[sims] SIMS 8 Press Release 30th March 2017

[mthomas08]

"@Michael I'm just curious really @PhilNeal - why are Capita (the biggest MIS provider) the last to the table?"

Getting timing right on a change of this magnitude is hard. Pearson were first into the cloud but went too soon and exited the UK MIS market because the technology just wasn't ready. Judging by comments on this web site there are others that entered too soon as well. There is churn in the market so whilst we lost some schools last year a number of state schools moved to SIMS from other suppliers so there are interesting dynamics in the market.

Site rules means I cannot market but hopefully the mods will permit this comment - we are not building SIMS7 in a browser; this is a fundamental rethink taking account of input from our users.

 

I can personally vouch on this one. It takes years to develop something for everyone just to do a u-turn. Look at VLEs, a government forced idea which half pulled the plug on it when a new PM came along. I know a ton of Schools that are still now completely hesitant to go Cloud based not just because of change but having low broadband capacity/availability. I'd never string anyone up for taking the leap or not out of fear of wasting ones time. For us, it's a good option going forward and if it scrapped the idea of an internally housed SIMs.Net it's even better. At some stage we will have to consider replacing the server - something I am not looking forward to.

 

Cloud is on the table for us like many but again I won't string anyone up for not taking the leap because there is no magic bean instead it will work for some and not others.

 

As for SIMs, I can see us going to 8 as soon as possible.

[Jehanzeb]

@Jehanzeb - lots of questions!

 

The security issue is taxing us - do we insist on login in again after inactivity or not? The school & the MIS provider is responsible for ensuring that sensitive data is protected. Getting a secure but non invasive approach is an issue & advice very welcome. I feel that some education is required with staff as fines are eye-watering.

 

With regards to change requests we take them seriously - proof of the pudding, I'm afraid you will have to wait and see as talking about them is promotion.

 

With regard to "modules" we try make them seamless but we need to be sure that third parties can compete with us.

 

High contrast screens - don't forget that many of our users are older. (Even Sky had to provide a high contrast menu in a recent update!!)

 

As for too much text - you're probably referring to the Options screen - it has been extensively tested by students choosing their own courses. They managed fine!!

 

It's responsive so will perform properly on tablets & is finger friendly.

 

Firstly thank you for taking an active part in discussion Phil. It is nice to see some excellent questions and responses to it. Now with security, how much "secure" is "secure"? and are we making a system secure enough but not useable enough? There are other companies that are handling customer data yet providing single sign on system with ample timeout session. With TeachersApp, we're talking about sometimes as short as couple of hours of inactivity and it asks users to re login with Google/Microsoft credentials and then enter PIN number before the register loads up. I agree with your point of "educating" staff but we need to understand in the School environment, there is limited time from starting in the morning and in the afternoon. Systems should adapt to changes, people needs not other way round, or am I wrong in thinking this?

 

With regards to high contrast, I believe it should be an option and not set as default. Not everyone is "old" and resistant to change.

 

If student A was doing just fine, does it mean student B,C,D ... we're doing fine too? Too many options given to students and you need a dedicated assistant to help them. Students at Primary attract to colourful cartoon characters, moving objects, more often touching and moving them around not lots of text on a single page. Then again the screenshot provided was for GCSE level so it makes sense why it is the way it is...

 

I will patiently wait for new screenshots to appear ��

 

Kindest regards

 

J.

Edited April 1, 2017 by Jehanzeb

[Jehanzeb]

@Jehanzeb Regarding collecting feedback, I received the following response on a case today: "Unfortunately due to the fact we re-visited the way our change requests are processed fairly recently it appears that this request has been lost as we cannot find this issue anywhere on the backlog. As such you will need to re-do the change request via the normal route witch will then be reviewed and actioned".

 

Whilst I get that it costs money to make a change, it needs testing etc, and that some things are hard to implement, it equally should not take over 12 months of nagging to get a 1 line change to a MSI and a 1 character change to a db field to fix 2 bugs.

 

So whilst it's yet to be seen if Capita will insist on a cloud-only approach (or let schools/trusts run a local cloud version if they insist), I assume that the potential of having the ability to be more agile might mean that Capita are able to react faster and respond to issues - which should be a good thing. As the moment I get the impression that the 'legacy' setup they have inherited is holding things back. At the same time, I'm equally surprised we've not seen a mixed approach between the existing app and web-based - i.e. capita introducing a web UI for all teachers to use to take registers sooner (and by that i mean 'free' as part of existing sims offering)

 

I agree with your thoughts there @minimoo . Private cloud would mean Schools can keep their data inhouse whilst providing services to internal users. I also believe the way data recording is done should be looked at as now there are many people/teams involved in collecting recording and producing data for example the new intervention module in SIMS.net, the SEN team collects data and sends it to SEN head, the SEN head then inputs the entire data into SIMS.net, consuming so much of her time. This is because everyone uses Macs and the SEN head is one of the handful people who uses windows based machine.

Collaborative work is way forward and so the new systems should accommodate that.

 

Kindest regards

 

J.

[vikpaw]

For the apps I'd be happy for TouchID (or equivalent) to secure access. Is this possible now?

 

For the web, follow the route banks take with a timeout period that gives you plenty of notice to become active or be logged out. Allowing the school to control this would be good.

 

Ideally it could be configured to have different timeouts for in-school access than out of school, but implementation based on IP / location might be more taxing.

 

A range of options will be useful.

[Arthur]

The security issue is taxing us - do we insist on login in again after inactivity or not? The school & the MIS provider is responsible for ensuring that sensitive data is protected. Getting a secure but non invasive approach is an issue & advice very welcome. I feel that some education is required with staff as fines are eye-watering.

Could you add support for U2F keys? They are dead simple to use and significantly more secure than other methods like one-time passwords. U2F is also unphishable.

 

Websites such as GOV.UK Verify, Google, Facebook, Github and many others already support them. It would be great to see Capita added to that list.

 

This low-cost device may be the world’s best hope against account takeovers

 

The past five years have witnessed a seemingly unending series of high-profile account take-overs. A growing consensus has emerged among security practitioners: even long, randomly generated passwords aren't sufficient for locking down e-mail and other types of online assets. According to the consensus, these assets need to be augmented with a second factor of authentication.

 

Now, a two-year study of more than 50,000 Google employees concludes that cryptographically based Security Keys beat out smartphones and most other forms of two-factor verification.

 

The Security Keys are based on Universal Second Factor, an open standard that's easy for end users to use and straightforward for engineers to stitch into hardware and websites. When plugged into a standard USB port, the keys provide a "cryptographic assertion" that's just about impossible for attackers to guess or phish. Accounts can require that cryptographic key in addition to a normal user password when users log in. Google, Dropbox, GitHub, and other sites have already implemented the standard into their platforms.

 

See also: https://fidoalliance.org/case-study-series-google-security-keys-work / http://fc16.ifca.ai/preproceedings/25_Lang.pdf

 

 

If you could also support Windows Hello for Business, Nexus Imprint on Android and Apple's Touch ID for iOS and macOS that would be fantastic too.

Edited April 1, 2017 by Arthur

[GrumbleDook]

The problem with an object as a receiver or a secure code or as a secure physical object (e.g. U2F keys), the physical access to that object is the risk.

 

In the same way SSO between desktop and MIS is not a good idea (in security terms) as it relies on the user being present, logging out of computers and ensuring no one else has access to the computer when it is logged in, the same applies to secure objects or receiving objects.

 

If a teacher leaves the room then they have to remember to take the key with them, or if using phones to receive / generate secure keys... they have to take that with them.

 

Many folk have their lock screen showing the first few lines of SMS when they come in ... and so you only have to have access to the locked phone to be able to see a code as it is received.

 

Use of SSO and biometrics is the most likely to reduce risk, with the time out against the biometric part of the authentication.

[Arthur]

the physical access to that object is the risk. If a teacher leaves the room then they have to remember to take the key with them

With a password/passphrase as a second-factor surely it wouldn't matter if the teacher forgot to take the key with them (if SIMS did what @vikpaw suggested above and automatically logs out when idle for a short period of time)?

[minimoo]

@JehanzebThe security issue is taxing us - do we insist on login in again after inactivity or not? The school & the MIS provider is responsible for ensuring that sensitive data is protected.

@PhilNeal -

more to the point, given that any company that chooses to process data in the cloud should be ensuring that the cloud provider has implemented appropriate safeguards, and will be jointly liable for any breach.. presumably schools (as data controllers) should be conducting their own risk assessments and asking capita appropriate questions to ensure that they are happy with the appropriate security measures - one legal firm goes as far as saying about getting "personalised contracts with cloud providers". The 72 hour notification period that I believe is required under the GDPR? should also be interesting with schools if a breach occurred at the wrong time - I was trying to get hold of a CTF file on friday afternoon... school i was trying to contact is locked up until after easter now! All I can say is you will need a lot of Good Luck ;/

 

In terms of security and the cloud version - if it's a browser interface - there's two locations staff are likely to access the system:

 

a) from a personal/home pc - which could have any number of viruses on depending on staff. School policy could say that staff shouldn't use their own devices, but only school owned. In this case, there could be a 3rd party keylogger running - the obvious way to defend that is some form of two-factor authentication

 

b) from a school owned device (that should have up to date AV, security settings etc) - either in school or at home. The most likely risk point here is probably that the teacher logs on in a classroom, then walks off, and a student accesses data in the system. Hits copy and pastes and pastes it to a public website.

 

For the 2nd - getting staff to think differently is key - as I don't think there's any difference between leaving the PC unlocked - or leaving your mark-book on the desk of an unlocked classroom - where the markbook has a printout of names<>photos - that is still technically personal data under the GDPR right? If not, you basically need a non-invasive two factor auth with every rest api call system - and if you can invent that, you can probably retire from capita

[vikpaw]

The people responsible have to educate the users.

 

The number of staff I deal with that MUST print out data, it's crazy. No amount of technological safeguards will prevent the weakest element in all our systems.

[Michael]

As they have the largest user base, they also have the largest set of variations of use, so to suit everyone is hard.

 

But also the reality is other MIS companies were quicker to market and have a more complete 'feature set' than the SIMS current offering. I don't think the largest user base is relevant - every school 'core' MIS requirements are the same. It's just some schools use the available options more extensively.

 

Going cloud is just a natural progression, given that I'm old enough to remember MIS systems unique to the Office, but then suddenly it all branched out into the Classroom and more. And again ironically, the majority of schools I've seen typically all have 'bolt-on' Assessment tools and a high percentage of these are web based.

 

Unfortunately I think it's a case of Capita maybe being a little too complacent and now they're playing catch up. If I'm wrong then Capita would have released a cloud offering years ago, or alternatively a hybrid, so at least Teachers can take the Class register nice and easily, but instead you still need the same full fat product installing regardless what it's used for.

 

This is where Advanced Learning got the formula right - CMIS for Office use and e-Portal for Classroom use. They've clearly understood the requirements better and it's 110% easier to place a shortcut on everyone's desktop, rather than deploy the client to every machine that requires it.

[Michael]

"@Michael I'm just curious really @PhilNeal - why are Capita (the biggest MIS provider) the last to the table?"

 

Getting timing right on a change of this magnitude is hard. Pearson were first into the cloud but went too soon and exited the UK MIS market because the technology just wasn't ready. Judging by comments on this web site there are others that entered too soon as well. There is churn in the market so whilst we lost some schools last year a number of state schools moved to SIMS from other suppliers so there are interesting dynamics in the market.

 

Site rules means I cannot market but hopefully the mods will permit this comment - we are not building SIMS7 in a browser; this is a fundamental rethink taking account of input from our users.

 

Yes it's inevitable that some companies will 'try' and enter a market and not succeed (whatever the reason) - technology, marketing, cost or simply technical/development problems or lack of features.

 

You can't deny there are now approx 15 MIS providers which wasn't the case 15-20 years ago. Proportionately Capita lost more schools last year than gained - again whatever the reason, so yes the market is changing, but the point is it's been changing for quite some time.

 

I think it was clear SIMS8 wasn't going to be SIMS7 in a browser for a long time. It would be totally unusable on a tablet or phone. The .NET/MS SQL technology can still be delivered in the background, however the user interface would have to change. There are too many extensive menus in SIMS7 that simply wouldn't work on a tablet. You don't have the same accuracy as you do a mouse.

[Zoom7000]

But also the reality is other MIS companies were quicker to market and have a more complete 'feature set' than the SIMS current offering. I don't think the largest user base is relevant - every school 'core' MIS requirements are the same. It's just some schools use the available options more extensively.

 

Going cloud is just a natural progression, given that I'm old enough to remember MIS systems unique to the Office, but then suddenly it all branched out into the Classroom and more. And again ironically, the majority of schools I've seen typically all have 'bolt-on' Assessment tools and a high percentage of these are web based.

 

Unfortunately I think it's a case of Capita maybe being a little too complacent and now they're playing catch up. If I'm wrong then Capita would have released a cloud offering years ago, or alternatively a hybrid, so at least Teachers can take the Class register nice and easily, but instead you still need the same full fat product installing regardless what it's used for.

 

Indeed, many years ago, we purchased iPod Touch devices (way before the iPad was released) and Groupcall Emerge just so staff could do registers on the move.

 

Schools that have wanted to make the jump have already jumped to RM Integris or other Cloud platforms that have come to the game so much sooner than Capita.

 

I'm sorry, but Capita have simply been bleeding schools dry with license and support costs for so long now that I simply don't have the confidence or patience with them anymore.

[Michael]

The security issue is taxing us - do we insist on login in again after inactivity or not? The school & the MIS provider is responsible for ensuring that sensitive data is protected. Getting a secure but non invasive approach is an issue & advice very welcome. I feel that some education is required with staff as fines are eye-watering.

 

If that's the case, then why does SIMS7 not have a timeout or locking feature? You can't just presume everyone locks their Windows PC.

 

I've seen other providers provide numerous choices in terms of security, so I don't think it's taxing at all. Probably the logical thing to do is to specify some defaults and allow schools to configure to their requirements. Surely this is what it's all about... you can't set the same for all school regardless, it's all about flexible choices.

 

To put it another way, every school uses Assessment tools, yet no two schools output in exactly the same format. It's all about offering flexible tools to do what schools want.

[PhilNeal]

@Michael "I think it was clear SIMS8 wasn't going to be SIMS7 in a browser for a long time. It would be totally unusable on a tablet or phone. The .NET/MS SQL technology can still be delivered in the background, however the user interface would have to change."

 

Yes the interface has changed to support tablets etc but it's the fundamental concepts that I was referring to - it's this that will make the most difference.

 

@minimoo we're not supporting private clouds except for countries. We started with the intension of supporting private clouds but with the development of ~20 micro-services, reporting warehouse etc. we moved away from that idea. There is a flow from engineering, through staging with auto-tests to deployment. We didn't want to re-invent SOLUS.

[minimoo]

yep - makes some sense. It does however mean that a system that could be local to a LAN (sims 7), is potentially always accessible to the world (sims 8) - so the risk increases (at the same time, arguably in contrast - cloud vendors might be better at configuring security than an IT admin in a local lan)

 

"To put it another way, every school uses Assessment tools, yet no two schools output in exactly the same format. It's all about offering flexible tools to do what schools want." @Michael - what will be interesting as the cloud becomes more embedded is whether vendors keep their API's to themselves and 3rd parties - or whether they allow schools free access as customers.

[mjk]

Is the API documentation going to be published?

I would be very concerned if *all* data isn't accessible to schools through the api, as this would represent a real issue with vendor lock in. Can you give us assurances @PhilNeal ?

[Edu-IT]

What impact will this have on pricing? Will there be costs to merge? Any new ongoing 'cloud' fees?

[vikpaw]

What impact will this have on pricing? Will there be costs to merge? Any new ongoing 'cloud' fees?

 

The FAQ (now added as link to first post) states that for SIMS Primary

There will be no charge for data transfer on upgrade.

Upgrade implies you're not buying a whole new system, just updating but I suspect it's not going to be a small upgrade fee. We know it's a major system change and pricing is yet to be revealed.

As it's cloud only, the cost of the product should include the cloud charges.

[Michael]

@minimoo - I know for a fact Bromcom's API is free, so it's just a case of signing up to be a partner. I'm speculating this would apply to anyone - another company or the school themselves if you're smart enough to code and tap into the API.

 

Most other providers charge for such a privilege... so again it's something worth thinking about.

 

Most providers will migrate you for free as part of the process, but then training costs also need to be factored in, as well as support on general.

[Michael]

I suspect SIMS8 will have an API, but I suspect it'll be the same/similar process to SIMS7 - at a cost, but then at the same time I'm sure Capita want to include more tools which puts less of a need for third party products in the first place.

 

Other/existing cloud providers have done exactly this, so I'd expect Capita to do the same.

[minimoo]

@Michael for schools and sims 7 they seem to charge £2500 - from a business sense (15 hours of developer support) that's not too bad - it does however put a stop to any individual schools trying to do something useful - or for any one to develop an open source project that links with sims for instance, as you'd need to be really committed to an idea to put in the initial outlay.

[mjk]

I suspect SIMS8 will have an API, but I suspect it'll be the same/similar process to SIMS7 - at a cost, but then at the same time I'm sure Capita want to include more tools which puts less of a need for third party products in the first place.

Other/existing cloud providers have done exactly this, so I'd expect Capita to do the same.

 

I'm more worried about the lock-in possibilities, and that Capita will do a data grab and make it difficult for schools to migrate away. It would be easy to do if they provide a limited API rather than a full one. At least with local SQL you can always get to the data to migrate to other products and I'm hoping that @PhilNeal will confirm a RESTful api will be available and have read and write access to everything.

[vikpaw]

@Michael for schools and sims 7 they seem to charge £2500 - from a business sense (15 hours of developer support) that's not too bad - it does however put a stop to any individual schools trying to do something useful - or for any one to develop an open source project that links with sims for instance, as you'd need to be really committed to an idea to put in the initial outlay.

For SIMS 7 schools, I believe access is free, but with no support, and you have to sign various disclaimers and NDAs. Certain individuals, naming no names, ahem, @matt40k, have managed to create something useful...

 

I'm more worried about the lock-in possibilities, and that Capita will do a data grab and make it difficult for schools to migrate away. It would be easy to do if they provide a limited API rather than a full one. At least with local SQL you can always get to the data to migrate to other products and I'm hoping that @PhilNeal will confirm a RESTful api will be available and have read and write access to everything.

 

Confirmed if you see above:

Restful APIs are already with TPs for read. Write APIs will be available by June. End users to follow.

[PhilNeal]

@vikpaw all confirmed & thanks.

 

Perpetual licences on local servers allow you to continue to use the software for ever without paying any more to the software vendor; data in the cloud is potentially very volatile. It is therefore important to avoid lock-in and be sure you have enough time to switch supplier if it becomes necessary.

Edited April 2, 2017 by PhilNeal
Corrected tagged name

[mjk]

so is it confirmed that ALL data is available through the API?