GDPR - access to sims from outside the network

[artfulmatt]

Hi all,

 

I've been looking at the new regs and just curious if any of you allow access to sims from home? Staff here have laptops to use both in school and at home, and we use MS remoteapp to access sims. My only worry is if the laptop is left logged into sims then anyone could potentially access the data. I did think about the lock screen timeout, but then when in school using them in lessons they don't want the laptop locking them out mid way through.

 

Cheers,

 

Matt.

[Steve21]

That's a bit of a non-issue really, In regards to that if it's left unlocked and accessible it's probably already failed GDPR without them needing to open SIMs. Emails etc etc

 

But you could setup a different lock screen setting for the RDP connection however I'd recommend you could even just change the timeout on the RDP connection so it'll disconnect when idle at whatever time you want. No lock screen/other issues just the standard RDP/RemoteApps timeout

 

Steve

[KibosJ]

We allow SIMS access from home, we have RDS set up. We also have a lock screen timeout set and just make sure staff know that this is necessary.

[foofighterjim]

Probably worth making sure that your RDS server is set to disable client redirection.

[Michael]

In the context of SIMS, I see no other solution other than a screen timeout.

 

In the context of browser based MIS solutions (such as Bromcom), as standard they have a strict timeout policy. This can be tweaked per user, depending on their role, so it isn't a one size fits all. You can also enforce password requirements (like you can in AD to your requirements). I don't believe the password requirements are as flexible in SIMS or customisable for that matter.

[artfulmatt]

Sims 8 is browser based isn't it?

 

We have a similar issue with using personal mobiles and connecting to outlook 365 school account. Something I think we will need to stop. I'll look at the timeout options on remoteapp.

[Michael]

Yes SIMS 8 is going to web based, but a bit of a lottery when it'll be released to the masses. I'd speculate years, as controlled trials (to say 100 schools) are yet to begin to the best of my knowledge.

[enjay]

We allow access to SIMS from home, just like we allow access to any other data from home. And just like any other data, staff are educated in appropriate data handling - passwords, locking screensavers, preventing access by family members (emphasised for staff with children in the school). Staff can add the school email to their personal mobile if they want, but are told to add a PIN if they do.

 

Allowing access to drives and email from home but not SIMS seems a bit pointless to me, to be honest.

[pete]

We require 2FA for access to SIMS (all RemoteApps, actually) outside of school.

[Paid_Peanuts]

We require 2FA for access to SIMS (all RemoteApps, actually) outside of school.

 

May I ask how you achieve this? Do you use the free Google Authenticator?

[jmak]

Yes SIMS 8 is going to web based, but a bit of a lottery when it'll be released to the masses. I'd speculate years, as controlled trials (to say 100 schools) are yet to begin to the best of my knowledge.

I had a demo last term and the rep took note of my suggestion that capability for 2fa would be "nice to have". He looked nearly as surprised that someone might ask for it as I was that it wasn't built in....

[Dave_O]

May I ask how you achieve this? Do you use the free Google Authenticator?

 

Yes, would also like to know how you do this.

[free780]

Well you can do Azure Application Proxy and turn on 2fa for web apps. But you need EMS. Edited October 14, 2017 by free780

[Steven_Cleaver]

Same here use two factor authentication for SIM's machines staff just use encrypted App we developed as part of our remote access system few years back but built round RDP, just with added security.

[pete]

May I ask how you achieve this? Do you use the free Google Authenticator?

 

We use Duo Security ( https://duo.com ). It integrates with Remote Desktop Services (and a whole bunch of other applications). So long as you've a phone of some description (landline, dumb mobile, smartphone) it'll work.

 

The closest offering to what we have is Duo MFA (we're on an old plan that's no longer available to new customers).

[Sir]

We now are starting to trial direct access with 2fa.... now available for first time. ...will report asap

[ITGURU]

SIMS doesn't even use case sensitive passwords yet - I contacted Capita recently and they told me that there are no plans to implement secure passwords. For what data it holds i'm very surprised.