[sims] SIMs.net - Third Party Write Back - Permissions required as Senior Management Team

[Steve21]

Afternoon All,

 

I'm not sure if I'm missing an obvious one here, or whether they're just trying to be funny guys (or majorly failing with their software).

 

But it seems our SLT are in talks to buy a third-party website app that requires Groupcall Emerge access to writeback to SIMs, and requires their access level on their account to be "Senior Management Team" just to write back things linked to SEN/Seating Plans/Behaviour etc.

 

Isn't that bonkers? The amount of access required with that account is more than most SLT members here have :s Let alone a random company... and not that I can even see a reason the company would need that high an access right in the first place from Data Protection point of view.

 

@PhilNeal any thoughts before I give my opinion back to SLT?

 

Steve

[PhilNeal]

I think I'd ask them to list what data they are accessing/writing. The access level does seem high.

Group Call is a partner and our team can assist them if requested.

[bobsmith]

Frequently had issues with third party applications requesting more access than they really need. It's often a case of them asking for the highest access rights to avoid having to specify precisely what they do need.

 

Even more annoying is that after there was a discussion on this forum about the misuse of the UPN I've found a well known third party routinely using it for no good reason!

[36Degrees]

Groupcall tell you that it needs that level of access by default so it may be worth investigating / asking the question of what it actually does. The first software we used with it I could reduce the access levels quite significantly but unfortunately not the most recent.

 

You need to make SLT aware of the issues and ensure that you get a statement from Groupcall about their security mechanisms (all in writing of course!).

[Steve21]

Don't have any issues with with the Groupcall side of it, it's more the fact the 3rd party insist on the SMT account for "their" access which seems dumb :s

 

Got a call in with their dev team today though to confirm

 

Steve