Software

Ask something
Discussion Locked

How tight should security be ? Network, workstations ?

0 helpful
29 replies

by pj8089 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have worked in the IT field for a very long time.... and was recently asked to teach again in a local school's adult education forum.
Never in my life have I been so frustrated working in a networked class room computer lab.
I could not run programs from a cd based disk, I could not install any program, could not make student folders.. not even on the instructors pc. Many accepted sub programs were not installed or availiable (Adobe Reader, Adobe Flash Player, Quicktime, etc.)
When is security too much ? When should you have to deal with network admin approval for accepted software ?
All the pc's allowed an internet connection (Thank God).
I was even asked to teach an Ebay Basics and Advanced class. Ebay Turbo Lister was not accepted to be installed for the class.
When is security too much ?

29 replies

by cg it

I'd make sure USB ports were disabled, there are no floppy drives, no CDs, and that every user was a quest, there is passwords for BIOS and System setup, that there are locks on the cases.....

you have no idea the damage people [kids and adults] do. Dunno what it is, maybe they take their frustrations and anger out on computers, maybe bad wiring in the head, who knows, but if they can screw it up, they will.

When is security not enough should be the question? It's not enough when it costs $$ and 2 weeks of time to get back up and running because someone got in and screwed up the network through a workstation.

by deadly ernest

people to do their work.

I was both a student and a part-time teacher in one of our tech colleges, here in Australia. The system used NT servers and workstations (late 1990s). the systems were set up so that you could do anything you liked - except delete things from C drive. Everytime the system was rebooted, it checked the registry etc against the master on the server and reset the system to the default installation. The sys admins recognised that teachers and students needed to be able to work on and change the systems - so they set it up to allow that, and still protect the network.

Thus, teachers could install software, have students install software, and a reboot put it all back the way it was.

Many labs had machines with removable drive caddies, and the students brought their own drive - these were for specific classes on building systems, security, networking, and the like.

Each student had their own directory on the server, for storing files etc. Each subject had its place on the server, where the teachers could upload class notes and other downloads for the students.

It sounds like your sys admin is lazy bugger and can't be bothered doing the extra work to allow this type of operation.

by jdclyde

In every campus situation I have been in, it is the job of the instructor to notify the admin of any special needs they will have, and then to do the follow up walk-through on a system to make sure it has what will be needed.

It is unreasonable to just expect everything to just be there when you walk in if you have not taken these steps.

And the best classes I have taken for servers or networking did have the removable drives. You got a drive that had an image on it already, but were free to do as you wished to it in a real world environment. If you pooched it, they would drop a new image for you. At the end of class, all drives are wiped and loaded for the next class.

In generic class rooms I have seen the setups Ernest was discussing where they reset at reboot. This allows limited freedom.

But anyone that thinks a system in this situation should be completely open clearly has never had to work in this type of situation before.

by marchred

Couldn't agree more - it's up to the instructors to be prepared in adviance and notify the sysadmin of their requirements. Security of its nature is "pessimistic" - you can always relax the controls when experience determines they are too tight, but it's a nightmare to increase controls because there have been too many issues.

Like other correspondents I have been both student and instructor. As an instructor the first thing I do (before class) is consult with the sysadmin to make sure that whatever activities we are going to undertake will work ... the scout's motto "Be Prepared!"

by sd itman

Sure that would work to get the individual workstations back to normal but what of the damage done to the network?

by deadly ernest

The general servers are locked down and untouchable, as are the switches and routers. The labs where major work can be done are all siolated with a router, anything inside the lab stays in the lab. No damage to the wires, etc.

by knot_mine

Congress passed laws that create huge criminal and civil penalties for installing software that is not properly licensed. Publishers and their hired guns are extremely agressive inforcing those laws.
System administrators are simply responding to this legal environment by locking down PCs. There is no other way to ensure that instructors or anybody else walking up to a random PC, is installing software that is legally licensed for that box.
You can rant and whail as much as you like, but smart companies are not going to open themselves up to that kind of legal exposure.

by deadly ernest

of the licence situation in the lab environments that I mentioned. Teaching computer courses requires that the teacher and student be able to do things with the computers. That's needed for most courses, or the course objectives can't be met. So they need access to the systems, but having it reset to the default image on reboot resolves all those concerns, just turn the machines off.

If licenced softwrae is needed, then the teacher has to arrange for it to be on hand, but what the OP mentioned was mostly free software or trial softwrae and the licence was not an issue.

by wayoutinva

I was a student at a technical college until Feb of this year when I graduated. They were running a program called deepfreeze that once enabled would basically lock the system settings to what they were at the time the program was turned on..you could install anything you wanted for that session, it didnt matter, once the system was rebooted that program was no longer there..same thing with system settings..you could literally destroy the registery and a simple reboot would fix it..it was a simple matter for them to unlock the program install what was needed and turn it back on...problem fixed..I have also seen public school divisons do the same thing so they dont have to be so tight on the security to the point that frustration sets in trying to do basically anything..its something to look at anyway

by joseph.r.piazza

The writer was taeching an aduilt education class. Therefore he has no idea of school's IT policies or who the Sys Adminstrator is. Yes he should be able to just go in and teach.

The reboot configuration as identified by the man in Australia is perfect.
or
Allow the instructor to have System Adminstrator rights on all PCs and he can install anything he wants. Make it policy that he must uninstall everything at end of the Day.

by jdclyde

I can safely tell you that you are sadly missinformed.

ANY instructor is responsible to make sure they have what they will need for their classes. This means outlines, books, and any other resources.

Computer access is just another resource, and they DO specifically tell you to walk through your class the WEEK before teaching to make sure everything is working. Many can not be BOTHERED to take this step, and you get what we have here. Someone crying because THEY did not prepare for their job.

Even most campuses that DO reset at roboot, still limit greatly what you can and can't do with the system.

The poster is out of line. Maybe it was the fault of whoever he reports to, for not telling him that he is responsible to make sure he has what he needs. Wonder if they forgot to tell him to bring his lunch too?

by cg it

JDClyde's replies are what I've seen most school policies are concerning computer classess and Adult Ed computer classes, not to mention in the private, pay for classes.

you get your MCT JD?

by jhogue1

My previous post was critical of IT folks. But lets think about teachers.

For an instructor to walk into a computer lab to teach without first (well in advance) checking the lab for software / permissions and policies is just flat lazy sloppy teaching.

Students deserve a lab and instructor who are ready to teach.

If teaching lab is not "close to home" the telephone still works to check things out.

I regurlarly teach in 3 different computer labs and occassionally in 3 others. Every semester I make the rounds and check machine in each lab.

I also send IT a reminder a month before each semester of what I need in each lab. If a major software change is needed, I try to give them as much extra lead time as possible.

by pj8089

I have taught for 35 years ! I have worked in the IT field over 40 ! So I know how to be prepared and I know how to setup a network, and more importantly I know how to keep one running... I do NOT have to block access to human beings ! No matter what they do ! We have to control the internet, but take away the useage of a computer, might as well go back to using terminals !

by doug m.

I work for a public high school district, and you have some people that respect the equipment and those who try to ruin it. Some of these kids are junior hackers in training it would seem. Some try to physically break the equipment, others try to steal what they can. We've had memory missing, speakers, etc. We've moved to thin-clients for the most part now and we can lock down alot of things that way. Not saying that is the best solution, but it works for us. We lock down a little at a time and see how far we can go without locking down too much.

by jfp

These kids are smart and a lot of them are hackers. The Basic rule for student user machines is lock them down so they can only do what you want them to do and no more. The Ideal from a network admin stand point would be thin clients, but unfortunatly no money to do it.

If you are teaching a night class, they need to provide you a mechnasim for having the tools you need installed and made available. Most schools use SMS, Zenworks or some other desktop management tool so that installs are pushed out by IT.

by xt john

We service 52 libraries in a four county area. All of them have differing views of what they'll allow the public to do. We have to tailor the various software to accomaodate their wishes. Who will allow Flash drives, which site wants the public to have access to a shared folder on the network, etc. Over the last two years, we have developed more of a 'clean up after they trash it' mentality over a 'try to lock them out' policy. Software such as Deep Freeze, Clean Slate and Microsofts Shared Accesswill allow the Computer to go back to a pre-determined state, wiping out any of the hacking, downloading, trashing the public can dish out. ANd beleive me, they'll do it. Either by ignorance, or maliciously. Not everyone, of course... but there are those few...

by longwayoff

XT John hit it right on - I work in a public library with Internet access for patrons. All our computers do have Adobe Reader/Flash & Quicktime on them, but we do NOT allow ANY access to the C: drive, nor can you run an executable of any description that isn't part of our set-up. No exe's from USB/CD/floppy drives, for instance. We have Deep Freeze on all our public computers (& thank heaven for it daily) to restore system state. We have not had any major unrestorable problems since we installed Deep Freeze, but before that, all the lockdowns in the world couldn't keep hackers & hacker wannabes out of the hard drives, not to mention knotheads who deleted system files because they had no clue (even hidden ones! - go figure). We do permit saving to USB/CD/floppy drives, but not the hard drive. General public access computers are a different challenge from those a corporate network type faces.

by dksr42

If you want the permisions you need to ask the Net Admin to add you in the domain with the permissions. If they do not have the security level high at schools, kids would be online playing games and looking at porn or other filth instead of learning. It happened at a high school my son attended some kids where able to get through to a porn website, they got suspended for it, that is the resean for the security, and also the cost for the damanges to computers they can cause cost tax payers, and also the predetors that are out there trying to lure our kids.

by jhogue1

I agree that it is the instructors job well before a class to make sure that the software needed is installed on the computers.

I totally disagree that I should have to change my student learning outcomes to meet the requirements of a sys admin or IT dept.

It is not the instructors job to make things easy for IT or to decrease student learning just becuase something needed for instruction is "too much trouble" or "too much risk" for the IT dept.

It is the job of IT do enhance learning and make things possible in teaching labs. If it weren't for students and instructors there would be no need for university sys admins.

It is a whole lot more work for IT depts to have teaching labs that are effective for teaching and learning BUT teaching students effectively is the purpose of the institution.

by jdclyde

to clearly inform the IT department exactly what their needs are in advance of the class.

It is also clearly the responsibility to TEST that what the IT department has done is adequate to handle the class that is going to be taught. The computers should handle what the instructor needs, provided what the instructor needs is in line with campus policy.

by jhogue1

This is a good strategy.

We have one lab that is completely isolated for networking and operating systems classes that is completely unlocked. It the class messes it up they get to fix it.

The other labs are completely locked down as far as networking goes.

by jhogue1

The problem with giving the ability to install Acrobat Reader is that it also confers the ability to install the full version of Acrobat.

As far as the original post goes -- both people were doing a bad job.

Any teaching computer lab should have acrobat reader, flash player and quick time installed. The sys admin did a poor job of setting up the lab. The instructor should also have check the lab early enough to get things installed that were missing.

by rhutcheon

I'm a network admin myself and I dont allow anyone to install any program without running it past me first.
You wouldnt let a stranger walk into your home and install a program that could potentially damage your computer would you?
The admin where your are should have set up a user account that will allow you to install your applications, and also set you up so that you could only log into those particular computer to do this! Its not that hard if they have their head screwed on right is it?
As for the programs that were'nt on the computer? Havent they heard of a standard operating environment? When I build a computer for my company there is 20 standard programs that go on, and numerous others depending on the department.

I would say though that it is hard for some of us to accept not having full access on a computer or network.. But when your in someone else's ocean you cant always make waves.

by jcdshs

Yeah, i work in a school too.
We have different user profiles depending on whether you are a student, teacher, etc.
This gives people different levels of access to the servers and the workstations.
Could this be a way to solve the dilemna for the adult ed classes?

by jdclyde

you need to update your thinking.

If you don't understand WHY the systems are locked down, then you just have not been paying attention to the reality out there.

Also, you may not have noticed, but other classes will need to be taught on those systems, and if the students can make major changes, the next class will not be able to be taught. It is pretty simple, really.

Next time, TALK to your boss and the admin. You would be amazed how helpful people are when you are reasonable with them. I would recommend aquainting yourself with the campus policies for computer usage before having that talk though.

Oh yeah, if you went off about how the admin screwed your class up, you now have an uphill battle the next time you will want or need anything from him.

by sillywizard

Every environment is different.

I work for a public school system that also has an adult education school at night. They utilize one of our labs and sometimes run into issues with our security policies. Almost every single time there is a problem, the instructor waits until the night of the class to find out about it. Only once or twice were we (the IT Dept) notified of these classes. We always meet with the instructors (assuming we are notified) and go over everything they need and loosen up security when possible to accomodate them. From creating local user accounts with less local restrictions, to creating policies specifically for their use, we do what is best for our network while also allowing them access to resources necessary to teach their course. Anything less is irresponsible.

I agree with some of the poster here that it is definately the responsibility of the instructor to make the time to coordinate with the IT dept. It is not your network. If something happens to the network because of an incident during your class, who will the administration blame for it? They will not come to the instructor, they will come to us, the IT dept and ask why we allowed it to happen. It is easy to complain about this while having to accept zero responsibilty for the network.

This obviously a communication issue between instuctor and IT (which we have improved on in our school by being more proactive)and less a problem of being overly secure.

This discussion is closed to new replies.