Web Filtering For Education Cloud, On-premise Or Hybrid? - Smoothwall

Web Filtering for Education2.3 Hybrid deploymentWhile the debate of the pros and cons of an on-premiseenvironment pitted against a cloud computing environmentis inevitable, there is another model that can offer the best ofboth worlds.A hybrid solution features elements of both on-premise andcloud, leveraging the benefits of both.A hybrid deployment usually retains a less powerfulhardware appliance on-site and is combined with clientdeployment for a portion of student systems. Thesedeployments may start as heavily skewed towards theexisting on-premise solution where an organization ismigrating to a more balanced hybrid setup.On-premise systems are generally considered a capitalexpenditure whereas cloud-based systems are typicallyconsidered an operating expenditure. Managed devices off-site - There is a growing need forschools and districts to filter managed school-owneddevices off-site. If that applies to your school, and youwish to still retain your on-premise filtering model, ahybrid solution will allow you to add a cloud solution to alldevices that go off-site and may be an ideal option. Flexibility - A hybrid solution can provide your institutionwith the flexibility to match evolving needs. For example,you may wish to choose how to distribute depending onavailable resources. Or you may be a school planning toroll out programs such as a 1:1 initiative, which will involveadding more devices over time. Hybrid can be ideal formeeting flexible and changing requirements. Bring Your Own Device (BYOD) - Some schools anddistricts require the benefits of cloud but also want themost effective filtering for BYOD. Hybrid allows you toachieve both.How might a hybrid deployment work for filtering?A hybrid solution can be the best solution for some schoolsor districts that may be concerned about any ofthe following: Load distribution - As internet traffic increases, the needfor powerful filter hardware can arise. With bandwidthcosts decreasing, it can prove expensive to keep up. Cloudfiltering can alleviate the bottleneck at the gateway edgeand extend the capability of more modest hardware. Authentication - By introducing the cloud solution forsome devices, the need for additional authenticationmethods can be removed, particularly for newer devicessuch as Chromebooks, improving the accuracy of filteringand logging, and ultimately improving digital safetyoutcomes.09

Smoothwall for EducationWhitepaperWhile the debate of the pros and cons of anon-premise environment pitted against acloud computing environment is inevitable,there is another model that can offer thebest of both worlds - hybrid deployment.10

Web Filtering for Education3.0 CIPA requirements & guidelinesFor school districts that require government e-rate funding,it is a good idea to revisit the Children's Internet Protection(CIPA) requirements and guidelines to ensure you arecompliant.Internet Safety PolicyCIPA imposes certain requirements on schools that receivediscounts for Internet access or internal connectionsthrough the e-rate program – a program that makes certaincommunications services and products more affordable foreligible schools. Access by minors to inappropriate matter on the Internet; The safety and security of minors when using electronicmail, chat rooms and other forms of direct electroniccommunications; Unauthorized access, including so-called “hacking,” andother unlawful activities by minors online; Unauthorized disclosure, use, and dissemination ofpersonal information regarding minors; and Measures restricting minors' access to materials harmfulto them.Schools subject to CIPA may not receive the discounts offeredby the E-rate program unless they certify that they have anInternet safety policy that includes technology protectionmeasures. The protection measures must block or filterInternet access to pictures that are: Obscene Child pornography Harmful to minors (for computers that are accessed byminors)Schools subject to CIPA have two additional certificationrequirements: Their Internet safety policies must include monitoring theonline activities of minorsThey must provide for educating minors about appropriateonline behavior, including interacting with other individualson social networking websites and in chat rooms, andcyberbullying awareness and response.CIPA requirementsSchools subject to CIPA are required to adopt and implementan Internet safety policy addressing:Schools subject to CIPA may not receive the discounts offeredby the e-rate program unless they certify that they have anInternet safety policy that includes technology protectionmeasures. Schools must certify they are in compliance withCIPA before they can receive e-rate funding. CIPA does not apply to schools receiving discounts onlyfor telecommunications service only; An authorized person may disable the blocking or filteringmeasure during use by an adult to enable access for bonafide research or other lawful purposes. CIPA does not require the tracking of Internet use byminors or adults.11

Smoothwall for EducationTechnology Protection MeasurePublic Notice and Hearing or MeetingA technology protection measure is a specific technology thatblocks or filters internet access.The authority with responsibility for administration of theschool or library must provide reasonable public notice andhold at least one public hearing or meeting to address aproposed technology protection measure and Internet safetypolicy. For private schools, public notice means notice to theirappropriate constituent group.WhitepaperThe school must enforce the operation of the technologyprotection measure during the use of school-owned computerswith Internet access, although an administrator or otherauthorized person may disable the filtering measure during useby an adult to enable access for educational or other lawfulpurpose. For example, a school that uses web filtering softwarecan set up a process for disabling that software upon requestof an adult user through use of a sign-in page where an adultuser can affirm that he or she intends to use the computer foreducational or other lawful purposes.CIPA uses the federal criminal definitions for obscenity andchild pornography. The term "harmful to minors" is defined as"any picture, image, graphic image file, or other visual depictionthat: Taken as a whole and with respect to minors, appeals to aprurient interest in nudity, sex, or excretion; Depicts, describes, or represents, in a patently offensiveway with respect to what is suitable for minors, anactual or simulated sexual act or sexual contact, actualor simulated normal or perverted sexual acts, or a lewdexhibition of the genitals; and Taken as a whole, lacks serious literary, artistic, political, orscientific value as to minors."Decisions about what matter is inappropriate for minors aremade by the local community. E-rate Program rules specifythat "[a] determination regarding matter inappropriate forminors shall be made by the school board, local educationalagency, library, or other authority responsible for making thedetermination."12Additional meetings are not necessary – even if the policy isamended – unless those meetings are required by state orlocal rules or the policy itself.

Web Filtering for Education4.0 Choosing the right deploymentstrategy for your school districtWith more and more software migrating to the cloud andthe clear benefits that brings, a natural progression for manyschools will be migrating to cloud filtering or hybrid over thenext few years.Although cloud environments are becoming increasinglypopular, on-premise web filtering is unlikely to disappearaltogether. Many on-premise environments find having aphysical appliance more reliable to manage.4.1 Where is your school district on your filtering roadmap?The following table offers some points to consider when considering your deployment strategy.Current needsPossible solutionSolution detailYour school district has heavily invested in an onpremise solution.Traditional:On-premiseUpdating your on-premise solution may be theright place for you now.You’re aware that cloud is coming and that youneed to move to it in the future, but you wouldlike to wait for cloud filter solutions to be moreestablished.You have the staff available to maintain and managethis equipment.You want to have full control over your system anddata, you don’t mind completing updates on yourdevices, and do not want to overhaul a system that isreliable with the opportunity to manually improve.Your school district has quality on-premise equipmentbut is noticing gaps in some of the filteringrequirements you need.Your school district has available staff to maintain theequipment but need to find a solution that will coverthe filtering gaps.Your school district has a limited budget but is inneed of a solution that can cover your school district'schanging environment.Hybrid: Traditionalon-premise combinedwith cloud add-onA hybrid solution can allow your school districtto keep its functioning on-premise solution butimplement an add-on using a cloud solution ontop.This can be an easy fix without a big overhaulof the existing solution. Your school district cangradually progress over to the cloud, giving youtime to plan for meeting all of your complexrequirements exclusively through the cloud.By using a combination of on-premise and thecloud, you will be able to achieve greater costefficiencies, simplify solution management, andimprove your content filter's overall performance.13

Smoothwall for EducationCurrent needsPossible solutionSolution detailYou want to overhaul your school district's filteringsystem and bring your district fully into the modern ITenvironment.Cloud: Advanced all inthe cloud filteringInstalling a fully cloud-based solution will enableyou to create a filtering infrastructure designed toaccommodate future technical changes.You don’t want to have a huge capital expenditureoutlay and are looking for a solution that reducesexpenses with a subscription-based cost.A cloud solution will enable you to managefiltering costs over time without significant upfrontexpenditure in on-site equipment.You want to have flexibility in your offering tofulfill your changing device-specific requirements,fluctuating enrollment numbers, and support an everincreasing number of devices.The IT infrastructure will be simplified withoutthe need for complicated configuration. A cloudsolution will enable you to keep your solutionflexible so that you can scale up or change flexiblyover time.WhitepaperYou want a no-nonsense solution where your data isprotected.You want to reduce the need for running updates tothe latest version, freeing you up for other technicaldemands.You want to avoid bottlenecks with your vast datasetswhich can be hard on your processors and affect thespeed of your reporting.You have an overwhelming amount of manageddevices and no BYOD program.14Data in the cloud is normally encrypted and storedin a remote and physically secured site. Thisis likely more secure than a school district canachieve.There will be no need for updates as the cloud willautomatically run the most current solution.Cloud computing allows filtering to occur at devicelevel, activity is distributed across every device,avoiding bottlenecks.

Web Filtering for Education4.2 Case scenariosCase scenario ACase scenario BSchool District of 10,000 studentsSchool District of 1,000 students3,000 PCs, 7,000 iPads700 PCsSchool District A would like to simplify filtering on theirwireless devices. They find the complexity of on-premisewith certificate-based MitM filtering causes problemswith some key sites and occasional issues with Kerberosauthentication. They are reasonably happy with their set-upand have invested in expensive equipment that is workingwell for them on their Windows devices. They have a goodlevel of technical support readily available and are justlooking for a solution to streamline their wireless filtering.School District B have made large investments in their onpremise filtering equipment. They are currently reasonablyhappy with their filtering set-up but are concerned that ifother districts in their state are moving over to the cloud, theywill soon be unable to meet the level of filtering required.They have the staff to keep up basic maintenance butknow that the system needs an update. They are wary ofoverhauling a system that is generally working and don’twant to pursue a big change at this time.Solution: HybridSolution: On-premise updateThe addition of cloud filtering would ease the problems theyfind, as it uses simplified authentication and no MitM. Sincethere are no serious issues when filtering for their wiredcomputers, using a hybrid solution will improve their filteringservice and they can review migrating fully to the cloud in thefuture.With the right staff that are able to maintain an on-premisesolution, the school district will be able to keep up-to-dateby simply updating their appliance-based solution. Althoughthey will not be able to enjoy the benefits cloud computingoffers, they will be able to run a fully up-to-date filteringsystem and be able to review again when cloud solutions aremore established.15

Smoothwall for EducationCase scenario CCase scenario DEducational Service Center of 17,000studentsSchool District of 5,000 studentsWhitepaper5,000 PCs, about to introduce 12,000Chromebooks with more to be added overfollowing yearsEducational Service Center C has a number of wired desktopPCs used by staff and students. However, they are planningto implement a 1:1 strategy and want to be able to achievefast deployment for these devices while being able tofilter the devices on and off-site. They also are looking forflexibility and scalability as they want to trial with their 3,000high schoolers first before rolling it down at the middleschool level.Solution: Hybrid or cloudThe ESC is looking to make significant changes to their ITstructure. With the plan to roll out 3,000 managed devicesto middle school students, and then to increase this acrossthe rest of the region over time, cloud filtering would providethe best solution. It will enable the ESC to achieve fastdeployment and easy scalability as the number of devicesincrease.16800 PCs, 1,000 Macs, 2,000 ChromebooksSchool District D has a smaller technology department whoare struggling with the time needed to maintain an up todate on-premise filter while having to manage the rest of thedistrict's technology needs. They also have large data setsand are looking to reduce the demand on their processors toimprove their reporting. They want to be able to see filteringdata over time so that they can gain a full contextual pictureof a student when necessary. They have 2,000 Chromebooksand need easy deployment and flexibility of on and off-sitefiltering.Solution: CloudCloud reporting will reduce the need for staff managementand maintenance. The most updated version of filteringwill always be automatically be available without needinga lengthy installation processes. The right cloud solutionwill also enable them to be able to access a much morecomprehensive picture as it will be able to report on 100% ofdata.

Web Filtering for Education5.0 How to choose a providerWhen choosing a provider, it is important to choose a solutionthat covers all the requirements as part of CIPA. Looking fora vendor that is established and a specialist in solutions foreducation and the public sector is a good starting point.Asking the vendor how they are able to meet the guidelineswill give you a good understanding of whether they are alignedwith the necessary filtering requirements. Having room forcustomization is also key when selecting a provider.5.1 Checklist of functionalityReal-time contentanalysisEnsure their solution does not just use a URL block list, but instead uses real-time contentanalysis to look at pages objectively and avoid unnecessary blocking or missing any pagesthat should be blocked. For example, a provider that categorizes content by analyzing thecontent, context, and construction of individual pages is much more effective at finding andblocking inappropriate content without overblocking entire sites. Relying on URL block listsalso often means subdomains are not included in the filtering provision – a key and growingconcern amongst educators.Powerful real-timereportingLook for a provider that offers timely reporting. A provider should empower school districts totake a proactive approach and intervene in concerning behavior before it further develops.On/off-site protectionIf your school district has any managed student devices, it's necessary to make sure you havethe option for them to be filtered off-site. Check to see if there is granularity in this.Full incident reportingMake sure your provider is able to report on 100% of the data created. This will help build a fullcontextual picture of an incident and provide evidence-based reporting to administrators.AuthenticationLook for a simple authentication process that makes access smoother and makes it easier totrack all users.Social media controlsCheck that the solution gives you options around social media including read-only access.Anti-malwareEnsure the solution covers protection against malware and ransomware threats.17

WhitepaperSmoothwall for EducationData securityEnsure that any vendor understands any specific requirements around school data.Easy bandwidthmanagementMake sure the solution will enable you to control and allocate bandwidth to allow media andfile-sharing.Layer 7 applicationcontrolCheck the solution will enable you to identify and stop applications you don’t want to run onyour network and prioritize the ones you do.Anonymous proxyblockingLook for a simple authentication process and allows to easily track all users.Age appropriateLook for filtering providers that use a wide variety of directories (e.g. Microsoft AD, GoogleDirectory) and allow filtering to be set appropriately at group and/or user level.Simplified configurationSometimes elements of on-premise solutions can make filtering more complex than it needsto be. Cloud filtering simplifies the approach, making filtering easier to configure and lesslikely to fail. For instance, some cloud filtering solutions are able to analyze content in realtime without the need to add on-premise additions including man-in-the-middle decryption,certificates or exceptions.Multiple optionsMake sure you choose a provider that can offer a solution that best suits you. A good vendorwill be able to look at your needs and provide a tailored solution to meet all your requirements.DeploymentCheck that the speed of deployment and the resources you will need on-site match up. Manycloud solutions can have a faster set-up than on-premise. Less configuration and equipmenton-site makes cloud filtering deployment a speedy process.ScalabilityCheck that your solution will easily adjust depending on your school district's ever-changingnetwork needs. Adaptability is key for a long-term solution.Provider reviewsLook for providers that can show you an established history in providing filtering for USeducation. New providers may offer services that are "too good to be true" as they do not fullyaddress the needs and challenges of filtering in education and may not be able to deliver whatthey are promising.SupportA quality pr

Smoothwall is a leading web filtering and digital monitoring developer. Since 2001, Smoothwall solutions have protected millions of students worldwide. We pioneered the development of real-time, content aware web filtering and have since launched further monitoring and digital safety solutions to protect users in today's world.