Giving SLT User Administrator Password

[plexer]

Well, you can ask, but as they are SLT they outrank you and can do what they like. It is neither "your" network nor "your" password so the only thing you can do is tell them why it is not a good idea and ask them what they are thinking that they might need to do when you are not there

 

Depends really IT is the responsibility of a centralised company within our federation now staffed with all the existing people a managed services company if you like, they would have to be talking to the Director of IT Services to be granted domain rights here and I doubt that would happen

 

Having said that I never said it was my network or my password?

 

Ben

[witch]

Depends really IT is the responsibility of a centralised company within our federation now staffed with all the existing people a managed services company if you like, they would have to be talking to the Director of IT Services to be granted domain rights here and I doubt that would happen

 

Having said that I never said it was my network or my password?

 

Ben

No, @plexer, you didn't. @elsiegee40 did. Your situation is different from a school with an IT tech. I'm sure a Director of IT Services carries more clout!

and @Ephelyon Yes, they certainly should justify themselves and I did say that. All I meant was that however much you explain the problems, and however much you want them to listen to you as an expert, sometimes you are on a hiding to nothing and need to accept it or go mad in the process.

[SYNACK]

Well, you can ask, but as they are SLT they outrank you and can do what they like. It is neither "your" network nor "your" password so the only thing you can do is tell them why it is not a good idea and ask them what they are thinking that they might need to do when you are not there

 

I partially disagree, it is your password and user account, traceable to you, if they need admin access give them a different account for it, separate from their usual account as users running around doing everything while logged in as a domain admin is begging for trouble. Also segregate what they actually need, of it's just software installs have a local admins group and even restrict it down to just the stations that they need. Sure there should be at least one other domain admin or password in a safe for continuity purposes but not too many more. The best way to describe this to them is that someone with a domain admin logon can read everything, all their documents, all their emails, everything and ask them if they are happy spreading that around, usually it is two separate issues, the continuity one and the software install one which you can get around with more limited local admin only Groups pushed out via special Groups in a gpo.

[Ephelyon]

I think @witch is talking generically about giving SLT an account with admin access, not necessarily your own. Perhaps "'your' password" refers to "admin access passwords" in general.

 

I do agree that the school IT resources are the property of the school, which in our case is to say they are the property of the County Council with the Head locally in charge. That is the accepted structure and doesn't change just because we might want it to.

 

However, and on the topic of explaining oneself, I'd view it this way:

 

Full access to all data assets within an organisation is nothing short of an occupational hazard. That's because the first question the Police will ask you if your house gets broken into is "Who else has the keys?" If you are a full administrator, you're on that list. In common law, you can do away with the DPA completely and opt for "Malfeasance in Public Office", for which the burden of proof is (VERY broadly speaking) "the preponderance of the evidence". That means it needs to be "more likely than not" that the defendant is guilty of the charge.

 

Furthermore, there will be some data stored on the system that even members of SLT should not be privy to. This includes sensitive personal data on staff, particularly where e.g. disciplinary meetings are concerned, or disclosures of e.g. mental health concerns that may lead to an OHU referral. Some of you will know that the latter happened to me last year, and the only member of SLT I expect to have access to those stored copies of OHU referrals is the Head. Not the Deputy Head, not the Assistant Heads, not the Business Manager, because they Don't Need To Know™. In that manner, and only in that manner, we comply with Principles 2, 6 and 7 of the DPA.

 

Our profession is the only one where it is accepted that the "can" is not the same as the "may" in terms of access to data. The ONLY reason for that is that we have accepted the necessity of this for us to carry out our duties for the past 40 years. Nevertheless it remains an occupational hazard - and not a power trip! - that nobody else should be exposed to unless they can state, and prove, in explicit terms, why it is required. Perhaps it would be appropriate for the Governors or the LEA to intervene in forming an impartial external judgement on the matter.

 

Maybe it's possible to use some of that reasoning when discussing these matters with SLT.

Edited September 6, 2013 by Ephelyon

[elsiegee40]

I ended up pointing out to the HT that what had been done with our administrator password was like giving the school keys and alarm code to a contractor and then leaving all the internal doors and filing cabinets ... and then keaving them unattended to get on with it.

[CAM]

Also consider if they wanted rid of you or someone else for whatever reason and decide a bit of network tampering is the way to go. You have enormous amounts of power as a network admin and the trust and impartiality that goes with it. As SU - ROOT used to say to me every time I used it during shell training, "With great power comes great responsibility!"

 

It sounds utterly paranoid but that is a trait that network security revolves around.

[witch]

1052151It sounds utterly paranoid but that is a trait that network security revolves around.

 

Yes, of course, and indeed when I talked about "your" password I did mean the admin password in general - and @elsiegee40 's explanation is a good one and I shall keep that in mind!

But if they want to do it, they will.

Edited September 6, 2013 by witch

[nicholab]

Would love to know if this got taken to a disciplinary where this would go. They can't just sack you for not giving access as it in your jobs spec to maintain the systems to the highest profession standards!! Edited September 6, 2013 by nicholab

[GrumbleDook]

Well, you can ask, but as they are SLT they outrank you and can do what they like. It is neither "your" network nor "your" password so the only thing you can do is tell them why it is not a good idea and ask them what they are thinking that they might need to do when you are not there

 

 

Correct, it is not "your" network, but it is "your" password ... and you can cover it under DPA under principle 7. Principle 7 of the Data Protection Act - Guide to Data Protection

Sharing your password means you are not taking reasonable organisational measures to prevent accidental damage, ie that someone may delete or move data for which they do not have the understanding, expertise or experience to judge the impact of.

 

I would also cover it under Principle 1 - the processing of data shall be lawful. If access to data is given to someone who does not have the right to process it (ie as part of their job description) then your are in breach of principle 1.

 

And this is before we get into the fact that it would allow for accusations to be made against SLT that they are 'investigating' staff files and there is no clear audit trail to prove it one way or another, meaning that any case of constructive dismissal suddenly gets a massive injection of ammo to throw at the school.

 

Explain to SLT that by doing it all by the book you are protecting them and the school, and should they wish to insist that they know your password they I suggest you give them a dummy account, with minimal delegate admin access whilst using a separate admin account yourself.

 

I would also speak to a union to get advice about being instructed to complete an action that could be potentially harmful to the school and individual employees.

 

In short, don't give them your account, give them another and if you can do as suggested, account details in an envelope, sign the envelope, laminate it, sign the laminate too, then into the safe. Some SLT will want a second copy kept off-site. Do the same again, but the off-site copy has to stay with a nominated and trusted person such as the Chair of Governors, then brought in for a monthly check to show it has not been opened.

[Ephelyon]

Forgot about Principle 1.

 

But how does that square with what I raised before about the "can" NOT in fact being the same as the "may" in our case? Surely that must mean that, for us, the requirement for access to all data assets must be included in each of our job specs, otherwise a sysadmin post is always in breach of Principle 1?

[nicholab]

I did at one point refuse to sign the end user agreement as I would break it on a daily basis. It also did not have any input form us and generally made me cross? Edited September 6, 2013 by nicholab

[witch]

I refused to sign the end user agreement until it was modified to allow me full access to any staff data on the server. We have a separate admin network which I am not responsible for so that made things a little easier.

 

I agree that we have a big responsibility over this issue and I wouldnt give out "my" password - I was just using that as shorthand for an admin account. But I still say that even with all these reasons documented and a minimal admin account created - if they still demand the full admin access, I don't see how you can refuse? The suggestion that SLT is going to be irresponsible with it or do something unacceptable is a bit worrying

[Ephelyon]

The fact is they can cause problems without meaning to. The concern isn't that they would deliberately vandalise the system, but simply that the use of this skill requires great precision and some of us have careers in - basically - how to use it properly. Surgeons tend to hold onto their scalpels too. To suggest otherwise demeans the profession.

 

As I said, clearly there is a hierarchy but at the end of the day if you believe an instruction is potentially illegal you have the right to refuse. If they have a problem with that, then it's time to go before the Governors, the LEA or a Tribunal if necessary and slog it out.

[witch]

How would just requesting admin access to the server in a head's own school be illegal?

[Ephelyon]

I said earlier:

 

"Furthermore, there will be some data stored on the system that even members of SLT should not be privy to. This includes sensitive personal data on staff, particularly where e.g. disciplinary meetings are concerned, or disclosures of e.g. mental health concerns that may lead to an OHU referral. Some of you will know that the latter happened to me last year, and the only member of SLT I expect to have access to those stored copies of OHU referrals is the Head. Not the Deputy Head, not the Assistant Heads, not the Business Manager, because they Don't Need To Know™. In that manner, and only in that manner, we comply with Principles 2, 6 and 7 of the DPA."

 

But that could be a different scenario. If there are allegations made against the Head, for example, here they would go to the Governors. The Chair also has an account and may store data (meeting notes etc) in respect of that allegation. The Head may not access this.

 

Put simply, just because you hold X Very Senior Role doesn't mean you get full access to everything. Nobody does. We are the only exceptions and that's purely for functional reasons, e.g. how can you back up all data if you can't access it all? If someone wants to give me a few million and a team of very clever people, I'd be quite happy to go away and attempt to design a security/filesystem model that doesn't require this, but for now it remains an unfortunate exception.

[GrumbleDook]

How would just requesting admin access to the server in a head's own school be illegal?

 

If the Head has admin access and doesn't have a clue about what he might break when fiddling then the school is failing on principle 7, as they know that there is a high risk that something could go wrong. They are not taking all 'reasonable' organisational measures (ie only those that have the expertise, experience and understanding of the data and systems it is housed in).

 

If the Head is trained and certified SysAdmin then it would be reasonable for him to be granted full admin access (or given a separate account with full admin access so that there is a separation of activities between the day job and the elevated access).

 

In the same way, if another member if SLT is an experienced data controller, has a high level knowledge about the MIS then they might have access to a full admin account in there.

 

It should be part of a school's risk assessment when identifying data controllers, and the final decision should be with the SIRO, if you think about it.

[GrumbleDook]

Forgot about Principle 1.

 

But how does that square with what I raised before about the "can" NOT in fact being the same as the "may" in our case? Surely that must mean that, for us, the requirement for access to all data assets must be included in each of our job specs, otherwise a sysadmin post is always in breach of Principle 1?

 

It will vary from school to school but generally the NM, and others with full access to the main admin account which can access everything, can grant access to everything or change passwords to grant access, are recognised as that they can access everything, but that does not mean they *will* access everything.

 

This is then backed up with an audit trail of password changes, etc so that it is clear who has done what... if needed.

 

In the same way the CPO in the school will have access to sensitive personal data and data labelled as IL4, it does not mean that they will read every little bit of data on every child.

[jmak]

Just an aside: My account is a member of the Administrators, Domain Admins, Domain Users and Staff groups, but there are still some functions that I can only use under the built in administrator account. I use my account for most admin activities on the server, but the built in account when computer says no. We buy support services from our LA and they have access to and sometimes use the built in account too, for the same reason.

 

I have tolerated that on the basis that there is a trail of the fact that my access can be tied to my machine and that someone else does need access in case I am not available. Is there a permission that I can give myself, so that I can close this loop hole?

[Ephelyon]

Thanks, good to know. I wonder how it would be to work for a Head who'd had a sysadmin background?

 

Would be interesting considering that with the amount of full-time teaching experience needed to reach Headship, I'd imagine they wouldn't have been doing much sysadmin work since about... the 80s/90s?

[nicholab]

I think it comes from a change security model in schools I still find it confusing that one teacher is not allowed access to some information but another teacher is I thought they were all on the same team. This suggest that historically all teacher had access to all information and now there are different information circle in schools. But the data protection act is stupid that for over 50 years index cards have been used but only now have we decided that use need to registered that card index which is stupid.

[Ephelyon]

That was because of the globalisation of information that began to take root from the 70s onwards, though most particularly from the 90s. It caused people to begin to think more deeply about information, how it is used and why, who ought and ought not be able to see it or change it, etc. Without the attempts and standardisation and protection that have arisen since, none of it would have been feasible on that scale.

[elsiegee40]

Thanks, good to know. I wonder how it would be to work for a Head who'd had a sysadmin background?

 

Would be interesting considering that with the amount of full-time teaching experience needed to reach Headship, I'd imagine they wouldn't have been doing much sysadmin work since about... the 80s/90s?

 

I have been "booted upstairs" and am still 'in the know'. I try to stay out of anythjng technical unless my replacement asks me to do so. I have resist the temptation to use my knowledge... though, when I report an issue, I have usually worked out the solution too I agree that some technically trained leaders may find it harder to restrain themselves though.

[Ephelyon]

What was your position? Just occurred to me I've never asked

[Get2theChoppa]

Just an aside: My account is a member of the Administrators, Domain Admins, Domain Users and Staff groups, but there are still some functions that I can only use under the built in administrator account. I use my account for most admin activities on the server, but the built in account when computer says no. We buy support services from our LA and they have access to and sometimes use the built in account too, for the same reason.

 

I have tolerated that on the basis that there is a trail of the fact that my access can be tied to my machine and that someone else does need access in case I am not available. Is there a permission that I can give myself, so that I can close this loop hole?

 

 

add yourself to enterprise admin also!

[ryoung]

For a balanced view on getting the balancing act between SLT and NM right I strongly recommend What Heads Need to Know about ICT