Keeping Children Safe in Education 2023

The 'Keeping Children Safe in Education 2023' statutory guidance has been a great step forward for safeguarding in schools, and provides much needed ‘Must’ and ‘Should’ guidance in many areas of school life.

From an IT perspective it introduces a few challenges in the sections which apply to web content filtering. How can schools offer the same level of protection to Apple, Chrome and Windows devices?

Jamf Safe Internet fulfils most, if not all of the requirements

Schools should of course consider risk assessments made for their individual needs, but in most cases Jamf Safe Internet should fulfil the needs of all platforms in most environments. For the purposes of this article though we will focus on iPad as one of the least well catered for platforms by traditional network based filtering solutions.

In most cases Jamf Safe Internet will be a huge step forward from existing filtering solutions for iPad because it has been developed with a platform-centric mindset. By that we mean that Jamf have considered the device and the user in all aspects of development, and at no point have they accepted a compromise for either. The result is a product which sits unobtrusively on the device, transmitting as little data as possible off the iPad to ensure that security and filtering is maintained.

A key consideration from the KCSiE guidance relates to providing content filtering for all school devices, not just the school network. Jamf Safe Internet protects iPad wherever it’s being used and doesn’t rely on hardware or other services on the school network.

With a commitment from Jamf that a development roadmap is in place to continually evolve the product, keeping pace with the ever changing needs of Apple and the developing online threats. For more information about Jamf Threat Labs, the team behind the security side of Jamf Safe Internet, click here.

Jamf Safe Internet leaves no device unfiltered

From a technical perspective Jamf Safe Internet is a dream to use. Particularly for Jamf Pro based customers who can setup unified endpoint management (UEM) integration, which allows the groups setup in the MDM for devices (for example 'STAFF' and 'STUDENT') to be mapped over to Jamf Safe Internet and appropriate policies for those groups.

The result of this technical wizardry is that new devices onboarding to the MDM are automatically assigned the relevant filtering policy and no device is left at risk.

System Requirements

The only real technical requirements for Jamf Safe Internet is that the following destinations are added to the safelist for any existing filtering solutions on the school network:

Whitelist these destinations and set them to bypass any SSL inspection

edna.wandera.com (Jamf Security Cloud using TCP Port 443)

*.wandera.com (wildcard to cover all other Jamf security destinations)

*.jamf.com (wildcard to cover all alert / block display pages)

And it’s recommended that iPads are running iPadOS 16 or higher

How do you know that Jamf Safe Internet is working?

Instead of trying to think of inappropriate content to test Jamf Safe Internet, use these test sites once setup:

Verifying that Traffic is Going Through Safe Internet

In a supported browser, go to http://dns-test.wandera.com/. If the webpage reads Secure DNS traffic is active, all of the device's internet traffic is going through Safe Internet.

Verifying that Content Filtering is Working Successfully

In a supported browser, go to http://gambling.com/, for example. If content filtering is working correctly, the block page is shown.

Verifying that Security Threats are Blocked Successfully

On the device, open a browser and type in the following test URLs:

http://spam.threatops.co.uk/ to test spam prevention

http://malware.threatops.co.uk/ to test network-level malware

http://phishing.threatops.co.uk/ to test phishing threats

Visiting any of these three sites will direct students to http://block.jamf.com/.

The school can also check that content is filtered using the SWGfL testing tool https://testfiltering.com/

Reporting

The following common reports can be generated on demand for a date range. Normally referencing reports 1 and 3 initially, then following up with reports 2 and 4 as needed.

1. Apps Report

Details the number of blocks for inappropriate web content or app traffic by category

2. Apps Hostname Breakdown

Shows the individual sites for each category that have been blocked

3. Security Report

Details the number of block for spam, phishing and malware

4. Security Report By Category

Shows the individual sites for spam, phishing and malware 

Conclusion, Jamf Safe Internet is the 'safe' bet

In conclusion, Jamf Safe Internet would be a great choice for most schools, certainly those with a significant deployment of iPad.

Our experience of many other big name solutions for iPad, almost without fail is that they have flaws in relation to filtering anywhere (i.e. offsite), technical setup, slowing down responses, data privacy, impacting teaching and learning, disabling key features of iPad and more.  Jamf Safe Internet has none of these issues

Jamf Safe Internet will continue to use the very latest best practice as dictated by Apple, to secure iPad in a way that won’t negatively affect the user experience or teaching and learning in class. A great solution to keep children safe in education.

Email us at info@krcs.co.uk

Call us on 0115 985 1797