Are you responsible for the school network? Have you been tasked to develop and deploy a content filtering solution? If so, this guide is designed to help think through the
programmatic side of the house, while future articles will help with the technical considerations.
Things to Consider in a Content Filtering Strategy
Whether you're working with 100 devices, or 20,000, school network administrators around the world are faced with new demands to ensure students can easily access educational content,
while providing a family-friendly environment. During normal times this is tough, but in a post-COVID world, this task has become exceptionally more difficult.
At the core of the problem is having a basic foundation from which to start. Here at CleanBrowsing, we are fortunate to work with a lot of schools. In the process we have identified 10 key questions
that we believe will help schools of all sizes think through their content filtering strategy. This programmatic guide will be supplemented with a more technical guide.
The Problem Is The Same
The problem, regardless of the organizations size, is always the same (99% of the time):
Ensure students are not accessing inappropriate content.
Although it may sound simple, deploying a solution to appropriately solve this is extremely complex and wholly dependent on the school and their specific interpretations and
corresponding acceptable online use policies. Where administrators typically go astray is in their initial planning, or lack there of.
10 Questions To Help Establish a Better Foundation
These questions are designed to help you think deeper about the problem, and your organizations specific needs. Having answers to these questions will help you choose the
solution that works best for your organization:
1 - What does your organiation consider "inappropriate" content?
At the core of the problem is the ambiguity of "inappropriate" content.
Is a person in a swimsuit or lingerie the same as pornography? How and who makes that determination in your organization? What about obscene content?
Something being inappropriate, or obscene, is wholly subjective and as an organization, you need to have a clear understanding of what you mean to avoid that confusion.
2 - Must you conform to specific rules, regulations, around content filtering for children?
Every jurisdiction is different. In the US, for example, schools receiving funding from the Federal government must conform with the Children's Internet Protection Act (CIPA). This act
requires schools receiving federal funding to block or filter internet access to content that is obscene, pornographic, or considered harmful to minors. Other jurisdictions have
What are your requirements?
3 - Has your organization performed any content filtering in the past?
Depending on the size of your organization, this might be more complicated to answer than you might realize. Some organizations have legacy solutions that everyone has forgotten as
they are "set and forget" or they are deploying a local agent meant to solve one problem (e.g., AntiVirus) but has other functions that may cause issues (e.g., internet filtering).
There are also those configurations that occur at the edge on devices like routers that an administrator might not consider to be "content filtering" but they leverage similar
technologies and can cause conflicts.
At the core of this question is to encourage an organization to have a clear understanding of their existing stack. This understanding helps troubleshoot and ensure all deployments
go as expected.
4 - What level of control are you looking to enforce?
Let's face it, kids are sly little foxes, and if they invested as much energy in their school work as they do finding ways to bypass your controls they would all be valedictorians.
Alas, the reality is that is not the case.
What is your organizations real commitment to this? Both from a program, technical and people stand point? The biggest stumbling block administrators have is this idea that one singular
solution will solve it all - e.g., "we want to block everything, everywhere!" Most organizations don't have a true appreciation for what that means. To truly address "all" your strategy must
look to employ a myriad of hardware and software based solutions, and even then the idea of an absolute "all" is a recipe for disaster.
As an organization you have to figure out the level of control you want to enforce, and where. Is it something you want to be bound to the device, regardless of the network?
5 - What are the organization's device fleet demographics?
Is the organization working with Apple devices? If so, which ones? (ie.g., MacOS, iOS) Windows Devices? Chromebooks? What versions of each? Do you have a good system for how they
are maintained? What about mobile hotspot devices?
These questions are imperative to understanding an environment and figuring out the best strategy to take when deploying a content filtering solution. The more device types in your enviornment,
the more complicated. The more out-of-date platforms, the more complicated it becomes.
6 - How will the fleet be managed?
Will you be working with a Mobile Device Management (MDM) solution? Will you be doing this manually? These questions help understand options and the time to deploy.
Deploying manually on 10 devices is not a problem, on 1,000 devices things get a little trickier as human errors are inevitable.
7 - What tools does the organization employ to manage the fleet?
Does the school use an MDM solution? If so, which one? And does it have multiple MDMís for different device types (e.g., GSuite for Education for ChromeBook,
Mosyle for Apple products, etc..)?
Is there feature parity for each device type?
8 - Does the school use a VPN?
What are the rules for use of a Virtual Private Network (VPN)? If a VPN is used, is it an "always-on" application on the device?
Does it require student action? Are you using a third-party VPN platform or a self-hosted platform? What features does the VPN platform provide with regard to
customizing DNS or content filtering?
We find schools that do use VPN's rarely think much about DNS and hard hit with a harsh reality that the service they are using does not allow for content filtering via DNS.
9 - If devices are issued to students, are those devices hardened?
If devices are issued to your students, are they hardened? Are students given administrative control?
We find a lot of administrators are having to issue devices to their students, but leaving certain aspects of the device open to the user, or not hardening them at all.
10 - How are browsers managed and controlled on devices?
Browsers are quickly becoming one of the most frustrating tools to school administrators as they introduce system-level controls into their applications.
VPNs were once the leading tool used to bypass, but browsers are quickly crawling their way to the top of that list as they integrate more control into their browsers.
Has your organization given any thought to how browsers should be used? How will features be limited on those browsers? Or what browsers are acceptable on your network?
This is a very important question very few schools are asking, but it's quickly becoming one of the most important.
We find a lot of organizations pay almost no attention to the browsers they allow, or the functionality being introduced to the browsers, on the devices they have control over.
CleanBrowsing is a DNS-based content filtering service. We specialize in helping organizations create family-friendly networks. This means that we're perfectly suited to help
schools of all sizes create a network that appropriately conforms with your organization's acceptable use policies for internet use and welcome the opportunity to help you think
through your strategy, and eventually deploy a solution. If this is something that you're interested in, you can reach us at email@example.com and all our pricing is
transparent on our pricing page.
Future articles will dive into the technical options and how to think about them. We will explore some of the latest technologies like Encrypted DNS and Virtual Private Networks (VPN)
and how to leverage them in your stack.
Browse the web without surprises. CleanBrowsing automatically blocks adult content, while allowing Google, Youtube, Bing, DuckDuckGo and the rest of the web to load safely. It only takes 5 minutes to enable the service for free and with nothing to install.