352

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child. There are privacy issues. Security issues. Potentially legal issues - is the software ...


246

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies point of view before we talk about how it can benefit you. Why would a company want to do this? Many reasons. It makes it assured that your computer can ...


148

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. I can't control it, I have no insight into how patched it is, how virus-ridden it is, and I do NOT want you to keep company data on your personal device when ...


145

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they need admin access, but I would want to revoke that access once they were done. I would want to know the list of everything they want to install, and if they ...


142

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a sysadmin. He would knew all the protection protocols in place. He could just impersonate anyone, from any area, download things, impersonate the next one, and keep ...


137

I wouldn't. You have no real way to tell exactly what they've changed. Some schools are excessively nosy or controlling. And even if the district is being respectful of your privacy, they could have a rogue admin in their ranks. Others have been bitten. There have been lawsuits because of blatant misconduct before. They have alternatives, so ...


103

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


89

Separate development and production It is usual practice to give developers local admin / root rights on their workstation. However, developers should only have access to development environments and never have access to live data. Sys-admins - who do have access to production - should have much more controlled workstations. Ideally, sys-admin workstations ...


83

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad. Relevant here are the advisories concerning preparation before travel: Review the applicable company policy, Review destination country applicable laws, Prefer to use devices dedicated to travel (computers, ...


66

Others have already stated why this is a bad idea and I fully agree, don't let them install those stuff (certificates??, no way), now, you don't have to be that parent if you present some options: Multi-booting: this way your kid can have a school OS and a home OS, he just need to let them install all the stuff on the school OS and remember not to do any ...


63

Is this common practice in big companies? Yes. The feature is available in most enterprise firewalls and also several firewalls for smaller companies. It is even available in the free web proxy Squid. And several personal firewalls have implemented it too. As more and more sites, (both harmless and harmful), move to https://, expect that the usage of SSL ...


56

Security administrators are responsible for your machine and what happens on your machine. This responsibility violates the basic security model for a single-user Unix machine because the admin (an absent party) is root on your machine, you are not. Unix isn't really set up for this model. Admins need to be able to install security controls on your machine ...


48

In addition to all the other reasons given: Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users. The company want to control this and the easiest way is by controlling the machines. Letting employees install these programs on their own computers would be both a ...


43

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


42

Since this question is not a technical one, rather more about human behaviour, you won't get the answer. What you describe is very typical though and I made the same experience. Complex password rules will usually not lead to more safe passwords, really important is only a minimum length, and a check against a list of the most used passwords. People cannot ...


41

So this answer is from the point of a developer. Keep that in mind. First, not having "local admin" rights on my own machine is a sign that I should look for a job elsewhere. It's nearly impossible to write code, fiddle with stuff, and maintain a toolchain if you have to ask permission every-time you need to update (or test out) a new dependency or ...


41

Under these circumstances, the ideal case is simple. Get a "burner" laptop for schoolwork only. Use standard tech and low specs suitable for the work at hand (contact their IT dept to find out what they feel is suitable) and let the school do whatever they want with it. The burner should cost at most a few hundred dollars and save a lot of hassle. If your ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


35

Now the school IT department wants to install some software on the laptop and is asking for administrative access. The school does it because it's easy for them. Lots of parents are computer illiterate and asking every parents to review and install software every time they needed to and keeping all of them up to date is very laborious. I feel that on ...


34

Clean desks policies are rather literal in the sense they don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours. Sensitive data doesn't only include password....


34

From a sysadmins point of view: They want to install Office, Outlook, an AV and some site certificates. If you already have an AV installed, (which you should), then another AV will conflict with yours and be a larger threat to your child's computer. Do a Google search for: "multiple antivirus installed" and you'll see why it's bad. As for the ...


33

To quote AviD on this: Security at the expense of usability comes at the expense of security If you make it too hard to fulfill a security policy, people will either ignore it or look for loopholes and workarounds which fulfill it to the letter but not to the spirit. So you will reach the opposite of what you intended and weaken security. A security ...


32

Trevor Paglen's book about USA Department of Defense secrecy, Blank Spots on the Map, has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom ...


25

None of the reasons you've given are valid reasons for escrowing your password. There's only a couple valid reasons for escrowing any sort of "authenticator" information. A couple others have touched on these, but I'll try to clarify a bit. Encryption Keys: It makes absolute sense for the organization to have access to escrow copies of your encryption ...


25

SSH traffic looks different from HTTP and HTTPS. SSH traffic simply tunneled through port 80 or 443 (i.e. ssh -p80...) can be detected by looking at the first response packet already which contains the SSH version and not the HTTP version or the TLS ServerHello. But you could also simply enforce the use of a HTTP proxy inside the network which makes the use ...


25

A few reasons off the top of my head: ARP poisoning or network flooding attacks on the network would generally require root access to a machine on the network. Being able to install unauthorised programs might open the company up to legal liability if those programs are themselves illegal (e.g. because they're pirated or not licensed for for-profit use or ...


23

Hiding your employer would not appear to be of any use at all when you want to hide the employee's email address from the public. If you hide your employer info but spread your contact details far and wide, the employer info is not interesting. The assumption being made is that once you know the company name and the employee name, then one can freely email ...


22

The idea of customising the training to meet user requirements is in fact a very good approach. However, there will have to be certain additions to this approach which will then suit everyone in your organisation. With that being said, it is very correct when you say that the training required for an application developer will not be the same as an HR ...


21

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more relevant data, process more data in shorter time and also use more detailed input data for the analysis. This way the chance is higher than before that somebody can ...


Only top voted, non community-wiki answers of a minimum length are eligible