Clarion Call privacy concerns

[mrwoberts]

Can I just run this by someone to make sure I'm not overreacting.

 

We cleaned up old sims users before the start of term and subsequently Clarion Call stopped working.

They said their software was using a user that has since been removed. No problem, just pop in the new username and password in a plain text file in the clarion folder!!!!

 

That is a show stopper in and of itself, but when I went into the folder where clarion call is installed there are plain text files of a recent export with tons of personal data in.... plain text (xml)

 

I'm looking for someone to tell me this is all fine and stop worrying, or to back me up and say... "Get on the phone to their support straight away and demand this changes!"

 

They are supposed to be GDPR compliant, but this is just bonkers.

[elsiegee40]

@GrumbleDook may have had dealings with this outfit

[Banjo]

The file is a worry. The main concern is how this information is transmitted from your sever to the cloud - encrypted or plain text?

[mrwoberts]

The file is a worry. The main concern is how this information is transmitted from your sever to the cloud - encrypted or plain text?

 

Good question, I shall add it to my list of things to ask them. I've a horrible feeling these XML files are simply pushed to their server via a listening URL, found in the config file.

[GrumbleDook]

If the file is in a secured folder on the server then plain text or otherwise is a risk management thing.

It is how it is transmitted that is the important question to ask.

 

I don’t know the software itself and have spoken with them directly but ask them about secure transport and how that is managed.

[mrwoberts]

Just waiting for a clarification on the transfer method, but initial response suggests we just need to secure the folder where the data is dumped - they rely on the SIMS command line exported which dumps in plain text... Okay, I can understand that, but maybe it would be better to delete the data when it has been used??

 

Next stop was the secure transfer. I have asked if the plain text files are encrypted before being sent to a URL on the internet (using curl).

Hope to hear back tomorrow. I see from the curl trace file that a certificate is involved, but nothing of what I see means that this plain text file is being encrypted - even purely on the basis of the plain text file being left behind.

 

Am I missing something here? Should the file be encrypted before being transmitted, or is an SSL connection to a remote server through curl sufficient?

Edited September 24, 2018 by mrwoberts

[GrumbleDook]

Encrypted and then moved over encrypted tunnel is better, in the same way wearing a diver’s dry suit whilst walking in a corridor will keep you dryer then walking naked on the pavement ...

 

(If there is risk that the windows in the corridor are left open and it is monsoon seasons then you realise the above is not being sarcastic but about risk management).

 

And the reason the old file is left ... so you can check what was transferred. There are improved ways of doing this now though.

Edited September 24, 2018 by GrumbleDook

[mrwoberts]

:laughing:

 

Point taken. I think it was a good exercise to spot this and discuss it with SLT, and now, as you say, record this as part of our risk management - taking any action where appropriate. I was kind of expecting something a bit better from these guys, but in the same way I'm sure I could be pulled up on some ways that I do things. Helpful discussion and made me think more about our setup/methods here.

Thanks for contributing.

[dhicks]

Encrypted and then moved over encrypted tunnel is better, in the same way wearing a diver’s dry suit whilst walking in a corridor will keep you dryer then walking naked on the pavement ...

 

From a software development point of view, trying to implement your own encryption mechanism / library / whatever is probably not the solution. If you use standard, tested tools (e.g. curl), hopefully somewhere along the line, someone who knows a lot more about encryption than you do has been involved and ironed out the bugs. Storing a plain-text file on your SIMS server, in an otherwise carefully permissions-controlled folder, is okay from an application point of view, although at your end you could of course encrypt the hosting VM and/or the drive or folder at the operating system level. Tools like curl should, of course, be kept up-to-date in case of issues, and should be checking the certificate received from the Clarion server each transaction to make sure it's valid.

[bobsmith]

This is why I moved us away from them 2 or 3 years back - I never had confidence their software solution was robust enough.