The end of an era

In a couple of weeks I’m leaving this vast, beautiful island and my home for the last decade to return to the substantially smaller, wetter and greener one of my birth. This is for family reasons (lots of missed time over the covid years) and is thankfully not goodbye; my role has changed to accommodate remote work until next year and I’ll hopefully retain a stake thereafter pending my eventual return down the track....

September 15, 2022 · 3 min · 625 words · Chris Beattie

Code debt and custom sandboxes

Schools can hardly be the only organisations with legacy applications in regular use for vital ’line-of-business’ functions. Hopefully for the most part these are visible to IT, securely contained and have an end-of-life date with a succession plan rather than being adopted through choice into a modern desktop environment. A while ago I encountered a nasty and unavoidable case of the latter and had to figure out a solution. The application I was tasked to deploy was for processing sensitive financial data on our most heavily-secured devices and relied on Internet Explorer and Java....

September 2, 2022 · 6 min · 1160 words · Chris Beattie

User bypass of policy-enforced browser extensions

By most estimates, Chromium browsers have a 70-80% market share and are deployed in academic and enterprise environments across the globe. Policy-based management is vital to ensure a uniform user experience and enforce security controls, yet on Windows bypassing some aspects of this as a restricted, non-admin user is trivial. This is concerning because schools may rely on these settings for duty of care and student protection. Enter Extensions In recent posts I’ve outlined why Internet security is important for schools and how network-based monitoring and filtering solutions are no longer sufficiently comprehensive to be viable in isolation....

August 8, 2022 · 6 min · 1203 words · Chris Beattie

HTTPS inspection: a lost cause

HTTPS inspection is a function provided by many Internet security vendors marketed at schools and businesses since it promises to remove encryption from web traffic and ensure that everything is visible to the filtering system where it can be checked for malware or flagged for inappropriate content. This worked fairly well a decade ago but in the post-Snowden era of pervasive encryption and advancing Internet security standards, this cannot deliver what it once promised and instead puts us and our networks at risk....

June 30, 2022 · 7 min · 1368 words · Chris Beattie

Cybersafety the hard way

I’ve been working in the education sector for almost a decade and after so long a great many things that inform my thinking become assumed, unacknowledged. Some of my greatest revelations have come from describing the things we do, the problems we have and the ways we fix them to folk outside of our wheelhouse. That’s what this post is; it’s a primer on attitudes to technology in schools through the lens of cybersafety....

June 27, 2022 · 9 min · 1909 words · Chris Beattie

Exchange Online mailbox sender restrictions with Azure AD synced groups

I’d love to see current global stats comparing use of Exchange on-prem vs cloud. Surely given the number of recent security disasters, any notion of physical ownership of mailboxes equating to their safety has been well and truly dispelled and only the bravest or most prodigiously-resourced organisations would attempt hosting it themselves. Exchange Online is doubtless the most popular version and would most often be deployed alongside an on-prem Active Directory, yet as soon as AD is in the mix the assumption is that Exchange is on-prem or hybrid....

June 13, 2022 · 4 min · 662 words · Chris Beattie

KB5014754 Certificate Confuddle

In a masterful stroke of irony, within days of me sharing my solution for NPS RADIUS with AADJ devices, itself made necessary because Microsoft doesn’t consider the needs of their cloud-first customers, they made a major change to how certificates work in Active Directory in KB5014754 without considering the needs of their cloud-first customers. This change breaks the mechanism my solution relies on to operate and while there is a workaround, it is only viable until the change kicks in....

June 9, 2022 · 6 min · 1076 words · Chris Beattie

I'm in the docs!

So my previous blog around AADJ device certs for RADIUS on NPS gathered some steam. Thank you @jabbrwcky for this inspiring article that shows how to bring NPS into the cloud era with smart solutions like @scepman_ and @RADIUSaaS. — glueckkanja (@glueckkanja_) May 25, 2022 It now features in the official documentation of SCEPman, the cloud CA I used in my solution! Intriguing to see how to lift NPS to the cloud era, and great to see clever solutions to all challenges....

May 29, 2022 · 1 min · 143 words · Chris Beattie

Microsoft Virtual Event Presentation

Delighted that the Microsoft education team gave me the opportunity to present some of my recent work to their top schools around the country and thankful for the great encouragement from those that attended. Honestly, the education community is just brilliant – and I’m proud to be a part of it!

May 27, 2022 · 1 min · 51 words · Chris Beattie

Microsoft NPS RADIUS for AADJ devices

Microsoft’s Network Policy Server (NPS) has been running network authentication in the enterprise for decades but is now out of the loop when it comes to a modern cloud-first infrastructure. Using an inventive approach, I show that it is possible to overcome its recalcitrance and get it authenticating Azure AD-joined (AADJ) as well as on-prem AD clients. This is the long-form writeup of the project I presented at Microsoft’s Australia-wide Surface Gold & Lighthouse Virtual Event in May 2022....

April 29, 2022 · 14 min · 2827 words · Chris Beattie