Cloud MIS Security

[vikpaw]

Just a closing thought as i go for my weekend, though will be back tomorrow for a bit in teh morning.

 

With a cloud MIS for security you really want to have dual-factor authentication. It's just too risky not to, right? Attempts at enforcing strong passwords, just force the user to write it down, usually somewhere obvious, in clear text, with a big label that says use this for 'XYZ MIS' (yes that popular product rears it's head again!)

 

I'm just wondering, how do you then get third party apps and providers to connect to the system?

Anyone with experience or thoughts?

 

For example, we have in-house SIMS, so my add-ins either have credentials passed in at run-time or stored locally on a server here, and they talk to eachother within the confines of my network.

 

How does this work, if the MIS is in the cloud, and all staff are using dual factor? How does the third party or automated system authenticate in a way that's dual factor?

[X-13]

How does this work, if the MIS is in the cloud, and all staff are using dual factor? How does the third party or automated system authenticate in a way that's dual factor?

 

Depends what the second factor is.

 

If it's a code via a physical token/app [Like WoW's two-factor] then they could just use the generator app as part of XYZ MIS and any time a 3rd-party app needs something it just requests the current code.

 

TBH, it's something that would be awkward to do [it may not be...] you either have to auto-auth all apps or hand over the code to generate valid authentication codes to 3rd-parties.

[LosOjos]

I'd imagine this would come down to the third party app having to exist within the same network as the MIS, and two-tier authentication only being employed for connections originating outside of that network.

 

I'm certainly not the authority on this though!

[Geoff]

Two factor authentication requires you authenticate with 'something you have' and 'something you know'. So this could be something simple like a pin number and a fingerprint to get inside a building. World of warcraft is a good example of it done well. The 'something you know' is your username/password and the 'something you have' is the battlenet authenticator. It depends on the situation and your users as to what will work best for you, but for internet services of any description look at the WoW model.

[GREED]

@vikpaw mate

 

Can you give some examples of third party products that require an ad-hoc or even constant communication link with the cloud MIS in this scenario. I want to respond with specifics here as we are working with the same scenario with a customer using a Dual-Factor Authentication separated security layer between t'nternet and MIS.

 

This is common in local authorities who are hosting the MIS in their data centres. It is not a standard feature outside of this. I'm interested at why the distinction between cloud and client MIS here, given so many client MIS's are available via a remote desktop-type facility, which have the same levels of authentication (i.e. not usually dual factor). With the concern, I would want DFA on everything regardless of the cloud.

[Steven_Cleaver]

If I was accessing any MIS system remotely either internally based system or Cloud based I would expect Dual Factor Authentication, to be honest the main reason we built this into Remote Access solution so to access our MIS system you need to have encrypted app and your Network username and Password as well as your (MIS username Password) no encrypted App can't access MIS systems.

 

This makes it reasonably seamless for the user as they click the App and this does encrypted Authentication then they just login as they normally would.

[PhilNeal]

@GREED an example of an application that runs against SIMS is Groupcall's exporter taking info to LA systems.

@Geoff I'm not convinced that the "something you know" is sufficient as its a constant; I can obtain millions of static passwords from Internet sources. Random characters from the "something you know" would work I think.

[Steven_Cleaver]

@GREED We use SIM's but use Insight for parental portal which sits on a seperate Server and communicates with SIM's to extract Student information for parents into Insight is this the kind of thing you mean and requires a SIM's user account authentication to do this so it has virtually live data going across this is all done internally.

[Geoff]

@Geoff I'm not convinced that the "something you know" is sufficient as its a constant; I can obtain millions of static passwords from Internet sources. Random characters from the "something you know" would work I think.

 

I was simplifying for the purposes of readability. The correct term for 'something you know' in the context of two factor authentication is of course a 'knowledge factor'. Which is defined generally as 'the user is required to prove the knowledge of a secret in order to authenticate'. This generally takes the form of a password, pin number or pattern.

[vikpaw]

Good discussion this.

 

I know remote access to on-site MIS needs to be secure, and should be dual factor, this is fine as i imagine teh other systems continue working as they do.

 

I know how dual-factor works, and i expect that there is either a generator, or a physical device of some kind which prevents simple password snooping. This would be for all users. My query is how does an automatic app / third party service, process or whatever use this physical generator / device?

 

It's okay to issue all humans with a keyfob but what about the other systems? As has been said, they may have to stay internal, or, utilise some kind of trust. That is what i'm trying to work out.

 

For example, we use groupcall emerge, and schoolcomms.

 

Emerge uses dual factor as the service is locked to the physical device and then utilises a username, password, and pin code on top. I don't allow public access, so it only works when the user is on my wifi / lan. Even if we published that service externally, it would be secure using the same set up. The groupcall server is on site and has internal comms to SIMS.

 

When I run the schoolcomms desktop app and sync data, it uses my client to run sims and connect to the server and i provide sims credentials ad hoc.

 

If I use XYZ-Nimbus MIS, and it's in the cloud. How does Groupcall connect to that? Even if i house it internally, the MIS is now out there. For me to connect i need dual factor, how does the groupcall service do ad-hoc calls to the MIS. And it does need to, each device via the server pulls down live attendance data if it's available.

 

Schoolcomms may be easier as it might be part of my authentication to the cloud as it's normally called on request.

 

Groupcall also does it's overnights on schedule and Salamander connects to SIMS, nightly and on command, to synchronise data between SIMS and the ID card system. Even my own internal scripts would be affected, e.g. Command Reporter which runs overnight to dump data out of SIMS and then into the library system.

 

I'm sure there are other third parties with similar requirements, and probably some that are cloud themselves...

Do they all need to change how they interact with XYZ-Nimbus compared to XYZ-Terra?

 

Who is the onus on to make these things work? Is this where SIF has it's place? I don't know, i'm not really sure how it works.

[X-13]

My query is how does an automatic app / third party service, process or whatever use this physical generator / device?

 

Trusted system account?

 

As in, if $user requests data, DON'T require two-factor.

 

The username would be akin to the RM system account we have, where it's a randomly generated string of numbers/letters. [Randomly generated at creation, not every time it's needed.]

[vikpaw]

I guess, but it kind of defeats teh 2-factor argument, cos your system is open to a simple username/password combo access. So yes, i guess, you make it very complex and long. Assuming it's easy enough to do that based on user. Haven't seen how dual-factor is implemented.

[X-13]

I guess, but it kind of defeats teh 2-factor argument, cos your system is open to a simple username/password combo access. So yes, i guess, you make it very complex and long. Assuming it's easy enough to do that based on user. Haven't seen how dual-factor is implemented.

 

This soft of thing is how you either compromise your security or break your add-ons...

 

 

Unless all the add-ons are from xyz MIS as extra paid features.

 

That way the automated stuff is trusted as it's FROM the company who made the MIS in the first place.

[GREED]

A very good conversation. There are many aspects that can be covered here, including the justification for dual factor authentication specifically for cloud MIS compares to client MIS that is accessable via the internet still. Instances where the likes of Groupcall connect is also interesting.

 

Dare I get picky, but this is for x third parties to also answer, how they intend to resolve this compared to how will x cloud MIS resolve this for them (all).

 

I must say this has given me some things to think about. What I can say is currently Aspen MIS itself does not use DFA, but customers we are working with utilise DFA through an additional layer, separate from Aspen MIS. We are working on a project to have DFA embedded into Aspen for a large customer in the US. I will also have a better understanding how this will work in practice in the summer and will be happy to share

 

Ultimately, now everything can be accessed over the internet, there is the conundrum we have always had: Security over convenience. How can we conveniently get data to x third party (or from) while still being secure with a data key or the like... I don't have the answer myself!

[X-13]

How can we conveniently get data to x third party (or from) while still being secure with a data key or the like... I don't have the answer myself!

 

Change them from 3rd party to psuedo-1st party?

 

Bring them in-house if they want to write an add-on and let them have the authentication code [along with a cast iron NDA] or require them to hand over the source, which you'll add the authentication generator/code to after it's done.

[PhilNeal]

@X-13 an interesting suggestion and possibility one with legs.

 

It is possible to have a trusted link into another cloud which would allow no run time password to be required however I think the MIS Cloud supplier would be liable for any data theft even if that occurred via a TP. We are talking eye-wateringly high fines so perhaps some form of bond would be required to protect the MIS vendor?

 

 

This whole area is very difficult to see a way through so hopefully someone will come up with a suggestion!

[plexer]

E1 uses a username/password combo plus ask for 3 random digits of a 6+ digit pin code.

 

Ben

[penfold_99]

How can we conveniently get data to x third party (or from) while still being secure with a data key or the like... I don't have the answer myself!

 

Lucky I do. Drum roll........ And the answer is SIF.

 

SIF allows for secure data transfer between applications plus it doesn't matter if the MIS is in house and the other application is hosted externally, vice versa or both remote.

 

connections are secured by client ssl certificate authentication.

[penfold_99]

There are two types of authentication application and user.

 

One of the key things to understand is where the system boundaries are between users and data.

 

Application to application integration extends this boundary outside of the normal boundary of the school or La network, but the relationship between users and data doesn't change.

 

One key thing to remember is the requirement for dual authentication only applies in a few use cases and mainly down to the type of data being accessed.

 

The government clarified this in relation to parents/guardians, with online reporting the parent has access to data normally covered by IL2 but due to the cost of rolling out dual authentication they advised it wasn't required as only a small new of records were allowed to be accessed per login.

 

One of the key things MIS's should do but currently don't (I haven't seen anything that does) is scope which students an application access.

[Steven_Cleaver]

There are two types of authentication application and user.

 

One of the key things to understand is where the system boundaries are between users and data.

 

Application to application integration extends this boundary outside of the normal boundary of the school or La network, but the relationship between users and data doesn't change.

 

One key thing to remember is the requirement for dual authentication only applies in a few use cases and mainly down to the type of data being accessed.

 

The government clarified this in relation to parents/guardians, with online reporting the parent has access to data normally covered by IL2 but due to the cost of rolling out dual authentication they advised it wasn't required as only a small new of records were allowed to be accessed per login.

 

One of the key things MIS's should do but currently don't (I haven't seen anything that does) is scope which students an application access.

 

Hi @penfold excellent points but could you explain what you mean by "One of the key things MIS's should do but currently don't (I haven't seen anything that does) is scope which students an application access."

 

Thanks

[penfold_99]

Hi @penfold excellent points but could you explain what you mean by "One of the key things MIS's should do but currently don't (I haven't seen anything that does) is scope which students an application access."

 

Thanks

 

For example if an application only requires details for a sub set of students such as 6th form, SEN, they should only have access to those students. Most system grant access to all students irrespective of what data the application requires.

 

Context is a tricky thing to implement successfully between application as its dependant on the needs of the user.

[vikpaw]

For example if an application only requires details for a sub set of students such as 6th form, SEN, they should only have access to those students. Most system grant access to all students irrespective of what data the application requires.

 

Context is a tricky thing to implement successfully between application as its dependant on the needs of the user.

 

Or the company asks for full 'GOD' rights (or thereabouts) on the system: Attendance Manager, Timetabler, Third Party Reporting, System Manager, Personnel ... . .

 

Softlink the libary people wanted me to grant all kinds of access to simply dump a list of student names and reg groups, not to mention charge for integrating. i did it myself using command reporter in the end.

[Steven_Cleaver]

For example if an application only requires details for a sub set of students such as 6th form, SEN, they should only have access to those students. Most system grant access to all students irrespective of what data the application requires.

 

Context is a tricky thing to implement successfully between application as its dependant on the needs of the user.

 

Thanks thats clear now and can see your point.I get what you mean about the context and the needs of the user.

 

Do you think this would be feasible by divising a system or appliaction that only pulls the relevant information from the SQL database in SIM's into another database which you could then add in your own fields that SIM's may not hold, be interested in or manage as well, which you could then customise to suite.

 

Sorry if this is off point just interested in opinions really.

[vikpaw]

I don't think it would be very efficient. Creating a view might work better, though i never managed to edit data that i accessed via a view.

[Steven_Cleaver]

I don't think it would be very efficient. Creating a view might work better, though i never managed to edit data that i accessed via a view.

I can see what you mean about it not being efficient just think it might allow me more flexibility in what I wanted to do with it in regards to customisation.