filtering devices providing IWF and extremist filtering only. These will shortly be repointed to nosslfilter.policy4.proxy.swgfl.org.uk which will be preconfigured with a policy that mirrors this behaviour. unfiltered.proxy.swgfl.org.uk - IWF and extremist filtering only. This has to be enabled within the safetynet UI. This functionality will soon be removed. Users wishing to have access to proxy with a minimal filtering proxy will be able to use the new custom proxies to achieve this. A list of these proxies can also be found within the Safetynet administration interface. Hope that helps, Steve

Thanks Nick, I will follow up and see what we can do.

Hi, I'm the Product Manager for that product, have you raised a service call for the issue? Happy to get this looked at for you if I can get a few more details. Thanks Steve

Just to jump in here (Product Manager at RM). We are currently developing self service firewall as well so changes can be made by the school instantly.

Would love to hear your feedback on UBF, we are currently doing some work to make this easier to deploy so any additional feedback would really help. Thanks Steve (Product Manager)