[sims] Malicious removal of data

[Obee1]

Hi all,

 

Sure I have queried this with our support at our LA, but does anyone know of a "change log file" that records all actions in Sims? We have had a couple of incidents of behaviour incident reports being malicously removed. I want to try and track down who has removed them.

 

Anyone got any ideas?

[PhilNeal]

Sorry we don't track access to the behaviour area.

[tombry]

I'd love this as well, as I have my suspicions as to who is removing BIs for students, but I can't actually prove it because there is no log file.

[pete]

It'd be nice if the permissions sets for behaviour / conduct were a bit more granular, so you could restrict a person/group to modifying just the behaviour incidents they've recorded.

 

If the modification has a consistent trigger, set a trap with the consent of SLT and see what you catch?

[pcstru]

I'd think that in theory, it should be possible to track down changes to any MsSQL table via the transaction logs. In practice I think this would be extremely difficult and time consuming and require expert knowledge of the SIMS schema. (there is some information available on the web on how to re-create deleted records using a transaction log - but it doesn't deal with identifying the source of the change).

[jinnantonnixx]

You could add a trigger to the behaviour table to write the SQL user, IP, date&time, action (Insert/Update/Delete) to a logging table when a value is changed.

All unsupported, of course.

So don't do it.

[tombry]

It'd be nice if the permissions sets for behaviour / conduct were a bit more granular, so you could restrict a person/group to modifying just the behaviour incidents they've recorded.

 

If the modification has a consistent trigger, set a trap with the consent of SLT and see what you catch?

 

edited to remove potentially slanderous comment

 

we have 3 different reasons why BIs go disappearing, only one of which acceptable in my mind - the teacher who gave the points gave too many - and those are typically replaced with a lower level incident.

Edited March 3, 2014 by tombry

[vikpaw]

We've asked for an edit (own) permission for ages, i'm sure the CRs all got wiped out in the spring clean. I'm sure we raised it when they asked for feedback on a polishing project a while ago, but i don't see that anything was changed.

 

It's a really big deal, and unfortunately, the most you can track is when people have logged in. Sysman 6 is a little better at looking at which module was accessed, but there is no real auditing of changes, so you could at best narrow down the time window, and maybe the IPs used, but it's not worth the effort if you need hard evidence.

[Greg]

With Head's approval, put key loggers on the suspected users machines

[vikpaw]

With Head's approval, put key loggers on the suspected users machines

 

Unless it's the Head doing it of course, in which case it is inherently approved by policy and SIMS should be lauded for allowing it.

[vikpaw]

For those suffering from changes: it should record the member of staff involved. At least if done through the register, which is the best way to do it. It also records the lesson info. So for new entries there should be some record.

 

If someone then alters it, you can at least ask the originator if that is what they expected and then make a public issue of it, or start with manglement and then push out from them. It's up to them to re-inforce the professional behaviour.

 

It they get removed totally, before a backup is done, then it's not gonna be trackable. Unless, does anyone know if there are any traces left from a delete. I'm pretty sure not, but there might be. Could be worth scouring the SQL tables if it's a big issue.

[GREED]

How often is this happening and at what intervals?

 

It is a rubbish solution but you could set up a nightly report to pull behaviour records, then when you have evidence and a time scale of when changes occurred, you can at least round it down and begin to look at the access logs to see who was logged in at that time.

 

Like I say, not the best or nicest solution, but is a start.

[PotNoodleTech]

Sorry we don't track access to the behaviour area.

 

See. This has been building up inside me for a while....... WHY??!!!!!!

 

I would have thought a Management Information System which contains a) legal data and b) lots of data which falls under the data protection act, would be one of the main priorities for accurate tracking of access and usage?

 

I just don't understand.

 

Cheers.

[PhilNeal]

We do track changes to attendance data which is statutory and assessments. Tracking behaviour is not a statutory requirement and deletions are not tracked; auditing is a matter of balance and at the time we implemented behaviour, did not consider tracking to be a high priority.

 

Several schools have reported suspicions that data has been tampered with. We will consider introducing auditing in the future.

[GREED]

We do track changes to attendance data which is statutory and assessments. Tracking behaviour is not a statutory requirement and deletions are not tracked; auditing is a matter of balance and at the time we implemented behaviour, did not consider tracking to be a high priority.

 

Several schools have reported suspicions that data has been tampered with. We will consider introducing auditing in the future.

 

Cough cough SIMS 8...

[PhilNeal]

Can't comment but it won't be this year!

[PotNoodleTech]

Thanks Phil.

 

I actually think it's really important to be able to know who updated a record and when. Probably more important than several changes you plan to implement this year (in my humble opinion).

 

We've requested audit info from LEA on several changes over the last year and they've never been able to provide anything. If a member of staff has for example accidentally overwritten some important pupil information - we need to know who that member of staff is so that we can address that training issue and make sure it doesn't happen again. Currently this is not possible as without clear evidence from the SIMS DB - we can't do anything. (witch hunt aside)

 

If there was a data protection or legal situation, we've got no ammo from the SIMS DB on who did what. Whoever did that - is free to carry on with impunity. That's a dangerous situation!

 

Cheers

Edited March 5, 2014 by PotNoodleTech

[vikpaw]

We do track changes to attendance data which is statutory and assessments. Tracking behaviour is not a statutory requirement and deletions are not tracked; auditing is a matter of balance and at the time we implemented behaviour, did not consider tracking to be a high priority.

 

Several schools have reported suspicions that data has been tampered with. We will consider introducing auditing in the future.

 

But, this has been an issue for ages. It shouldn't need suspicions of data tampering to fix something that when presented to a typical cross section of users, they would all agree it's useful to have tighter controls on.

 

http://www.edugeek.net/forums/mis-systems/79985-sims-behaviour-management-somewhat-flaky-2.html#post720618

and the next post too.

 

I think Detentions has a Delete (Own) permission now - not sure when that got added, it would be great to have the same for behaviour, and if possible an Edit (Own) for both.

It's not specifically auditing that is required, just some extra logic for whether or not a user can edit data. The procedures are in place to check for global edit / delete rights, they just need extending to be specific to a particular user. If the record has an owner / creator field, then it should be possible without needing to change the structure.

 

Edit: I know this doesn't necessarily tell you who edited / deleted the data, but that would be the next step to add, if possible. I can see how that would possibly need extra columns in tables. In the first instance though and i think for many users being able to restrict the ability to mess with the data would be all that is required.

Edited March 6, 2014 by vikpaw
clarify point

[chrisateen]

I think Capita needs to make it a priority to add such feature into SIMS. All MIS systems should have an audit trail.

 

I also had instances where things have gone missing and I have nothing to find out why it went missing.

[woodham]

I have raised this with capita for the last 8 years every year we ask can we have a proper audit trail whrer things are written into the db under the users name and not "sims user" so we can find out if errors are user error or code error and every year we get no response . I think it will not happen as it would require capita to do a full ground up rebuild of all the sims code

[vikpaw]

..,capita to do a full ground up rebuild of all the sims code

 

Well that is happening but for a different purpose altogether

[woodham]

just seen that thread so maybe just maybe well get a proper audit trail .... heres hoping

[vikpaw]

just seen that thread so maybe just maybe well get a proper audit trail .... heres hoping

It would be rather disingenuous if they omitted it from a fresh build, so i'd keep them hopes high

[simpsonj]

I seem to be doing a lot of necro thread raising lately, but did anything come out of this? I assume not as SIMS 8 hasn't been released yet, but thought I'd ask

[PotNoodleTech]

I've been waiting for it for 16 years so I wouldn't hold your breath!