What No Audit trail ?! - Safeguarding

[SwedishChef]

Just had to call CapitaEs support, we have an urgent need to see what records in sims a user has accessed.

(this may even escalate to local law enforcement)

 

However I am told that the biggest educational MIS system in schools (SIMS) cannot log an audit trail of

access, it only logs when a users logs in or out. -WHAT?!

 

I'm then given some feeble reason that it is due to how large the product is and the storage

requirements that it would generate.

 

Modern systems can log 1000's of records in seconds,and there are a number of ways/mechanisms this

can be done. even if sims just logged the area of sims they went into and what was typed in search bar

etc.

 

eg:Our school filtering system can log every access of the internet proves that high volume transaction

records can be logged 100's per hour instead of 100's (there are other examples too) this reason is purely

not good enough, and I suspect the real reason will be development costs versus marketable benefit.

 

I'm baffled....well actually I'm not, I'd rather people were up-front.

 

@PhilNeal - I'd really like your input on this. :-)

 

Anyone else have an opinion on this ?

[FN-GM]

I'm then given some feeble reason that it is due to how large the product is and the storage requirements that it would generate.

 

That should be upto the school to decide if they wish to turn on the feature and invest in the storage.

 

i must admit its odd how they can't offer this option.

[PhilNeal]

@SweedishChef I'll check out your case.

 

Data storage today is very different to when SIMS7 was designed and we are currently re-engineering everything without too much concern over space.

[FN-GM]

@SweedishChef I'll check out your case.

 

Data storage today is very different to when SIMS7 was designed and we are currently re-engineering everything without too much concern over space.

 

The new big version of SIMS is years of yet though isn't it?

[markwilfan]

I've always wondered this too

[howartp]

The option is there in current SIMS but it's turned off by default.

 

Tools > Data Change Management I think.

[SwedishChef]

@SweedishChef I'll check out your case.

 

Data storage today is very different to when SIMS7 was designed and we are currently re-engineering everything without too much concern over space.

 

Thanks Phil, I would appreciate that. Case number 1602-3448972, although I'm not sure what can be done in this instance.

 

On your comment I don't think the storage is the issue, there's cheap enough storage and SQL is more than capable of being scaleable. It's pure functionality.

 

I'm sure it would be a massive task to implement given the size of the product, but I feel a given the market share capita has (which stems from the LEA days)

a duty of care is needed and at the minute it fails this, maybe the government could help with funding the changes needed to safeguard the students ?

(I'm sure it's a nice sentiment that would be laughed at)

[synaesthesia]

This has come up before, and it's also something we've wondered about and wanted here too. Storage isn't an excuse and frankly hasn't been a viable excuse for the last decade. Let's face facts here - yes SIMS is large, but even with an audit trail available on every database change it wouldn't touch the logs of, as example, Impero for a typically sized secondary school which manages to log users, computers, websites, file tracking, usb tracking. They had to make a change in one of the major versions to go from text logging to database/SQL logging but that would have been natural development anyway. So yes, it is odd that it hasn't already been part of SIMS for ages.

[Quackers]

@SweedishChef I'll check out your case.

 

Data storage today is very different to when SIMS7 was designed and we are currently re-engineering everything without too much concern over space.

 

Is it being re-engineered to a web app so we can run it on a range of clients from iPads, Linux, Mac or will it be requiring a Windows client again?

[FN-GM]

The option is there in current SIMS but it's turned off by default.

 

Tools > Data Change Management I think.

 

That's only changes. It doesn't log who accessed what.

[localzuk]

I posed a similar question almost a decade ago on here somewhere. It was rather alarming then and is still alarming now that it doesn't have this functionality.

 

Our internet connection handles 10s of thousands of connections per hour. It generates logs that are, quite frankly, tiny. To the extent that we happily keep 6 months worth of them. The logs for an MIS would be minuscule in comparison.

 

Yes, SIMS7 is now a relatively old product, but with all the changes that have been made in the last decade, it can't be used as an excuse for this not being a capability of the software.

[pete]

^ Yup, there's been a lot of threads about it over the years, usually when some sysadmin has had to help an investigation into potential staff misconduct.

 

Responses from Capita have been either "ooh, it's really tricky" or "we'll get round to it sometime.......ooh look a ferrari *runs*".

 

There's a decent news article to be written about most schools inability to meet their data protection obligations as a direct result of using the most mainstream MIS provider.

[PotNoodleTech]

This comes up again and again over the years and nothing ever gets done. All I want is a Granular log On/Off option for each type of data/log and a "save logs to" field so that we can decide what we log and what we leave alone. That would be great.

[tomo1095]

Totally agree with you! I once logged a support call for this very reason, thinking it would be quite simple and was utterly baffled that they never included it.

 

The annoyance comes when SMT think it's just you being awkward and not wanting to spend time to figure out how to access such logs.

[GTX]

When you say SIMS is large.. How large we talking for a medium sized school?

[PotNoodleTech]

Not very large in the grand scheme of SQL databases - about 5GB - 10GB for a Secondary school usually.

[bossman]

@SwedishChef

 

There is an access log under Focus>System Manager>User Access Log

 

I haven't used it for ages but it is there still, don't even know if it functions now, give it a whirl

 

 

Scratch that! just been on and it just gives access times to the Sims from that particular workstation, sorry,

 

Trying the other way from inside the system manager but it just seems to hang!

 

Sorry for wasting your time

Edited February 2, 2016 by bossman

[Barcrest]

Has that LOG in system manager 6 ever worked?

[PhilNeal]

@SwedishChef & others thanks for sharing your views on this.

 

SIMS does not audit access views. The approach we have taken is to provide access controls to data areas which are then available to schools to assign. Since schools vet their staff, and we are rarely asked to provide anything further, we have considered this to be adequate but we regularly review this position. Schools frequently tell us about the functionality they want in SIMS and audit trails have not often been a priority.

 

New data protection laws are being drafted that will be available for viewing shortly for implementation in early 2018. Data access auditability may well become a requirement, and if so, we will update SIMS accordingly.

[FN-GM]

[MENTION=788]New data protection laws are being drafted that will be available for viewing shortly for implementation in early 2018. Data access auditability may well become a requirement, and if so, we will update SIMS accordingly.

 

So basically you will only do it when you have to?

[PhilNeal]

Or the change request system indicates that there is a strong desire for it.

[localzuk]

The change request system is, quite frankly, flawed.

 

There have been occasions where a change request has been posted, and without the direct link/ID, it has then been impossible to find. I've seen occasions of duplicate requests (by different people) with votes on each, but in total none of them were particularly highly ranked. Not to mention, how many schools actually use the change request system? Many schools don't, as they rely on support teams to do all the work for them, and some LEAs have even been against schools having access to the support site in the past.

 

It reminds me of this:

 

“But the plans were on display…”

“On display? I eventually had to go down to the cellar to find them.”

“That’s the display department.”

“With a flashlight.”

“Ah, well, the lights had probably gone.”

“So had the stairs.”

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

 

 

Let's put it this way - a search for "marksheet", "discover", or "msi", using the last 5 years turns up zero responses. I *highly* doubt that there's not been a single change request with those 3 terms in 5 years!!

Edited February 3, 2016 by localzuk

[CyberNerd]

The change request system is, quite frankly, flawed.

 

I recall a time where change requests were just deleted if the Capita support teams didn't like them. Does this still happen?

[psydii]

https://technet.microsoft.com/en-us/library/dd392015(v=sql.100).aspx

 

Ok, so not a one click option...

[pete]

Or the change request system indicates that there is a strong desire for it.

@PhilNeal Given that your change request system hosts duplicate requests for the same thing (one example):

 

1510-3406555

1311-1230629

1509-3384283

1209-1138593

1502-1360267

1302-1170976

1406-1309692

 

how confident are you that whoever's considering change requests to take forward is actually going through and aggregating similar requests when considering the demand?

 

Or better yet, why doesn't the "new change request" form default to a "search to see if anyone else has asked for something like this" form, the same way opening a case does?