CPOMS with Android tablets

[toffee_paul]

Hi,

 

Our school has recently started using CPOMS and it's being rolled out for all teaching staff. I've been informed the the safeguarding lead that in order for staff to have the level of access that allows them to look at incidents, they need to have 2 factor authentication enabled by way of an the CPOMS Authenticator app and that each teacher requires their own tablet in order to use the CPOMS Auth app. Is this correct? Also is anyone using CPOMS with Android tablets? If we need to purchase Android tablets I'll need to enrol them in G Suite's MDM so just wondering if anyone has done this before and offer some advice regards the set up of it.

 

Many thanks

[azureusnation]

Unfortunately this is correct. Users that need to see sensitive information will need the CPOM Authenticator App.

[clareq]

Our teachers have a USB dongle for authentication.

[azureusnation]

Our teachers have a USB dongle for authentication.

For tablets? i can understand Macs and windows desktop/laptops but you cant do that with a tablet.

[clareq]

No, not for tablets - desktops. I mentioned it as the OP said they would have to purchase tablets for use with CPOMS.

[toffee_paul]

Does each user need their own device with the CPOMS app installed or can they share a communical tablet/iPad?

[azureusnation]

They can share, they will just need to remember to log out and and other person will need to login.

[toffee_paul]

Log out of the CPOMS App? I've just gone to test this on a spare iPad. I deployed CPOMS to it and it's prompting for a QR code. There's no 'sign in' option.

[Chaniel]

We use CPOMS but as far as I'm aware, the CPOMS Authenticator app is only there for the two factor authentication over using a physical USB key.

 

Our staff who need the elevated access install the CPOMS Authenticator app on their mobile phones, much like you would Google Authenticator. They then login to CPOMS on their school laptop/PC, add a security key, scan a QR code on the authenticator and name it. If they need to elevate access in CPOMS, the app on their phone generates a code for them to use.

 

I don't see a need to buy them brand new tablets just to use the authenticator app when 99% of teachers will have an iOS or Android phone.

[mavhc]

Does every teacher access information that requires 2FA?

 

What 2FA system does it use? Is it TOTP like everyone else uses?

 

Can they use their phones?

 

What device are they logged into CPOMS with?

 

Can you use USB dongles or NFC? Are they using standard WebAuth and FIDO?

[bobsmith]

they can use their own personal phones - the only issue would be if they really don't want to install a school app on their personal phone - which I would fully support them in objecting to.

 

either way only a handful of staff here have to use the 2FA and there is a USB dongle option if they really don't want to use their phone.

[toffee_paul]

We're looking at every teacher and teaching assistant having elevated access thus requiring 2FA.

 

It may be an option to ask staff to use their phones and if not have the phyical USB sticks as a backup if they object to using the app on their personal device. It would be a damn sight cheaper than tablets at least.

[Sylv3r]

Our staff who need the elevated access have used their personal phones barring two - who's nokia or whatever type of phone they had wasn't compatible so we had to buy them the USB dongle - I think they are around £17 each.

[DrBeaker]

they can use their own personal phones - the only issue would be if they really don't want to install a school app on their personal phone - which I would fully support them in objecting to.

 

either way only a handful of staff here have to use the 2FA and there is a USB dongle option if they really don't want to use their phone.

 

+1 for this. I would personally object and wouldn't support that unless it comes directly from the Head. I know it's 2019 but it's not unreasonable to assume some people don't want or have a mobile phone. I know some elderly people that have never been online on the internet, as they don't want to. I've made a conscious choice that due to abuse by people in a previous role, not to use my personal phone for anything work-related in another role. They want me - buy me a phone, end of.

 

Expecting staff to use their personal devices for a system that's work-related and needs 2FA in my book, means that's a school problem.

 

Especially with employee wellbeing e.g. https://www.expressandstar.com/news/local-hubs/dudley/stourbridge/2019/05/11/work-related-stress-linked-to-stourbridge-mans-death/ being in the news. This is a a very dodgy area. I don't care even if it's just a 2FA app. What would happen if that staff member lost their personal phone and couldn't login to CPOMs due to this and there was a safeguarding incident. Is the employee going to be blamed?

 

We're looking at every teacher and teaching assistant having elevated access thus requiring 2FA.

 

It may be an option to ask staff to use their phones and if not have the phyical USB sticks as a backup if they object to using the app on their personal device. It would be a damn sight cheaper than tablets at least.

 

Our staff who need the elevated access have used their personal phones barring two - who's nokia or whatever type of phone they had wasn't compatible so we had to buy them the USB dongle - I think they are around £17 each.

 

The school made a conscious choice to use that system. They have to foot the cost for any additional kit required to get it to work. E.g. Would you be expected to supply your own toner for the printer in a school, but the school would supply the printer?

Edited June 21, 2019 by DrBeaker

[Sylv3r]

The school made a conscious choice to use that system. They have to foot the cost for any additional kit required to get it to work. E.g. Would you be expected to supply your own toner for the printer in a school, but the school would supply the printer?

 

We certainly haven't forced the staff to use their mobile phone, some of our senior staff when offered a school phone or device have declined the opportunity in the past as they didn't wish to carry two phones around with them and felt it was a waste of money to buy them an an iPAD / Laptop etc when they didn't really need one. Certainly, if a member of staff objected to using their own device (I think there's only 6 - 8 staff in total, we would just buy them the USB dongle.

[DrBeaker]

We certainly haven't forced the staff to use their mobile phone, some of our senior staff when offered a school phone or device have declined the opportunity in the past as they didn't wish to carry two phones around with them and felt it was a waste of money to buy them an an iPAD / Laptop etc when they didn't really need one. Certainly, if a member of staff objected to using their own device (I think there's only 6 - 8 staff in total, we would just buy them the USB dongle.

 

I may be cynical, but when I've seen in one hand how much money is wasted in schools and the next we don't have enough money to buy one cable I don't buy it. I find it hard to believe there's not funds for a key school system like that to the point they expect staff to use their own devices. E.g. cars the SLT team drive costing £40K, that means they're paid enough to afford that car, which means there's enough money to purchase a device for a staff member and are they REALLY delivering value for money or a unique set of skills that we need to pay you that much. Doesn't apply to all schools and staff nope, but that's from my experience. Staff who claim poverty are normally the ones driving the expensive cars.

[toffee_paul]

Staff who claim poverty are normally the ones driving the expensive cars.

 

Couldn't agree more!

[mavhc]

They should have bought expensive electric cars, reduce the running costs that are bankrupting them.

 

Note that once you have 2FA you can use it everywhere, google/ms/anyone who's not terrible really.

[DrBeaker]

They should have bought expensive electric cars, reduce the running costs that are bankrupting them.

 

Note that once you have 2FA you can use it everywhere, google/ms/anyone who's not terrible really.

 

2FA is great.

 

But IMHO in this case, if it's a work solution for a work problem then work needs to provide the tools and equipment to make the solution work. Not rely on the goodwill of teachers and support staff to fill the gap and use their personal devices. That's a great way to erase the goodwill of staff and undermine morale, it's a slippery slope to making them use your own phone for everything. That's from experience too folks. SLT can do what they want with theirs, they get paid enough to afford 2x phones which makes all this a moot point.

[mavhc]

I'd use my own phone because that means the school hasn't wasted £x on buying me something I don't need, there's a fixed budget, I'd rather it went on something that was needed

[Danp]

Does the 2fa app work with Android tablets now? When I last looked it didnt.

 

We too have asked staff to install on their own phones, some have done it no problems, others who have said no, we have made other arrangements.

[mavhc]

Does the 2fa app work with Android tablets now? When I last looked it didnt.

 

We too have asked staff to install on their own phones, some have done it no problems, others who have said no, we have made other arrangements.

 

Pretty sure it's just a standard TOTP app, so you can use any similar app, eg Google Authenticator, Microsoft Authenticator, etc etc

[mavhc]

Hmm, maybe not, it won't load generic TOPT QR codes, weird.