Cloud MIS Security

[penfold_99]

Or the company asks for full 'GOD' rights (or thereabouts) on the system: Attendance Manager, Timetabler, Third Party Reporting, System Manager, Personnel ... . .

 

Softlink the libary people wanted me to grant all kinds of access to simply dump a list of student names and reg groups, not to mention charge for integrating. i did it myself using command reporter in the end.

 

That is mainly due to how (for example) sims permissions work and how they roughly relate to data items.

 

To gain access to one data item for example teacher role (which is in their contract) you need personnel manager rights. Which gives access to most system don't need.

 

You could go down the custom permission but that would in increase possible support issues after MIS upgrades

[penfold_99]

Thanks thats clear now and can see your point.I get what you mean about the context and the needs of the user.

 

Do you think this would be feasible by divising a system or appliaction that only pulls the relevant information from the SQL database in SIM's into another database which you could then add in your own fields that SIM's may not hold, be interested in or manage as well, which you could then customise to suite.

 

Sorry if this is off point just interested in opinions really.

 

SIF is able to do this through XML filtering.

[vikpaw]

Are there any obstacles to SIF?

Is SIF the only solution?

[penfold_99]

Are there any obstacles to SIF?

Is SIF the only solution?

 

The only obstacles to SIF is supplier support, we have written SIF agent where needed and have been talking to suppliers regarding adopting SIF.

 

When talking to suppliers the driver is now having to support 2 new MIS in the form of progresso and aspen.

 

Progresso has a SIF agent but aspen doesn't yet.

We also need schools to talk to their suppliers about SIF integration and when there will be support.

 

Is SIF the only answer, well yes and no. If you just want a common data model then no, there are others CTFs but these may not contain the required information, if you are wanting to keep multiple data sources in sync such as MIS, library system, learning platform, cashless catering with the potential for update from any system then SIF is the only answer.

[vikpaw]

Does SIMS have a SIF agent?

 

I was thinking of alternatives which might be quicker in the short term, getting around my initial question of ad hoc data access, if SIF uptake is slow. Why is that by the way?

[penfold_99]

Does SIMS have a SIF agent?

 

I was thinking of alternatives which might be quicker in the short term, getting around my initial question of ad hoc data access, if SIF uptake is slow. Why is that by the way?

 

There are a couple of SIF agents for SIMS.net.

 

SIF implementations were originally being lead by LAs for vertical reporting and LA wide learning platform integration and not from a school horizontal integration point of view. this is changing.

 

LA SIF infrastructures cover 40% and LA independent SIF cover infrastructures are able to cover 100%.

 

If an application already has an API then SIF enabling is straight forward. We SIF enabled Oliver in 10 days by using their API.

[penfold_99]

@vikpaw forgot to add SIM.net Partnership exchange is built on SIF.

[PhilNeal]

To be more accurate its based on SIF. We had to make some changes to the way SIF exchanged messages.

[penfold_99]

To be more accurate its based on SIF. We had to make some changes to the way SIF exchanged messages.

@PhilNeal I would still class it as SIF.

 

Yes you have implemented a message broker to handle multiple providers (schools) within the same zones but it use the same data model and infrastructure specification as other implementations.

[jamesfed]

@vikpaw mate

 

Can you give some examples of third party products that require an ad-hoc or even constant communication link with the cloud MIS in this scenario. I want to respond with specifics here as we are working with the same scenario with a customer using a Dual-Factor Authentication separated security layer between t'nternet and MIS.

 

This is common in local authorities who are hosting the MIS in their data centres. It is not a standard feature outside of this. I'm interested at why the distinction between cloud and client MIS here, given so many client MIS's are available via a remote desktop-type facility, which have the same levels of authentication (i.e. not usually dual factor). With the concern, I would want DFA on everything regardless of the cloud.

 

In our case we access SIMS remotely via a VPN/Microsoft Direct Access, two factor exists in that the user has to enter their password and that the notebook PC has a domain allocated security cert (which we can revoke as and when required) maybe such a situation where a machine assigned cert will work for you as well?

[vikpaw]

In our case we access SIMS remotely via a VPN/Microsoft Direct Access, two factor exists in that the user has to enter their password and that the notebook PC has a domain allocated security cert (which we can revoke as and when required) maybe such a situation where a machine assigned cert will work for you as well?

Maybe, so the XYZ-Nimbus implementation would have to have / generate this certificate for whichever client required it.

It just seems like adding a whole level of complexity in the management process, which is fine if that's what is needed. I'm just wondering if the base is there in the current offerings.

[vikpaw]

Just been looking at Google Authenticator, I use it but didn't realize you can add it to your own servers.

[edutech4schools]

Just been looking at Google Authenticator, I use it but didn't realize you can add it to your own servers.

 

WOW can you. I have used that for ages on my phone.

[PhilNeal]

We've postponed using Google Authenticator on Agora as it doesn't force disconnection on publicly available terminals. ( I should add that I'm out of my depth on this)

[vikpaw]

WOW can you. I have used that for ages on my phone.

 

Yep

Google it

[vikpaw]

We've postponed using Google Authenticator on Agora as it doesn't force disconnection on publicly available terminals. ( I should add that I'm out of my depth on this)

 

Disconnection should be the job of the underlying service. Authenticator just does it's job for the 30 second interval when you use that time based code. After that you're at the hands of the application.

That's my understanding.

I'm interested in this as we plan to roll out iPads to staff next year, and it's something they should all have to hand.

Edited February 17, 2013 by vikpaw

[PhilNeal]

I'll check but the problem was we couldn't force a disconnect.

[Steven_Cleaver]

Taken a differen't tack with this built our own remote access solution around RDP.

 

SSL web server only exccepts SSL traffic.

SSL Tunnel sort of to from web Server to PC RDP connection Small Service on PC's to control this.

Students and Staff can access PC on the Network.

We have about 10 PC or Virtual PC's constantly on someone logs on one boots up someone logs off one shuts down automated.

Can't access MIS systems without Encrypted key (Encrypted code) on memory stick or PC\laptop, can't copy this key anywhere as it is coded in a specific way automatically when setup so to access MIS system Encrypted Key and Username and Password so Dual Factor for MIS, this is Seamless to user as they just click the app this loads up the logon web page and does the authentication then the logon with their username and password.

Can set this to Disconnect the session when you want if not in use so 1 minute or whatever you like as this is set against resources (PC's) can set MIS systems to 1 minute others to 5 or what you like.

Someone loses the Laptop or USB can't get in unless they also have staff username and password if they try to guess both key and User get disabled after so many tries.

Has logging and a lot of other features built in as well as other Security features.

 

Just interested if anyone can see issues with the above and to other things that we may need to build in or take account of.

[vikpaw]

@Steven_Cleaver Do you have any remote third parties that need access? Or automated systems? How do you resolve access for them?

[Steven_Cleaver]

@vikpaw I think I know what you mean by third party access but this is all done internally so things like communication between SIM's and Insight automatically is done internally as this is hosted on site as is anything like this as it is all hosted internally, then with Insight Staff, Students and Parents access this over SSL as are all our web solutions I run penetration tests on anything web facing and so do the LEA using external company I think and I get a report from them after these have been run.

[vikpaw]

I was thinking more about the situation when the MIS is in the cloud. So going back to my original post, would your solution work if you were using SkySIMS ? Would you even have the access to set it all up?

[Steven_K]

When connecting a third party, we lock down the integration by IP address and sometime client cert authentication as well as a username and password. I think the real security issue is users keeping their password secure. There was a recent case when one MIS supplier left a default username and password set up on their system, it was the same credentials for every school that wasn't a cloud based system. Also recently I was in a school and the secretary had her password written on a postit note attached to the screen, when I asked her about it, she complained that she was forced to make up a really long username with numbers, letters, different cases and funny characters and couldn't remember it.

[PhilNeal]

I think IP addresses can be spoofed so aren't safe.

[Steven_K]

I think IP addresses can be spoofed so aren't safe.

Yea thats a good point, I wouldn't suggest using it by itself. It reinforces the point that any system is only as strong as its weakest point.

[Steven_Cleaver]

I was thinking more about the situation when the MIS is in the cloud. So going back to my original post, would your solution work if you were using SkySIMS ? Would you even have the access to set it all up?

 

Part of the reason I said mine was a different tack so instead of Cloud based hosted internally and all third party communication, authentication is done internally also easy to link into your AD, easier to manage, more control. Sort of taking the point that we shouldn't only be talking about Cloud base systems and DFA but also any internally based MIS systems that we are allowing access to over the web.

 

You could in theory use it on a cloud base system where these weren't just one big database and each organistion had their own virtual server or physical server to host organisations MIS but would need second seperate server or VM to hold the solution and would probably use MIS username and Password and encrypted key to Authenticate but you would have the issue of how you deal with remote third partys and external automated systems in theory anything internally should be ok.