Redesigning School Network

Posted by _khi4@reddit | sysadmin | View on Reddit | 14 comments

A friend just called me "Hey they school i'm currently working at , they want to redesign their network in more reliable and safe way" They have ran into a ransomware , so they decided to redesign the network with strict policies this time all what cam to my mind is AD , then I was like why don't we go for Azure AD (Entra ID) or InTune I didn't dive deeply in any of those so I need advices , do you think that InTune can suit a school system ?

Reply to Post

14 Comments

[-]

JoJoTheDogFace@reddit

Redesign a network over ransomware? This is not really a networking issue, or maybe I am misunderstanding what you are saying. For that issue, I would suggest turning on shadow copies and ensuring you have good daily backups. Training is the second part of that solution. Only having rights to access and/or change rights to things they actually need access to is also high on the priority list. Another part would be programs that prevent that. And yet another part is ensuring the users do not have admin rights on their workstations (if they have to have admin, they should have a separate account that they log into to perform admin activities, just to ensure that admin activities only happen when they decide. Most schools are on a pretty tight budget, so make sure you or your friend are utilizing [techsoup.org](http://techsoup.org) Policies can be put in place to disallow USB devices and the like. How you do it depends on the environment.

[-]

_khi4@reddit (OP)

sorry yes I mean that we may need to set some restrictions so that no one of the students would like plug an infected usb drive or something also I was thinking of setting some restrictions over downloading files , is that possible ? not browsing but downloading , is that a thing ? forgive my lack of experience and knowledge

[-]

JoJoTheDogFace@reddit

If it is a domain, check group policy. If it is a workgroup, use local policy. You could also use InTune, but there is a cost associated. Downloading there are several options, depending on your desired outcome. I would suggest googling it as what would be best for you is hard to know with limited knowledge. Make sure you check out [techsoup.org](http://techsoup.org) though. Any tech working for a not-for-profit should have that site bookmarked. From what you have said, you will be interested in Microsoft 365 Nonprofit E3 $9.00/user/month * For nonprofits with more than 300 users that need Windows, Office desktop applications, and enterprise-level security * Upgrade to Windows 10 Enterprise included * **Office desktop applications for PC and Mac included, with apps for tablets and phones** * Provides cloud-based access to Office applications with email, instant messaging, HD video conferencing, 1 TB personal file storage and sharing, and other services * Provides Azure AD Premium P1, Azure Information Protection Premium P1, Microsoft Advanced Threat Analytics, and Microsoft Intune The reason that I pointed this one out is that it includes InTune. I think the full price plan is about $30 per user, so going through tech soup will save a lot of dough.

[-]

georgexpd8@reddit

A school district, in most cases, is not a non-profit.

[-]

JoJoTheDogFace@reddit

Tech soup also serves schools, but it is not their primary focus. It is worth the time it would take to get registered to see what they have to offer.

[-]

stufforstuff@reddit

Step one - get a budget IN WRITING. Then find someone that actually knows how to secure a network that will be willing to work within that budget to do a new design and hardware refresh.

[-]

Legal_Cartoonist2972@reddit

How did they get hacked

[-]

_khi4@reddit (OP)

no idea yet, but it's a school so maybe someone plugged in and infected usb drive or downloaded a malicious file

[-]

Legal_Cartoonist2972@reddit

How are you managing patching endpoints right now? Is there a domain controller or is this all a workgroup environment

[-]

SevaraB@reddit

Network segmentation alone doesn’t stop ransomware. EDR tells IAM to cut a user account off when it gets compromised, so NAC and RBAC won’t let the compromised user try to compromise more stuff on your network.

[-]

e2346437@reddit

I'm not sure they know what they mean when they say "Redesign the network". An actual network redesign will likely not keep them safe from ransomware in the future. They need to invest in products that will block or mitigate ransomware. Sentinel 1, Huntress, etc paired with a good antivirus software to protect the admin machines and servers. Firewall with gateway scanning for threats. Email filtering to block malware and phishing attempts. User security training. Also, they need good offsite immutable backups as a last resort. Intune is just a management platform, it doesn't really protect from ransomware, but you can pair it with Defender ATP to manage threats. That's all assuming the school can afford it; most I work with can't, so we make sure they have good offsite immutable backups and hope for the best.

[-]

_khi4@reddit (OP)

I know that intune is not directly going to protect them , but what's on my mind is that someone may have downloaded something or plugged in an infected usb device , so I was just thinking about controlling the installed softwares and the ports and all of that forgive me i'm kinda beginner so I know that my words are not so solid

[-]

Kwuahh@reddit

It's important to note that both a secure network redesign and Intune can assist in actually preventing ransomware. Insecure configurations are very common to take advantage of for an initial foothold, and you must harden every facet of your organization to provide the least number of potential cracks for a threat actor to abuse.

[-]

Kwuahh@reddit

You're on the right track, but if they were ransomwared they need to rethink their entire strategy. This isn't something to take lightly. They should be examining their whole infrastructure with the ransomware incident as a strong guiding force for where to place their efforts. There are a ton of angles to consider, and without knowing the lay of the environment, it's hard to provide any sort of concrete guidance. Intune is great, and that can address device hardening and authentication, but the physical infrastructure, network topology, trust boundaries, policies (both physical and virtual)... Seriously, it would be worthwhile to bring in outside help to examine the systems and protect what's important.