Protecting your kura and school networks from VPNs

A VPN creates a private connection between your device and a remote server.

Virtual Private Networks (VPNs) are marketed as a way to protect privacy and get around virtual blockades.

Some people use them as a sneaky way to get around region blocks and watch TV shows not available in New Zealand, others use them to protect their data while using public wifi, and some businesses set them up so remote staff can securely access work tools and data.

The technology works well for those purposes and, in most cases, it’s a relatively harmless workaround or useful tool. However, in schools and kura, the story is a bit different.

VPNs can be a way for ākonga to find a way around the filters, firewalls and monitoring you’ve set up to protect your network.

What is a VPN?

Usually when you browse the internet, your activity is routed through an IP (Internet Protocol) address linked to your home connection or a public network. When you access a site or app, it can ‘see’ your IP and know where your requests are coming from.

When you sign up and use a VPN, it creates a private digital connection between your device and a remote server, which hides your IP address and lets you sidestep online blocks. It’s often described as a digital ‘tunnel’ that lets you browse without exposing personal data or letting online monitors know where you’re located.

There are plenty of legitimate reasons to use a VPN but for schools or kura trying to protect their networks, VPNs can present risks. A student who downloads a VPN on a school device or BYOD may access inappropriate content usually blocked by network security without your system flagging the search.

Another risk is the way VPNs function. When you download a free or paid VPN, your device becomes part of the wider VPN network managed by the provider.

This is known as peer-to-peer networking, which means traffic from other users may be routed through your device and IP address. In rare cases, this can mean inappropriate or even illegal content can be linked to your school IP address or devices.

Detection the best protection

How can you protect your school network against tech designed to hide browsing activity and sneak around security software?

This is where N4L comes in. Their Safe & Secure Internet service includes VPN blocking, which blocks any attempt to download a VPN from a known provider.

N4L subscribes to several services that actively search for new VPNs and add them to their block list, which helps minimise the risk of a student getting around your firewall.

Emerging VPNs can make things difficult, but in many cases, N4L can spot VPN usage on your network and alert you.

A recent story from one school illustrates the risks of VPNs and the importance of constant monitoring.

N4L’s security team detected malicious and inappropriate traffic on a school-owned computer. Oddly, the issue was happening outside school hours and well into the night when no students or teachers were on
the premises.

With support from N4L, the school investigated the device and found a free VPN had been installed that used peer-to-peer networking.

Traffic from other VPN users was routed through the school device and IP address, making it look like inappropriate browsing was happening on the school network.

The outcome? The school was able to delete the VPN from the device, removing the threat to the network and stopping inappropriate content at the source.

Tech solutions

While they can’t spot every single breach, N4L network security includes built-in VPN detection, with constant updates to catch new threats as they emerge.

It’s not infallible, but it’s the best way to protect your network from risky or inappropriate content slipping through the virtual cracks.

Find out more about creating a secure network for your school or kura at n4l.co.nz(external link). You can also contact them via support@n4l.co.nz or
0800 LEARNING (0800 532 764).

 VPNs present risks for schools and kura protecting their networks.

Getting ākonga on board

As with any security issue in schools or kura, user behaviour is a factor. You can block and monitor all you like, but you can’t always prevent risky online behaviour, such as clicking on a suspect link or trying to view inappropriate content.

It’s important to educate both ākonga and kaimahi about online cyber risks – including risks with VPNs –and making mention of them in your user agreements.

For more information and support, visit education.netsafe.org.n(external link)z.