Electronic Registration (a new one!)

[Tiger]

benIT: "We recently has a goverment audit team in school for a week solid, looking at the finest detail of school operations - finance, Disaster recovery plan etc, they were very thorough (we heard same stories from other schools in the area). My question is why would such a audit not reveal the single network being a problem?"

 

I assume you are referring to Ofsted -yes? Aren't you giving too much credit to Ofsted's technical skill set for such specialist area? Even on this forum technical spacialst are having difficulty agreeing on the basic principles of the issues.

 

I am not happy to repeat my reference to Northern Europians and Australians but it appears that I have to. What goes against my grains is that what is not good enough for Northern Europians as if should it be OK for Brits. For Civil Liberties and Data Security/Protection and Privacy Laws, just like Health Care and Health and Safety, in the UK we appear that we have to put up with the 2nd rate standards!! Despite excuses for lower cost, simplicity or flexibity, they simply do not allow 'flat networks' in schools due to high risks schools will have in data security breach - why would we allow this in UK.

 

It is up to Network Managers and SMT to aim at better because they we are responsible for complying to Data Protection Act in the schools and not DCSF or LA. Please check this with your Headteacher or Bursar.

 

PLEASE CHECK IT OUT: DCSF's policy on Data Protection relies on schools yearly returns which include declaration on BS7799 for Data Security. Then on DCSF passes the buck onto BECTA saying that BECTA is responsible for providing guidance to schools on IT Data Security. And yet BECTA guidelines on IT Infratuctures has no reference to BS7799 on Data Security. So if there is a breach, the buck stops with the school - ie Headteacher/Bursar and Network Manager.

 

This is why many of us take Data Security and 'two network solution' so seriously.

[DMcCoy]

All of sudden it appears as if decision on 'flat networks' vs "isolated networks" has become a personal choice or throw of a dice. Far from it.

 

As a network manager and school SMT one needs make a decision on the basis of:

1. Strict requirements to comply to Data Protection Act by the schools

2. Implied recommendation by DCSF/Becta to comply with BS7799 as data security standard

3. Take a good look at existing guide for education establishment http://www.ucisa.ac.uk/ist/agree/

4. Use your own professional judgment in protecting 'vulnerable part of community' (ie children) for any consequence of infringment of data security against them.

 

And good luck.

 

From the ucisa page "as a starting point from which to derive a set of policies

appropriate to higher and further education."

 

This means the documentation isn't aimed at most of us. I simply do not have the time or the money or staff to split networks in a totally secure way, the requirements placed on me by the school for what information they want available and where makes it almost imposible.

 

Taking MIS as an example, to use it for registration the teacher will require access to it in the classroom. Now you have introduced a weak point in the seperation of networks, you have a terminal with access to the admin network within the classroom. I would also point out that parts of bromcom are only authenticated using a quick ntlm check against a domain, so it doesn't ask for a username and password serperately and of course also needs access to the admin domain in the classroom, as does sims.

 

The government and becta give out huge amounts of recomendations, which they faithfully ignore themselves too. We are often instructed to send our broken databases on a CD in the post for example.

[localzuk]

I assume you are referring to Ofsted -yes? Aren't you giving too much credit to Ofsted's technical skill set for such specialist area? Even on this forum technical spacialst are having difficulty agreeing on the basic principles of the issues.

 

I am not happy to repeat my reference to Northern Europians and Australians but it appears that I have to. What goes against my grains is that what is not good enough for Northern Europians as if should it be OK for Brits. For Civil Liberties and Data Security/Protection and Privacy Laws, just like Health Care and Health and Safety, in the UK we appear that we have to put up with the 2nd rate standards!! Despite excuses for lower cost, simplicity or flexibity, they simply do not allow 'flat networks' in schools due to high risks schools will have in data security breach - why would we allow this in UK.

 

It is up to Network Managers and SMT to aim at better because they we are responsible for complying to Data Protection Act in the schools and not DCSF or LA. Please check this with your Headteacher or Bursar.

 

PLEASE CHECK IT OUT: DCSF's policy on Data Protection relies on schools yearly returns which include declaration on BS7799 for Data Security. Then on DCSF passes the buck onto BECTA saying that BECTA is responsible for providing guidance to schools on IT Data Security. And yet BECTA guidelines on IT Infratuctures has no reference to BS7799 on Data Security. So if there is a breach, the buck stops with the school - ie Headteacher/Bursar and Network Manager.

 

This is why many of us take Data Security and 'two network solution' so seriously.

 

The problem as I see it is this:

 

Schools simply don't get the funding to maintain a seperate network infrastructure. This would require 2 sets of switches, 2 sets of servers etc...

 

What about physical security? Would your comments on BS7799 (which I might point out, pretty much no school in the UK will be fully compliant with) mean that cabinets based in class rooms themselves be non-compliant? As there is physical access to that room? If this is the case, our school simply would not have the space to have cabinets in locked store cupboards, so all cables would have to be rewired to a single place where the main cabinet is - at a cost around £100k.What about access to ports? Would there have to be some form of network access control in place also? Much of this technology is outside the reach of most schools - especially primaries.

 

And what about teachers who simply leave their computers unattended with the MIS open? Or have such a session open and let a pupil use it for something? These are situations that happen regularly in schools across the country.

 

Remember, the system is only as strong as its weakest link - the people using it. They *will* have their passwords written on post-it notes, or in their diaries. They will leave their machines unattended. Every school has policies outlining that this is against the rules, along with policies outlining many other rules - many of which are ignored by individual members of staff.

[benIT]

The problem as I see it is this:

 

Schools simply don't get the funding to maintain a seperate network infrastructure. This would require 2 sets of switches, 2 sets of servers etc...

 

What about physical security? Would your comments on BS7799 (which I might point out, pretty much no school in the UK will be fully compliant with) mean that cabinets based in class rooms themselves be non-compliant? As there is physical access to that room? If this is the case, our school simply would not have the space to have cabinets in locked store cupboards, so all cables would have to be rewired to a single place where the main cabinet is - at a cost around £100k.What about access to ports? Would there have to be some form of network access control in place also? Much of this technology is outside the reach of most schools - especially primaries.

 

And what about teachers who simply leave their computers unattended with the MIS open? Or have such a session open and let a pupil use it for something? These are situations that happen regularly in schools across the country.

 

Remember, the system is only as strong as its weakest link - the people using it. They *will* have their passwords written on post-it notes, or in their diaries. They will leave their machines unattended. Every school has policies outlining that this is against the rules, along with policies outlining many other rules - many of which are ignored by individual members of staff.

 

I could not agree more localzuk, Physical access is now a big news item for security, I have seen numerous articles about firms beefing up pysical access, So much so banks often had more money lost from cash machines being pulled away from the wall by vans and chains, than by network breaches (not including identity theft!)

 

I think however tiger has a good point, that in an ideal world we in the UK should not be such a push over on being "politically correct" or accepting "less value" but in the realword, or todays world, we need to access everything from everywhere - this is what people are expecting more and more......Example: .... How annoying is it when you can not get mobile signal - we just expect it should always have one .... truth is we could walk to a phone box but we dont....because we expect anytime anywhere access

 

Back to my point, this is why networks are merged, this is why banks, NHS, Councils, Goverment, MI5, you name it all have shared networks RING FENCED by security.... This is the solution for schools, in a nutshell - Keep it secure to modern day standards thats all their is to it!!! Then this provides access when users expect and need it!!!

[FragglePete]

Well, this is turning into an interesting discussion.

 

I've come from a MoD background were they still keep in place seperate networks depending on the security level.

 

Here, the networks aren't really seperate, just two seperate Domains existing on the same infrastructure. Either way does not bother me at present. Other Schools in this area are moving over to Single network structures, whereas I hear that some schools are wanting to get back to two networks.

 

Anyway, the original topic of discussion was Electronic Registration, and with some more investigating I'm impressed with the SIMS Online Learning Gateway demonstration which really does what we need; Access to Electronic Registration via a web interface (ie. Sharepoint). We've still got to look at a mobile/off-line solution but this is looking promising.

 

Let the debate continue..... ;-)

 

Pete

[benIT]

 

Anyway, the original topic of discussion was Electronic Registration, and with some more investigating I'm impressed with the SIMS Online Learning Gateway demonstration which really does what we need; Access to Electronic Registration via a web interface (ie. Sharepoint). We've still got to look at a mobile/off-line solution but this is looking promising.

 

Let the debate continue..... ;-)

 

Pete

 

Pete,

 

Sorry for the Off-Topic, I guess we all go off on one now and then

 

Further information to the electronic registration and mobile access; this is an idea in my head that I plan to test:

 

When we get the SIMS webparts, we can access registers from any Internet enabled device. To save money buying the PDA module and PDAs etc, I am going to use the new EEEPC (I think someone has discussed previous). This then allows for cheap access as the devices are only about £169 each!!!

 

Also Sims do not have a PDA option out for Assesment marking, so the webparts would allow a mobile option straight off!!! At no additional cost, apart from the $$$$ webparts!

 

I understand Capita are looking into solutions for offline use, worth keeping in touch with them!

 

Cheers

 

Ben

[FragglePete]

Pete,

 

Sorry for the Off-Topic, I guess we all go off on one now and then

 

Further information to the electronic registration and mobile access; this is an idea in my head that I plan to test:

 

When we get the SIMS webparts, we can access registers from any Internet enabled device. To save money buying the PDA module and PDAs etc, I am going to use the new EEEPC (I think someone has discussed previous). This then allows for cheap access as the devices are only about £169 each!!!

 

Also Sims do not have a PDA option out for Assesment marking, so the webparts would allow a mobile option straight off!!! At no additional cost, apart from the $$$$ webparts!

 

I understand Capita are looking into solutions for offline use, worth keeping in touch with them!

 

Cheers

 

Ben

 

Thanks for the info. All useful stuff atm. Just been told that they want this up and running by July now for 'staff training'!!! Teach me to show my Line Manger that demo; she went off and showed it to other SMT members and now they're getting all excited!!!

 

Pete

[Tiger]

Pete: I've come from a MoD background were they still keep in place seperate networks depending on the security level.

 

Anyway, the original topic of discussion was Electronic Registration, and with some more investigating I'm impressed with the SIMS Online Learning Gateway demonstration which really does what we need; Access to Electronic Registration via a web interface (ie. Sharepoint). We've still got to look at a mobile/off-line solution but this is looking promising.

 

Just been told that they want this up and running by July now for 'staff training'!!! Teach me to show my Line Manger that demo; she went off and showed it to other SMT members and now they're getting all excited!!!

 

Hmmm MOD background... interesting! You have a greta deal input you can provide on data security approaches. Of course schools data security requirements /standards do not need to meet military level.That is why DCSF Data Protection annual returns refer only to BS7799.

 

Electronic Registration: Indeed- this is the 'killer application' that unless you chose the right product

(A) You will be forced to go 'flat network'

(B) You will need to open SQL port on Admin Server to Curriculum Network and in case of web parts also you will need to open 'port 80'. Hence raisiing the very core issues discussed here ie Data Protection Act, BS7799 etc.. Enough is said on this - you just have to make up your own mind.

 

On practicality - running by July?? Under a different thread (Web parts), you will find that SIMS Web parts run very slowly like a dog and Capita has taken it back to drawing board. You need to ask for reference site of schools using Web parts to take attendance. I never heard this before.

 

I read that you are new education/schools software and have MOD background. In schools SMT typically gets carried away with flashy demos and they get excited and read so much into it and then they will lexpect you to deliver it!!! I would be very careful with flash demos and would demand to see it in real school situation with an SMT member before your school commits to anything.

 

Again read also under different thread use of PDAs for Registration - many are very frustrated. Ask for references. You can't go wrong - because seeing is beleiving.

[localzuk]

We gave up on electronic registration for the following reasons:

 

1. No offline registration option that suited us at the moment. This means that we'd have had to install a wireless network, or PDA's would have to be set up to synchronise with desktops.

2. Fire alarm preparation - if the fire alarm goes off, we want access to registers instantly. Using the electronic method meant still having to print off registers after registration.

 

So simply put, full electronic registration is not suitable yet.

 

It took us roughly half a year to test out, and then was implemented via standard laptops with the attendance module in SIMS.net for a term before being scrapped.

 

We do have access to learning gateway (webparts) but it is a) poorly designed and b) slow. So it gets very little use.

[Tiger]

Localzuk: "It took us roughly half a year to test out, and then was implemented via standard laptops with the attendance module in SIMS.net for a term before being scrapped.

 

We do have access to learning gateway (webparts) but it is a) poorly designed and b) slow. So it gets very little use".

 

This is the good about this forum - you get plenty volunteers to share their experience. Many thanks.

 

This matches the impressions I had and in fact is worse than what I heard. Then not surprising - VLE has been the biggest white elephant experience and very expensive!) for so many school - but that is a different subject.

 

Localzuk: " We gave up on electronic registration for the following reasons:

 

1. No offline registration option that suited us at the moment. This means that we'd have had to install a wireless network, or PDA's would have to be set up to synchronise with desktops.

2. Fire alarm preparation - if the fire alarm goes off, we want access to registers instantly. Using the electronic method meant still having to print off registers after registration.

 

So simply put, full electronic registration is not suitable yet."

 

Surprise to hear this.

 

Perhaps in turn you can get help from this forum - pls check John Condon's entries. He is also one that is against 'flat networks'.

 

From his past decriptions his company Bromcom seems to have answers to both of your concerns. (1) PDAs working wirelessly with server (not desktops) and (2) And proper firedrill facility.

 

Let us know your views.

[localzuk]

We won't use Bromcom I'm afriad, too many bad stories from other schools in the area. And my manager refuses to use it.

 

We don't have a wireless network - and we aren't going to get one anytime soon.

[FragglePete]

Hmmm MOD background... interesting! You have a greta deal input you can provide on data security approaches. Of course schools data security requirements /standards do not need to meet military level.That is why DCSF Data Protection annual returns refer only to BS7799.

.

 

I could tell ya, but I'll have to kill you! Sorry, no seriously security was taken extremely seriously. Except those idiots who loose laptops, which I'm a bit perplexed by as we had clear direction that all mobile devices had to have some sort of encryption product installed. Our site used Flagstone which was a hardware encryption product which rendered the hard drive data useless if password was entered incorrectly more than three times.

 

As for networks, well, all MoD networks are seperated depending on classification, but generally the 'less secure' were all hooked to the Internet centrally by an Internet Gateway Service run by various agencies. If it was internet connected in anyway, it had to go through this service, no ifs, no buts.

 

Part of the reason for me leaving is I had no freedom to do what I wanted to do. We couldn't just add a 'server' for a particular task without months of waiting and costing and then just being told 'No!' by EDS. Stuff that! ;-)

 

 

On practicality - running by July?? Under a different thread (Web parts), you will find that SIMS Web parts run very slowly like a dog and Capita has taken it back to drawing board. You need to ask for reference site of schools using Web parts to take attendance. I never heard this before.

 

I read that you are new education/schools software and have MOD background. In schools SMT typically gets carried away with flashy demos and they get excited and read so much into it and then they will lexpect you to deliver it!!! I would be very careful with flash demos and would demand to see it in real school situation with an SMT member before your school commits to anything.

 

It wasn't a 'flash' demo, but an actual live demo running from Capta's website which was essentially just a Sharepoint Server connected to a demo SIMS database. I find the Capita website slow anyway, but generally the guts of what we needed seem to run ok. I'm still investigating.

 

Yeah, I laughed when they mentioned July.

 

Pete

Edited February 17, 2008 by FragglePete

[nomad]

benIT - You said "We recently has a goverment audit team in school for a week solid, looking at the finest detail of school operations - finance, Disaster recovery plan etc, they were very thorough (we heard same stories from other schools in the area). My question is why would such a audit not reveal the single network being a problem? "

 

Would this audit be an OFSTED inspection or something like the Financial Managaement Standard in Schools (FMSIS) audit which would be looking at compliance with DCSF accounting standards? If it is then no surprise that they would not look at the single network problem.

[Bromcom_John]

From his past decriptions his company Bromcom seems to have answers to both of your concerns. (1) PDAs working wirelessly with server (not desktops) and (2) And proper firedrill facility.

 

Absolutely correct.

The system is ground up designed to utilise wireless technology and has the facility for offline Firedrill which does not rely on a current connection to what could be a burning network. In fact the whole spectrum of associated registration tasks (Markbooks, Behaviour monitoring, off site registration) can function with little or no live connection to the network. Heck, the newer products can take your classes register while your in Florida if you are feeling so inlcined (and have taken your tutor group on a field trip to the Universal Studios)

The PDA's can be set up to run via a dedicated Radio network or Industry standard Wireless networking.

 

@Localzuk - Sorry to hear you've heard less than stellar news. I'd love to get the chance to defend our side but this thread is not the place (theres been enough offtopic derailing already )

[benIT]

NoMad,

 

I can not recall, but will dig around, think it was relating to finance, but the main chunk of that was relating to keep data safe. I think we have established the main pos / neg for split /merge.

 

It wasn't a 'flash' demo, but an actual live demo running from Capta's website which was essentially just a Sharepoint Server connected to a demo SIMS database. I find the Capita website slow anyway, but generally the guts of what we needed seem to run ok. I'm still investigating.

 

Yeah, I laughed when they mentioned July.

 

Pete

 

I think we all know Capita is far from perfect!! I would also be keen to see how fast the webparts are for a self hosted solution, Like you all say the capita demo site was very slow. We did some of our own SQL lookups on SIMS data (for testing whats possible) this loads in seconds!! Eg Room/Pupil/Staff Timetable loaded in about 2 seconds!

 

That said if capita can not match this speed this will be a real issue, I hope it wont come to this, only time will tell.

[asherman]

We have used Bromcom for about 5 years with no problems. I especailly like their Winfolder system which allows teachers to do the register using their laptop or PC on the school network system - no wireless system required. You can also add the students behaviour and access messages for the teacher or the student, as well as viewing historical information. When needed their helpdesk support is much better than capita can provide.

[Bromcom_John]

Thanks you for the compliment, I'll pass it on to the Northern Support team.

I thought I'd add a little bit of new information to the discussion.. This is an excerpt from a circular distributed from BECTA on the 18th, from Dr Stephen Lucey, Becta Executive Director, Strategic Technologies.

 

"Recent high-level security breaches concerning loss of personal and sensitive information have highlighted the need to update information security guidance.

 

Suppliers – particularly management information systems, technical support, connectivity and learning platform providers – have an important role to play in helping schools to meet their responsibilities for data security. This may be simply to reassure school leaders that appropriate security mechanisms are already in place and make sure that they know how to use them to greatest effect. They may also ask you to review their security mechanisms and policies, and recommend or implement any necessary improvements. "

 

So it looks like the debate on adapting 'flat networks',Admin-curriculum seperation, opening servers SQL port or 'port 80' to curriculum network etc. and the risks (or lack thereof) has definitely spilled beyond Edugeek

 

(As if anyone had any doubts that it hadn't )

[jenny_urey]

Dear Users

I have worked in a school that uses lesson monitor and am currently working in a school that uses PARS. We use PARS for both attendance and all our behaviour logging. To be honest i find PARS alot more flexable and easier to use. Upgrades take seconds, installs take seconds and the staff find it so easy compared to SIMS modules. I very rarely have to train staff even new staff for more than ten mins before they have picked it up.

I found that lesson monitor to very very rigid and when problems occur they seem to be quite complex to repair.

 

Hope this helps by all means you can come and see our system.

 

Unable to answer the thread however this may help as its a quote from one of our schools.

 

Thanks

[Quackers]

I know pars are working on a web based version of pars, which might be of interest to you, called pars connect.

[jenny_urey]

Following on from Quackers.. PARS connect has now been released following a couple of months of testing by a few of our schools. Initially it enables teachers to log on remotely for attendance, behaviour and grading. The option for parents to log on and see their individual students data will be available shortly in line with the 2010 requirements.