Accessing Sims from home?

[sparxx]

Hi Everyone,

One of our Deputy Heads is keen to promote the use of Sims at home for writing reports etc..

Just wondering what solutions everyone has in place to achieve this? Weve had a look at a few Citrix and Sharepoint solutions but am wondering what you guys and girls are all using?

Any feedback would be appreciated

[Jake]

Out of curiosity, how does data protection work with that? What happens if someone leaves SIMs on their machine with kids personal details on and they have guests or something?

[kerrymoralee9280]

Surely that is out of the school's hands? And into that of the user. The IT team cannot make sure everyone is using it responibly much like the secure USB pen discussion we had before on here.

How does this data protection work at school in that sense? What if a teacher goes on some confidential staff info at SCHOOL and leave his/her machine unlocked for pupils to access?

I wish people would stop being so politically correct. Yes, measures need to be in place to stop major leaks etc, but lets not take it to the extreme and turn this country into an ever softer one.

@Sparxx - We use Terminal Services, with Sims.net installed on the TS box. Works a treat as at the same time staff can access all drives, docs, printers etc.

[Jake]

Fair comment, I was just curious as to whether there were issues with it

[webman]

Yeah we're doing terminal services with SIMS soon.

[sparxx]

@Sparxx - We use Terminal Services, with Sims.net installed on the TS box. Works a treat as at the same time staff can access all drives, docs, printers etc.

Right, did you do this yourselves? Or did you have a company come in with a complete solution? How many TS servers do you have? and for how many staff? How much did this setup cost you? Sorry for all the questions!

[Geoff]

Surely that is out of the school's hands? And into that of the user. The IT team cannot make sure everyone is using it responibly much like the secure USB pen discussion we had before on here.

How does this data protection work at school in that sense? What if a teacher goes on some confidential staff info at SCHOOL and leave his/her machine unlocked for pupils to access?

The seventh principle of the Data Protection Act states:

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data

If you fail to do this. You (as in the School) is in breech of the Data Protection Act.

[kerrymoralee9280]

Key word there Geoff was "appropriate".

What is expected of us? Because you can't go round to a teachers house everytime to watch whether they are using it appropriately......

Yes, we do have a role and responsibility in seeing that data is protected? But if you ask me, it is just as safe at home through TS than it is in a school full of information hungry kids....

[Geoff]

From a technical standpoint your systems must be secure. This obviously includes the hardware, software, and network.

From an organisational standpoint you must address some more issues. Who has access to the data, what controls are in place over these users and how your overall systems are governed.

In assessing if school systems meet the requirements of the seventh principle, it's helpful to ask yourself a few questions:

• Is there proof that the school took all reasonable steps to comply with the security obligations of the Act? For example, has it undertaken a security audit to assess the obvious security risks associated with the data processing?
  
• Has the school complied with relevant standards which relate to the security of personal data and which are used in the Education sector? For all public bodies, the ‘Code of Practice for Information Security Management’ (BS7799 or ISO 17799) will be of particular relevance.
  
• Can the school answer some basic security questions: Is there a security policy? Is there a business continuity plan should a disaster result in the inability to process personal data for some time? Does management take its security responsibilities seriously? Do staff and students keep passwords secure and follow access control procedures?
  
• How do other educational establishments deal with their security obligations? Have others set higher standards of security?
  
• What security risks are known to exist and what products and/or polices can minimise these risks?

Now, with all that organisational and technical stuff out the way. We need to deal with the teachers wandering off site with laptops. In the language of the DPA, they are 'data processors' and as such the school has an obligation to ensure they are bound by the same security regime as the school itself.

The DPA has the following to say about policies/contracts to enforce this.
A contract/policy must:

[*]Require the data processor to comply with obligations
equivalent to those of the seventh principle;[*]grant the data controller the right to audit the data processor at any time; [*]and specify that the data processor is to act only on
instructions from the data controller

Enjoy.

[ozydave]

Hi
Just found your post on accessing sims at home.
We have setup TS running sims. Not that difficult. Our TS server is not the newest. It’s an old dell power edge (don’t think they make them any more). It does have two processers and 2GB of memory. You do have to buy TS CALS (I think they were £13 or something like that) and have another server acting as the TS licensing server. We have set it up so 20 staff can access sims remotely. All seems to be working fine. If the need arises we can just get more CALS to allow more access.
The main problem was getting our County council to setup a sslvpn.
So to access sims remotely the teacher connect using the SSLVPN connection which takes them to the school network. They then can run a remote desktop connection (mstsc with the ip address) or a remote web connection (tsweb – http://server ip address/tsweb).
The TS server needs to be put in its own OU in Active Directory. You can then apply the TS loopback group policy to it. You can then lock down the server as much as you wish. We stop them doing anything apart from running sims and MS office. When they log on we have given them access to the personal files and shared areas on the network.

Does any of this make sence?
Let me know if you need more info, I’ll do my best to help

[Grommit]

Our School rfuses to let any staff have remote access to the School Servers or Email.....

There is far to much risk... I mean during school hours we have problems with Students getting hold of staff passwords, and / or trying to hack the staff passwords....

Imagine what would happen if they could do it from home...

Also there are issues of staff downloading masses of files from the shared drive.. I have often told staff "no we cannot copy your entire departmental Folder onto DVD"....

Imagine what they could do from home.. as access to the staff shared is a basic start for remote access..

So No Access from Outside...

[bossman]

ozydave:

This is exactly what we have done but before we role it out to the staff i will do an audit of all their computers at home via a questionnaire which will give me the feedback that i need to ensure the safety of the data and the network.

I will then draft an AUP containing a section on remote Sims access which the governors and unions will be asked to advocate and then have all staff members sign.

Bit long winded but this I think you have to do so as to ensure the maximum protection of the data on your schools network.

[Grommit]

ozydave:

This is exactly what we have done but before we role it out to the staff i will do an audit of all their computers at home via a questionnaire which will give me the feedback that i need to ensure the safety of the data and the network.

I will then draft an AUP containing a section on remote Sims access which the governors and unions will be asked to advocate and then have all staff members sign.

Bit long winded but this I think you have to do so as to ensure the maximum protection of the data on your schools network.

So basically you are just accepting their word that they are not letting others look as the SIMS data, or downloading it for their new job ?

[ozydave]

Grommit
We have obviously got the teachers to sign that they will comply with the data protection act. The teachers have to bear the responsibility for the safety of the data, both in school and at home.
At school the data is available so what is stop a teacher or any other member of staff coping / printing information and taking it home.
I agree that many times I have walked into a classroom and found the teacher has let him/her self logged on. All you can do I tell them of the importance of data protection again. If there is something that enables teacher to do their job in a way that suits them, i.e. doing reports at home rather than sitting at school etc then that has to be a good thing.
As regards downloading stuff from the server while working remotely, that is stopped. We have MS office running on the TS so they can open documents and work on them and resave but not copy to their computer at home. (In fact the only software that will run is SIMS and MS Office. Everything else has been stopped by the software restriction policy. The start menu has been redirected so the only icons they see are SIMS and Office)
If your school is concerned about the data falling into the wrong hands, do you allow the use of USB Flash drives and printers?

Regards
Ozydave

[Oops_my_bad]

Is TS traffic encrypted? I want to avoid having to use the VPN for this, otherwise I will have to set up a DMZ within the VPN or such like, to stop staff having more access to the network than they need :?