[SIMS] Sims Password Case Sensitivity Broken

[MACIT]

We have this morning noticed (although i suspect this has been the case for while) that all sims passwords are no longer case sensitive!!

Is anyone else aware of this I asume its not local to us

We are on 7.144

Regards


Neil

[Sivadam]

I can't ever remember them being case sensitive!

[Iain.Faulkner]

I can't ever remember them being case sensitive!

Same here

[laserblazer]

I just tried ours (7.144) and it's not case sensitive. I always assumed it was, @Sivadam could well be right.

[Rawns]

SIMS .net and FMS are not case sensitive for passwords.

[Sivadam]

I just tried ours (7.144) and it's not case sensitive. I always assumed it was, @Sivadam could well be right.

He usually is ............!!!!

[vikpaw]

Never been case sensitive. It's the first thing people ask when you've reset it to NKAJFUWEIA and i always say, just type it in.

[MACIT]

Well I've learnt something new today!

To be honest though considering the massive amount of highly confidential data Sims holds i believe this to be wholly indadequate and Capita should sort it out and quick!

[pete]

When I started here, everyone assumed passwords weren't case sensitive. It wasn't until I first poked into SIMS that I found the culprit.

[matt40k]

To be honest though considering the massive amount of highly confidential data Sims holds i believe this to be wholly indadequate and Capita should sort it out and quick!

It's called Trusted logins.

[Edu-IT]

It's called Trusted logins.

Isn't two factor security (system logon and SIMS logon) more secure though? At least if you can't enforce SIMS security, you can enforce system security.

[vikpaw]

It's not really two factor though is it, it's two - step, and usually they will make the two passwords match! At least with trusted, you can force it to be complex just in case they do decide that 1234 is a suitable sims password.
I'd like to see some kind of physical device required like banks use, so when the system is open to the world via portals, there is an extra layer of security.

[matt40k]

Isn't two factor security (system logon and SIMS logon) more secure though? At least if you can't enforce SIMS security, you can enforce system security.

Nope, like vikpaw says, it isn't two-factor. Plus they normally don't change it, give it a pupil so they can mark the register, have it written on the laptop or on a piece of paper in the laptop bag. SIMS SQL logins has been done really well by Capita, but it's a false sense of security, at least from the point of view of SIMS in the classroom.

Think of it like this, when you open Outlook, do you put a password in? No, what about when you go into the staff shared area? No. Well both hold sensitive data. Best thing is to teach staff "Windows + L", it takes seconds so they're is no excuse. They're professional, they're expected to follow the security rules.

[matt40k]

I'd like to see some kind of physical device required like banks use, so when the system is open to the world via portals, there is an extra layer of security.

It's generally accepted that being onsite connected to a internal network to be a layer of security. Basically you must have a "key" to get onsite and into a classroom, I mean if I walk into your school, I assume I would have to pass some sort of physical security to get into a classroom, even if it is a member of staff. That's all assuming you don't have network sockets in the reception area or car park, or a insecure wifi network

[pete]

I'd like to see some kind of physical device required like banks use, so when the system is open to the world via portals, there is an extra layer of security.

The last time I asked SIMS about this in person, they did a good impression of attempting to run away while staying in one place. On further questioning the half-answer I got was "if you're hosting it yourself and can make it work with sharepoint, woohoo, but we don't support it and the government says we don't need to".

This was the same conversation which involved "wait, so there's no audit trails for it either?"