SIMS Trusted AD Logins

[Olliesaurus]

Is the SIMS trusted AD login utility considered as a bit of a can of worms nowadays due to GDPR etc? It feels like it should be however more passwords etc.

 

Just raised my password complexity for all staff, wondering whether to be nice and allow them nice access to SIMS or smack them in the chops with a whopping password.

[FN-GM]

I don't see why it would be a problem. The GDPR issue starts when the computer is left unlocked an unattended.

[matt40k]

The National Cyber Security Centre advise would be to avoid SIMS logins and use Windows Trusted logins - https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach

 

Main reasons being user "password overload", lack of brute force support, the fact most peoples SQL server connections aren't encypted so the password is scrambled, not encrypted and the fact the "encryption" at rest of the password is pretty crappy.

[mavhc]

The National Cyber Security Centre advise would be to avoid SIMS logins and use Windows Trusted logins - https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach

 

Main reasons being user "password overload", lack of brute force support, the fact most peoples SQL server connections aren't encypted so the password is scrambled, not encrypted and the fact the "encryption" at rest of the password is pretty crappy.

 

If I steal your laptop your Windows password hash is cached on it though, your SIMS password won't be.

 

The password connecting to a MSSQL database is hashed, the encryption at rest would be on the server anyway, same as for AD password.

 

Still need to solve the problem of a teacher having 2 jobs, admin and teaching, and those jobs being done by the same login on a laptop connected to the classroom screen, left unlocked while the teacher is suddenly caused to step outside the classroom

[matt40k]

Seriously?! You know you can - stop the cached logins, you can encrypt the disc, you can once it’s been reported disable the computer/user login, reset the user password.

 

Win+ L (backed with idle auto locking policy) is easier then closing an app

[MartinT]

We use SIMS Trusted Authentication. It's one less password to manage and for staff to lose. They appreciate it as they need quick SIMS startup in classrooms when taking registers.

[mavhc]

Seriously?! You know you can - stop the cached logins, you can encrypt the disc, you can once it’s been reported disable the computer/user login, reset the user password.

 

Win+ L (backed with idle auto locking policy) is easier then closing an app

 

You can disable cached logins, but then the laptop won't work at home.

 

The question was comparing 2 types of login though, and the reasons given for preferring one were over stated.

 

With AD login SIMS is the same as always running when the computer is unlocked. With SIMS login when SIMS isn't running you can't load it.

 

Teacher computers will be unlocked when using the projector, because there's no transparent lock screen option, so they're going to need to stay unlocked for a whole hour's lesson

[matt40k]

Mmm... that does present at interest idea - screensaver that is a screenshot of your desktop. Computer is secured, but the last content is preserved (ie lesson objectives) on screen.

 

You can disable cached logins, but then the laptop won't work at home.

...Local accounts, DirectAccess... Heck don't disable it, encrypt the disc.

[MartinT]

Mmm... that does present at interest idea - screensaver that is a screenshot of your desktop. Computer is secured, but the last content is preserved (ie lesson objectives) on screen.

That could present... interesting scenarios!

[matt40k]

...In case of emergency, press and hold the power button

[mavhc]

In terms of risks they'd rank as follows:

Teacher shouting their password to another teacher across the classroom

Teacher writing down their password/typing it into the wrong box

Teacher letting students watch the keyboard as they log in

Teacher using name of cat as password

l33t haxors sniffing network traffic and running hashcat on their gpus

[Marci]

that does present at interest idea - screensaver that is a screenshot of your desktop

 

Do projectors not have a 'freeze' button anymore...?

[mavhc]

Doesn't work for video, plus then you might need a remote.

 

What would be better would be a secure desktop which requires a second login, for teacher's admin work, where class lists and pupil records are stored, configured to not duplicate onto other schools, auto lock etc. Then the main desktop can be used for teaching

[matt40k]

...assuming they have the remote I guess

 

- - - Updated - - -

 

...assuming they have the remote I guess

 

What would be better would be a secure desktop which requires a second login, for teacher's admin work, where class lists and pupil records are stored, configured to not duplicate onto other schools, auto lock etc. Then the main desktop can be used for teaching

 

...Sounds like Hosted SIMS