Securing a Web-based MIS system (WCBS 3Sys) with Two-Factor Authentication

[flyinghaggis]

We've been asked to make the schools MIS system (WCBS 3SYS) available to staff whilst they're away from school working remotely. The system is web-based so it's straightforward enough to publish it to the world over HTTPS.

 

However, some staff have expressed concerns that a single username/password for the system isn't as secure as it needs to be given the sensitivity of the data (pupil/parent/staff personal information) stored within it. Given these concerns we've been looking at potentially using a 3rd party service like Incapsula to secure the system with two-factor authentication. At least that way if someone does manage to get their hands on a member of staff's password it alone won't get them access to the database.

 

The system seems to work by basically changing your DNS to point at the Incapsula's servers and they then act as a gateway, and secure login, for accessing any internally hosted systems. I've noticed a few other providers offering similar services most of which seem to work the same way.

 

Has anyone used Incapsula or any similar services to secure internal websites? Are there any other options for securing an internal web database published over the internet that would be worth looking into?

 

 

https://youtu.be/bHoRPeW24n4

Edited September 22, 2016 by flyinghaggis

[HC_Netman]

We use Swivel Secure - up until now we have had a server onsite but are moving to their cloud platform over the next few weeks.

 

https://swivelsecure.com/

[flyinghaggis]

We use Swivel Secure - up until now we have had a server onsite but are moving to their cloud platform over the next few weeks.

 

https://swivelsecure.com/

 

Do you know what kind of pricing we'd be looking at to secure a onsite web database in order for 200 staff to access it using 2-factor authentication via SMS text or an app like Google Authenticator?

 

We were just about to go live with Incapsula but it's looking like we'll need to go for a higher tier package ($300 pcm) in order to support over 50 staff and it's priced per user ($3 pcm) above a certain number. If that's the case it's going to cost far more than we'd initially anticipated and budgeted for. Probably to the point where it's no longer viable to actually use it.

 

https://www.incapsula.com/pricing-and-plans.html

Edited November 22, 2016 by flyinghaggis

[Michael]

Is it any less secure than accessing cloud based e-mail we've used for years? I think enforcing strong passwords is the way to go, with optional 2FA.

[HC_Netman]

We pay just under £6 per user for a year although we may have got slightly different pricing due to the fact we were converting from onsite to cloud. (There maybe an initial setup fee for new users too).

 

Our users authenticate with a Turing Image but only because that is what they are used to. There are options available to use a mobile app or SMS.

[flyinghaggis]

Is it any less secure than accessing cloud based e-mail we've used for years? I think enforcing strong passwords is the way to go, with optional 2FA.

 

It's more from the point of view that the system we're securing will be published directly on the web and contains all of the schools MIS system information (pupils/staff details,etc) so management have asked us to look into ways of securing it beyond just a simple username and password.

 

Though I'm also of the opinion that any web/cloud based system hosting confidential information really needs some level of 2-factor authentication to make it more secure. A simple username/password really isn't enough these days IMO and 3SYS itself doesn't have any method of doing this AFAIK.

 

We pay just under £6 per user for a year although we may have got slightly different pricing due to the fact we were converting from onsite to cloud. (There maybe an initial setup fee for new users too).

 

Our users authenticate with a Turing Image but only because that is what they are used to. There are options available to use a mobile app or SMS.

 

Thanks. Its useful to have a few other options on the table as that's sounding much cheaper than Incapsula.

Edited November 22, 2016 by flyinghaggis