I am a teacher of computer science and have been successfully teaching programming with Visual Studio for a number of years. The network manager has raised a concern that the school network is at risk because the students can run executable files copied onto the computers from external sources.
One approach would be to isolate the programming classrooms from the wider school network, but this is impractical because the programming students often need access to the internet and other shared resources. Furthermore, the computers are used by other students who do not study computer science.
My understanding is that anti-malware, a firewall and group policies can be used to block executable files from external sources while allowing code written by programming students to run, and only from specified folders. Programming could be restricted to certain supervised rooms. Am I correct and how else can we negate or mitigate the risks of using compiled programming languages?