SchoolProtect User Guide

Zoom Window Out
Larger Text | Smaller Text
Hide Page Header
Show Expanding Text
Printable Version
Save URL

Declarations

A number of declarations exist within the Support Website. My Account >> Declaration Management that can be approved to gain the ability to unblock certain websites or services. These declaration can only be approved the the head teacher/proxy head teacher at the school.

The declaration page includes four declarations that relate to SchoolProtect:

1.LGfL: Allow 'Category 2' Remote Access Tools, such as WebEx & Team Viewer

2.LGfL: Access to websites classified as 'High Risk'

3.HTTPS web traffic inspection

4.Enable myVideos service

Details on these declarations are below.

'Category 2' Remote Tools

This declaration refers to remote access and allowing the use of methods of remote access that are blocked by default. Please see the following excerpts from the LGfL Security Guidance Document

"LGfL has three categories for Remote Access services that connected schools use across the LGfL infrastructure. Category 1 tools are USO-authenticated, ensuring that remote access facilities can be routinely provisioned (and more importantly, automatically removed when a user leaves an establishment), due to being linked to LGfL USO. Services benefiting from this include RAv3 (Cisco SSL VPN services), CentraStage, LogMeIn Rescue Enterprise (LGfL USO Edition), and a Remote Desktop Gateway to support schools' 'Terminal Servers'. Category 2 tools are everything else (bar category 3 tools) as they are not USO-integrated and therefore their manually-created accounts represent a clear risk to the school, due to the need for additional manual intervention if a user leaves. Category 3 tools are services that are, from time to time, classified as introducing significant security concern and therefore will not be permitted."

"Products in this category set provide the ability to gain access to services located in school from the Internet. It should be noted that allowing such proxy avoidance services to run circumnavigates the filtering system in place across LGfL 2.0. LGfL and its agents are unable to offer support on the use or mis-use of products in this category set. These tools do not make use of LGfL USO, permissions are ‘on for all’ and any management of abuse will impact on all users of these services. This category of tools can be authorised for an establishment by the Head Teacher. To do this the Head Teacher should visit… https://support.lgfl.org.uk/secure/myacc/ht/declarations.aspx LGfL Security Guidance v1.4 3 of 8 7/6/2016 …to confirm agreement and understanding of the risks and issues relating to using this category set. Due to the increased risks involved with the use of tools in this category, the school will need OTP (One Time Password) second factor authentication tags for all Nominated Contacts and the Head Teacher. These tags can be purchased at: https://shop.atomwide.com/ProductDetail.aspx?id=135&cat=7 LGfL recognises that users and their support agents have existing tools and methods. LGfL does not wish to ban all remote access products, and will always attempt to allow users to employ tools with which they are familiar until such time as any tool is objectively assessed to be inappropriate for use on the LGfL 2.0 network. For this reason it is not possible to publish a comprehensive list of ‘allowed’ and ‘disallowed’ products; security requires more than a good product, it also requires good practice. Products will be deemed as acceptable by LGfL until otherwise known to be a threat to security."

What does the declaration, described above, say?

Many commonly used tools for webinars include functionality which can give a third party access to your computer. Additionally, this applies to remote assistance software, which introduces an increased level of risk to your network because a third party can remotely control your computers.

By enabling Category 2 Remote Access Tools, you are confirming that:

* you have read and understood the explanation above;

* you take full and sole responsibility for any issues arising from the use or deployment of any Remote Access Tools at your establishment; and

* you acknowledge that you have read and understood the security policy which applies to the LGfL network (accessible via the link above).

LGfL recommends that you consider restricting open access for a limited time period, or reviewing access to your network by third parties at regular intervals.

What happens when it's approved?

When a Head Teacher signs the declaration to release category 2 remote tools sites a case is generated on this support site to trigger two specific changes which are implemented by Wavenet Education staff.

The process for this happening is as follows:

As soon as the Head Teacher clicks “Approve” a support case is generated on the USO support site. This triggers two specific actions which are implemented by Wavenet Education engineers.

1. A new category becomes visible in the SchoolProtect list of categories – Remote Access Tools. This category will be blocked in all polices and cannot be allowed. Instead as SchoolProtect administrator will need to allow the individual sites you require within the filtering Policy.

2. A second change happens at the back-end only. A number of Category 2 sites are blocked through firewall settings which are designed to deny access to specific target IP addresses. These firewall restrictions are lifted following the signing of the declaration. As a result, certain gateway and redirection sites, which share the same IP address as a previously blocked Remote Access service, will become visible even without any changes being made to any policies within the school. This should not cause security concerns as the sites to which they redirect would still need to be explicitly allowed by the school in order to work.

'High Risk'

This declaration refers to accessing websites categorised as High Risk. 'High Risk' within SchoolProtect contains websites considered by LGfL to be sufficiently high risk to block permanently. For example access to Google translate has been blocked as it can act as a gateway to all types of inappropriate web content as searches take place under HTTPS encryption . This means that when using the sites, the SchoolProtect filtering system is bypassed and inappropriate or dangerous content may be accessed.

What does the declaration, described above, say?

The 'High Risk' option provides access to websites that can be exploited easily to give access to blocked sites, which may include offensive material, pornography, extremist material or other material that is contrary to our acceptable user policy. However, the use of such resources may have clear educational value, such as Google Translate.

The 'High Risk' option allows your Nominated Contacts / SchoolProtect Administrators to give students access to individual sites that are normally blocked.

By approving this option, you acknowledge and agree that:

* you have read and understood this explanation;

* you wish to allow access to certain site(s) within this category, either for limited and defined periods of use or indefinitely until further notice;

* on a day-to-day basis, your Nominated Contact(s) will be responsible for setting the access permissions for these site(s); and

* you take full and sole responsibility for any issues arising from your establishment's use of sites within the 'High Risk' category.

What happens when it's approved?

A school can choose to allow access to these sites but such a decision may only be taken by a Head teacher.

A Head teacher wishing to do this must go to My Account >> Declaration management page and approve the declaration titled: LGfL 2.0: Access to websites classified as 'High Risk.

When a Headteacher signs the declaration, the category, 'High Risk' becomes visible to SchoolProtect administrators within the SchoolProtect policies for the school.

Visibility of the category confirms the declaration has been successfully approved.

The category will be listed in the Blocked categories list for all policies and cannot be moved. Instead individual sites that are categorised as High Risk can be allowed within a Policy.

To find out if a website is categorised as High Risk you can run a test on the URL test page.

HTTPS Decryption

For information on this declaration, please see here

Enable myVideos Service

The myVideos service is currently available as a Beta product. If your school would like to have it enabled, try out the features and engage with Wavenet Education in providing feedback, please ask your school's Nominated Contact to raise a support case and request this.

The myVideos page within myUSO provides school staff with a method of searching for, and previewing videos from on-line video sharing and resource sites on the internet, and making them available for viewing by pupils (and/or staff) from within myUSO, or via an in-school only 'Local favorites' page. All sites identified via myUSO as suitable for use in schools will appear in the 'USO schools community' list' accessible from this page, so that individual school staff can consider these initial 'nominations' of videos being suitable for use in a school, and can then choose from this list whether to make one or more videos available in their school.

Pupils cannot have direct access from this page to search video resource sites themselves. The playing of any video from an external site may be affected by the underlying filtering Policy the school has in place, and any pre-applied settings the school has in place for the specific video sharing sites in use. If in doubt, please contact one of your school's USO Nominated Contacts in the first instance.

This service initially supports the use of YouTube, displaying videos via YouTube's video player. No feature is offered to rank, cache, or directly impact or comment on, video resources hosted on other provider's sites. No responsibility is accepted for the use of videos from such sites, nor does Wavenet Education have, nor claim, any jurisdiction or rights over such videos. Staff with appropriate in-school internet access can make use of the fully functional YouTube web site directly, here: https://www.youtube.com

Wavenet Education acknowledges and respects all video resource providers' rights, trademarks, Ts&Cs, and usage guidelines

Also See:

YouTube

Filtering for Non-Schools

Please enable JavaScript to view this site.

SchoolProtect User Guide

Also See: