MX and Umbrella value input request

[MarshMadness]

I am a volunteer IT guy for a small school using an MX84 with Advanced Security and various MR's.  I want to make the school as secure as possible and reduce my likelihood of any incidents etc. so i am thinking about adding Umbrella.

I have spoken with someone from sales and i really do see value in all the abilities Umbrella brings, i just dont have the time or resources to config, manage and monitor yet another system.  It seems like Umbrella does a lot of the same things that Advanced Security does natively with the exception of granularity of policy and investigation etc.

I am using Umbrella/OpenDNS IPs for my DNS resolution already.

What am i overlooking; what is the compelling argument for an Umbrella subscription given i am looking to reduce my admin workload not to mention additional cost?

Thank you in advance for your insights...

[CptnCrnch]

First and foremost, Umbrella is one of the easiest to us security solutions you‘ll find. No need to operate a separate device, simply point your external DNS to their IP addresses (as you already do).

With Umbrella, you have a very powerful added layer of security in place. You users will be automatically be protected even from things your firewall / IPS etc. will learn about in days to weeks. The best thing is, the protection is happening in the background, there‘s no need for regular configuration, even monitoring can be automated.

[PhilipDAth]

If you go with an Meraki MX Advanced Security licence then I wouldn't bother with Umbrella UNLESS you were prepared to install the Umbrella roaming agent on each of your machines - especially notebooks that roam outside of your network.

The benefit of Umbrella here is that you have the same protection no matter where in the world the machine connects to the Internet.

[Uberseehandel]

To add to what @PhilipDAth has written, bear in mind that smartphones and tablets are now used for Office/Google applications, in addition to laptops. Indeed I wish it was easier to carry out some actions on phones that are second nature on laptops and workstations.

Kids, being kids, will detect any obvious chinks in security and exploit them.

In my experience, getting a handle on phones is difficult. I have to visit certain sites where one leaves phones, computers, tablets, USB sticks, writing pads etc. in a locker before leaving the entrance lobby, because the security guys can't keep on top of BYOD kit or any device that goes off-premises.

Just remember STUXNET. And the target machines in that project were air-gapped.

Sometimes one has to ask oneself "how paranoid do I want to be?" The answer is always "a bit". So its a judgement call 😎