emPSN Service Level Agreements

[TheCrust]

Has any school requested and received a copy of the service level agreements that their emPSN-framework contracts are being delivered under yet?

We asked on behalf of the primary schools we support - only to be eventually told that KCOM / Capita hadn't finished writing them yet!

When we pointed out to the rep in question that surely this should have been something that was done before they started selling services to schools if the services were going to be measured against them, there was an amusing amount of "umming" and "ahhing".

Heard from another secondary in our region that they had a similar response when the question was posed by them.

[korifugi]

Anyone? I've attempted to get something, anything from Capita but at the minute it seems like a game of "Laaa laaa laaa - we can't hear youuuu"

[TMODAlpha]

Anyone? I've attempted to get something, anything from Capita but at the minute it seems like a game of "Laaa laaa laaa - we can't hear youuuu"

Nothing yet. Shocking in my opinion.

[TheCrust]

Has anybody received anything? Or even had any positive responses when asking for it?

When I asked Capita for more information in relation to their HTTPS filtering project recently, I threw in a request for a copy of the SLA (the conversation went something along the lines of "Did you actually consult with the school as your client before making this arbitrary decision over a change in the service? Because this was NOT mentioned when you were pitching for the business last year! BTW can I have a copy of the SLA to see how you're supposed to implement change?") and they expertly ignored all requests related to the provision of a copy of the SLA.

Given this defiant silence in relation to the SLA, if I were being cynical I could very well start to believe that SLAs do not exist in relation to any services procured off the emPSN framework at all!

Has anyone actually had a copy of their SLA from either KCOM, Virgin, Capita or RM in relation to their emPSN connection yet?

[TMODAlpha]

Has anybody received anything? Or even had any positive responses when asking for it?

When I asked Capita for more information in relation to their HTTPS filtering project recently, I threw in a request for a copy of the SLA (the conversation went something along the lines of "Did you actually consult with the school as your client before making this arbitrary decision over a change in the service? Because this was NOT mentioned when you were pitching for the business last year! BTW can I have a copy of the SLA to see how you're supposed to implement change?") and they expertly ignored all requests related to the provision of a copy of the SLA.

Given this defiant silence in relation to the SLA, if I were being cynical I could very well start to believe that SLAs do not exist in relation to any services procured off the emPSN framework at all!

Has anyone actually had a copy of their SLA from either KCOM, Virgin, Capita or RM in relation to their emPSN connection yet?

No, to put it simply. And we are having similar issues with HTTPS connections which is causing havoc with all manor of devices.

[Edu-IT]

What have they done in terms of HTTPS?

[TMODAlpha]

What have they done in terms of HTTPS?

They have "SSL Enabled us" and given us a certificate to publish to all of our computers on the Root CA. Any certificates that are received from websites, have the issuers replaced with OpenHive and a lot of services reject this because they dont trust it. Cant install the certificate to tablets, so anything secure on there is rejected, including our MDM profile. So we cant push apps anymore, or update, or use certain apps. And every secure website throws up an error in Safari.

[synaesthesia]

Errr, my knowledge of SSL certificates for websites and HTTP is ropey at best but I have been dealing with it enough on IRC to know that it's quite pointless as it is - Openhive "replacing" them as *another* man in the middle, effectively doubling the risk?
Could someone explain that to me? I am making an outright assumption that I'm being daft rather than Capita doing something dangerous.

[TMODAlpha]

Errr, my knowledge of SSL certificates for websites and HTTP is ropey at best but I have been dealing with it enough on IRC to know that it's quite pointless as it is - Openhive "replacing" them as *another* man in the middle, effectively doubling the risk?
Could someone explain that to me? I am making an outright assumption that I'm being daft rather than Capita doing something dangerous.

Pretty much covers it yeh, and a lot of services will instantly reject the modified certificate. Rightly so.

No you're far from being daft.

[TheCrust]

@TMODAlpha So in effect they did stuff, completely without consultation with you as their customer, that has had a negative impact on portions of your network?

Hmm. That's not good and I know what I would be telling them in that situation. The polite version goes something like: "I say, chaps, you have breached your part of the contract by not only not supplying me a SLA to measure the performance of the service against, but then imparting changes in an arbitrary manner without consultation or consideration on how they effect me mean there has been a negative effect on the operation of some of my systems. Either you remedy this situation and start playing by the rules, or I consider the agreement between us terminated."


When I asked them what they were up to with this HTTPS / Certificate project on behalf of our supported primary schools - one thought we had had was by acting as a "man in the middle" they could intercept stuff to which they had no legal right such as between the exam boards, or the DfE, and the school - they eventually came back with this:

We can assure you that we do not de-crypt or re-encrypt any part of a user request. In order to perform the filtering function, Webshield looks at the user REQUEST URL to determine the host portion of the HTTP-part of an HTTPS request. This allows Webshield to carry out an allow/deny decision on the requested host name of the server, prior to any data being fetched from the web server (the RESPONSE). The software that Capita uses allow us to use either the full URL when asking for an allow/deny decision, or just the hostname of the web site (note this is still the REQUEST not the RESPONSE).

Following the action taken by Webshield to either allow or deny the REQUEST, if the request is valid no further interaction takes place, the data is fetched from the web server and delivered through the Webshield proxy server directly to the web browser. As stated we do not at any stage de-crypt or re-encrypt data and neither is there caching of any data, nor any data held on the Capita operated proxy servers. When the actual requested data is fetched it simply flows through the proxy server, the transmission over the Internet is secured, as is the transmission across the emPSN. We do not log, nor cache any aspects of content from the RESPONSE.

Obviously if the request is not valid/denied the user will receive a deny page from Webshield.

This process is the same for HTTP requests and for HTTPS request and our Webshield service does not differ in this sense from the previous embc service.

We are required by both duty of care responsibility, and by UK law enforcement organisations to trace requests back to their source should an investigation be triggered. The Webshield system report logs enable us to trace users and timestamp the URL requests but again this does not allow us to inspect at any time detail or content. This is also a requirement of the emPSN and therefore of the service.

I presume based on your concerns that we were inspecting content you asked if the school can opt out of this HTTPS inspection entirely and remain on the current filtering system.

The answer is you can but opting out will have an operational impact on your school users. You will lose the flexibility of per-user filtering for HTTPS web sites, which typically impacts the staff in school who are more likely to access these sites. Such that, should an HTTPS web site be denied by your site-wide policy (e.g. banking), you lose the advantage of user-based filtering (UBF) i.e. role based/ profiled access to the internet. Even if you log in, no action can be taken to relax the filtering for this web site.

I'm still not entirely sure what to make of that response as it didn't really address the questions I had put to them - but one impression I got from it was they were giving me something in the hope I would shut up and go away.

[synaesthesia]

"Lose the flexibility of per-user filtering for HTTPS websites"

Capita have always had a habit of over-complicating things. We've got a defunct RM Smartcache 2 box that's been in action for many years that did exactly that without having to faff around like that?

[Edu-IT]

HTTPS is encrypted though, so surely they have to do some de-crypting? Or am I totally wrong on what HTTPS is?

[Edu-IT]

Seems I'm not mad. Put this to them?

The headers are entirely encrypted. The only information going over the network 'in the clear' is related to the SSL setup and D/H key exchange. This exchange is carefully designed not to yield any useful information to eavesdroppers, and once it has taken place, all data is encrypted.

security - Are HTTPS headers encrypted? - Stack Overflow

[korifugi]

Hold on a sec...

This bit...

The answer is you can but opting out will have an operational impact on your school users. You will lose the flexibility of per-user filtering for HTTPS web sites, which typically impacts the staff in school who are more likely to access these sites. Such that, should an HTTPS web site be denied by your site-wide policy (e.g. banking), you lose the advantage of user-based filtering (UBF) i.e. role based/ profiled access to the internet. Even if you log in, no action can be taken to relax the filtering for this web site.

Sounds like they're saying this...

If you opt out - then you'll lose all ability to be able to access sites under slightly less restrictive filtering, for example being able to log into the "inthehive" system as a teacher to be able to show a youtube video to your class. Your finance departments will also be unable to look at anything to purchase due to all sales sites being filtered with you having no way to reduce the filtering level.

P.S. It's our ball and if you want to play - it's by OUR rules

Is anybody else reading that or is it just me?

[Jobos]

It seems each week there's a different problem with emPSN and if I had known about all the grief we would have I would have used a different ISP when EMBC finished!