354

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child. There are privacy issues. Security issues. Potentially legal issues - is the software ...


169

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers blocked) Complex format (differing cases, special characters, etc.) If so, you are actively incentivizing people to write the password down. Drop the outdated ...


147

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they need admin access, but I would want to revoke that access once they were done. I would want to know the list of everything they want to install, and if they ...


143

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a sysadmin. He would knew all the protection protocols in place. He could just impersonate anyone, from any area, download things, impersonate the next one, and keep ...


141

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And even if you did have access to all their devices, you can only check that they haven't written down the password if you, as a sysadmin, yourself know the password....


139

I wouldn't. You have no real way to tell exactly what they've changed. Some schools are excessively nosy or controlling. And even if the district is being respectful of your privacy, they could have a rogue admin in their ranks. Others have been bitten. There have been lawsuits because of blatant misconduct before. They have alternatives, so ...


67

Others have already stated why this is a bad idea and I fully agree, don't let them install those stuff (certificates??, no way), now, you don't have to be that parent if you present some options: Multi-booting: this way your kid can have a school OS and a home OS, he just need to let them install all the stuff on the school OS and remember not to do any ...


56

Security administrators are responsible for your machine and what happens on your machine. This responsibility violates the basic security model for a single-user Unix machine because the admin (an absent party) is root on your machine, you are not. Unix isn't really set up for this model. Admins need to be able to install security controls on your machine ...


42

Under these circumstances, the ideal case is simple. Get a "burner" laptop for schoolwork only. Use standard tech and low specs suitable for the work at hand (contact their IT dept to find out what they feel is suitable) and let the school do whatever they want with it. The burner should cost at most a few hundred dollars and save a lot of hassle. If your ...


35

Now the school IT department wants to install some software on the laptop and is asking for administrative access. The school does it because it's easy for them. Lots of parents are computer illiterate and asking every parents to review and install software every time they needed to and keeping all of them up to date is very laborious. I feel that on ...


34

From a sysadmins point of view: They want to install Office, Outlook, an AV and some site certificates. If you already have an AV installed, (which you should), then another AV will conflict with yours and be a larger threat to your child's computer. Do a Google search for: "multiple antivirus installed" and you'll see why it's bad. As for the ...


25

A few reasons off the top of my head: ARP poisoning or network flooding attacks on the network would generally require root access to a machine on the network. Being able to install unauthorised programs might open the company up to legal liability if those programs are themselves illegal (e.g. because they're pirated or not licensed for for-profit use or ...


23

Hiding your employer would not appear to be of any use at all when you want to hide the employee's email address from the public. If you hide your employer info but spread your contact details far and wide, the employer info is not interesting. The assumption being made is that once you know the company name and the employee name, then one can freely email ...


22

The idea of customising the training to meet user requirements is in fact a very good approach. However, there will have to be certain additions to this approach which will then suit everyone in your organisation. With that being said, it is very correct when you say that the training required for an application developer will not be the same as an HR ...


21

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more relevant data, process more data in shorter time and also use more detailed input data for the analysis. This way the chance is higher than before that somebody can ...


21

The best security practice is to train the employees specifically to avoid phishing and scams in general. Also, you need to test them periodically, to check if they are actually reacting to scams as they were trained to do. Password managers with auto-complete functionality might also help because they can be used to detect wrong URLs before entering ...


20

Install a camera behind their desk, better yet multiple cameras to cover all angles, and have somebody watch them. You might be bothered by this being unethical but don't worry, it's in no way worse than almost any other way that achieves what you want to do. About that almost: Use "passwords" that cannot be reasonably represented in plaintext by a user. ...


19

You don't. By forbidding users to write down their passwords, you're forbidding them to use the second-best password manager in existence. People are generally quite good at protecting the contents of their wallets; a list of complex passwords written on a piece of paper stored between their driver's license and their credit card is about as secure as you ...


17

Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the network. If Beehive was in place, it may have logged that he was doing something but anyone who has an intent of data exfiltration would've known how to bypass ...


16

Let's break this down: Your concerns as a parent Privacy: You don't want school staff being able to view what sites your kid is visiting, what files they have on their laptop, and other things that would come with admin access. Security: You don't really trust the school having the ability to install software; you're worried about viruses getting onto the ...


16

What is your threat model? I know I ask that counter-question to almost everything here, but most question about security never state what they actually try to secure against. Are unauthorized people regularily in your environment and could spot passwords that are written down? If so, awareness in your users can be improved to this specific and easily ...


15

I don't think anyone else has discussed the certificate issue: In my experience, a lot of schools use a MITM firewall to intercept HTTP traffic for their filtering policies such as to look at the content of the page. This is a problem for HTTPS because they have to replace the certificate with their own - which is probably what they want to install. See ...


14

I'm going to provide a situation that I have experience with, and then draw parallels. I am a Software Engineer, and have worked at several shops with a BYOD (bring your own device) mentality. Each of these shops had their own security practices and software requirements that devices were expected to follow, and it was understood that IT would periodically ...


14

Security Awareness expert here (awards, best-selling book). Absolutely, you should/need to customise training to the role/risks. Many international bodies actually call this out as important: NIST CSF (PR.AT) NIST SP 800-16 SANS FBI/DHS Jonathan Steenland, COO of the National Cyber Center Those were just what I could recall off the top of my head. But ...


13

Both a burner laptop and a virtual machine are respectable options. Multiboot is not, as any time the hostile os is running it can modify the clean os, with beyond-admin privileges. I feel like virtual machine might be superior in more regards than simple cost: The child might benefit from being able to use a better laptop at school. I am talking about ...


13

Should I let my child's school have access to my kid's personal laptop? No. My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. No. The school can bulk buy books, stationary, tools and computers at a discount and tax free. How is it cheaper or better for each parent to know: what to buy, where to go, how to ...


13

First off, I agree with the answers that say that this is a bad idea for a variety of reasons. Second, it appears that you are trying to use technology to solve a human problem. It is very, very rare for that to end well. Instead of focusing on technical measures to prevent writing passwords down, such as cameras, non-pasteable password fields, and so on, ...


12

This answer is not meant to contradict the existing answers, but rather supplement them because it's too long for a comment. Part of the reason is (as others have alluded to) that users can't be trusted to do foolish/malicious things. But another part is whose responsibility is it to fix things when that happens? I'm a full-stack developer and part time ...


11

In the MFA model, it is understood that the multiple factors come from outside the authenticating process itself. Else all authenticating processes are inherently MFA (itself plus the user's credentials). So, to the laptop, it does not count itself as a factor. There would need to be more external factors, like biometrics, tokens, one time codes, etc.


11

Schroeder's answer explains things very well, but I would like to offer a different view. Employees will likely act online. They will ask questions on Stack Exchange, in support forums of vendors, etc. If it's apparent whom they work for (e.g. by using the email address j.doe@awesomecorp.com), then an attacker looking to gain information about Awesome Corp ...


Only top voted, non community-wiki answers of a minimum length are eligible