snagrat

Or part of the /20 IP block is sold to another company/country. Phone continues to work, you have no idea what is now being used on the other range. Then your option c) kicks in. Most ransomware will extract data over a course of days/weeks before becoming known. Not just a few files in a zip uploaded to gmail

The data from any computer or server. It may not be a phone if the client IP changes through DHCP? VLAN is an option but not right away, or fix IP the phones so we could at least modify the rule to only include them. As it is a /20, it is unlikely that the phone system needs the whole range. Possibly using only a /32 which would leave the possibility for the remaining IPs to move to a different solution at any point without us knowing. Its all highly unlikely, I appreciate that, but alarm bells will ring when the provider is unable to confirm what specific ports are required.

Or..... IP range is sold in future. Ransomware/Virus uses non-standard port to steal data. Unlikely, but I have been involved in a situation where ransomware did upload over non-standard ports.

Correct.

Well the /20 range is based on Switzerland which is another red flag for this.

I wouldn’t worry too much if it was a smaller subnet, but again why do I need to open for 4000 IP addresses? Some risk is acceptable, but I feel their requirements could be easily reduced if they knew the setup better

I'm not aware of the system, it's their own system apparently? I'm aware the media ports can be a large range which I would be happy with, but surely they should know what these are. Plus, the media range is normally on a range not used by any other service.

I hear about firmware upgrades not being so good but only on WiFi. Are the switches more solid with upgrades?

I am supporting a company and I have been asked by a third party telephone provider to open up all TCP/UDP ports to a /20 IP range. I have pushed back to ask for confirmation of the exact ports that need to be opened but they are still pushing for all. They have suggested only doing it for the phones rather than the whole internal network. However, I am still not happy. Am I right that the specific ports numbers should be provided? A /20 also seems large for a phone system to work. What is the risk with having outbound ports open (not inbound) in this situation

I’m sure someone may beat me to it but I can show my claims later when back in front of computer

We are but not direct with Netsweeper. We have it via Schools Broadband. We just use the AzureAD agent so the sync happens to the Azure group and not AD groups

It’ll be the calling policy that disables this. Not sure Calendar or OneDrive can be removed though. Policies are not instant, can take several hours to kick in

Did you figure this out? We actually have it working but just introduced a new set of Chromebooks and the username is now not passed to the Azure login

It downloads the OS image on each device?

Just contact Papercut support?

I’m in the Team and is genuine. I was in it for the Parent App for Teams beta so maybe that is why you have been invited?

No, those licenses do not include Intune device management

SC-900 for me please

Devon is going to go to Bromcom from what I hear. The council team will only support the Bromcom finance package, so although the choice is the schools to go to either Bromcom, Arbor or another, ultimately everyone is going Bromcom. Bit disappointed in that, as many of the schools I have spoke to actually wanted to go to Arbor

What is the experience like wit these multi-tenants? Is it as seamless as being in the same tenant?

This will https://www.salamandersoft.co.uk/free-utilities/salamander-for-school-data-sync/ and is free

They do use a funny TCP port. That was my only concern for when the device goes to a different network outside my control

We are looking at this also. Great for the patch management side. Not sure if the pricing is likely to mean we can move ahead though…

Some Cyber insurance quote ask for it, although not sure if it affects the premium at all!

Yep check schedule tasks on the machine it runs from. Then just kick the task off manually whenever you want to force it.