SIMS over VPN

[Norphy]

My former boss wants teachers to be able to log into the SIMS client from home over the VPN. I think this is a bad idea but can't articulate why. I would much rather they use the offline client that we spent so damn long setting up for all of them.

 

What do you all think? Do you let your teachers use SIMS over VPN or do you use another solution like Terminal Services or the Offline Client?

[ChrisH]

Terminal services is going to be the easiest and more secure route I would have thought. It all comes down to the security issues though I would have thought.

[Norphy]

Its my preferred method I will admit. Come April I'll be buying some TS CALs and installing TS on a server.

[apeo]

Over here we have a few teachers laptops with Teachers Desktop on it. The question is what would the teachers require access to, and why.

[ChrisH]

Id go for a nice secure desktop where they can only run what sims needs. If you need to test it over the VPN for now you get about a 90 day grace period on the client licences.

[Netman]

MS Says:

"Negative analyses of PPTP were published over three years ago. Security analysts identified three problems that were immediately corrected. Since then, there have been no new issues cited. Their most serious complaint was not concerning the implementation but rather that the use of a user name and password for VPN connections is not as secure as certificate-based authentication. Microsoft agrees with this conclusion which is one of the reasons why Windows 2000 Server and Windows Server 2003 support public key infrastructure (PKI) and include a certification authority service. If you must use user names and passwords, enforce the use of strong passwords. Strong passwords are long (more than eight characters) and contain a random mixture of upper and lower case letters, numbers, and punctuation. An example of a strong password is f*3L~qO2>xR3w#4o."

 

Personally, I wouldn't worry about using it. You can use the Connection Manager Administration Kit to create an easy setup for the users and providing they are given strict instructions on security and you don't have any split tunneling going on, then it should be pretty easy and safe to use....

[SpuffMonkey]

Terminal services is going to be the easiest and more secure route I would have thought. It all comes down to the security issues though I would have thought.

 

I agree - we're putting in a 30 user Citrix solution for pretty much this reason.

[kingswood]

There's a good discussion over on this forum if you're interested (from a little while back but the principle is still the same):

 

http://seclists.org/lists/security-basics/2003/Aug/0497.html

 

I remembered it because I want to do the same thing.

[Norphy]

Over here we have a few teachers laptops with Teachers Desktop on it. The question is what would the teachers require access to, and why.

 

The amusingly named Assessment Manager (assman.exe ) is the primary need. They're making them write all their reports in SIMS Manshead.

 

Its not security that I'm concerned about so much, the encryption that the VPN connection offers is sufficient. Its more bandwidth concerns and usuability. My ex-boss says that he logs in SIMS "all the time" from home using the VPN connection and says it works fine. I think that when 20/30/40 teachers try it at once it will keel over and die and then people will start shouting at me the next day. Ully tried it last night and said it was crap, constant timeouts and dropped connections to the database.

 

I told my ex-boss in no uncertain terms that I didn't want people connecting to SIMS over the VPN connection and that I thought it was a bad idea. However he has completely ignored me and told ALL the teachers in a training presentation yesterday to do it. I am pissed off to say the least.

 

I'm setting up a terminal server now and relying on the 90 grace period.

[pete]

I told my ex-boss in no uncertain terms that I didn't want people connecting to SIMS over the VPN connection and that I thought it was a bad idea. However he has completely ignored me and told ALL the teachers in a training presentation yesterday to do it. I am pissed off to say the least.

 

well as long as your objections (and reasons) are in writing it's his fault (though probably still _your_ problem).

[Chafftech]

@norphy

 

I would recommend you check the legal ramifications of having potentially sensitive data available to computers outside your LEA. Check with your LEA that they allow sims data to be accessed from teachers homes.

 

Personally I would just say it can not be done due to data protection, particularly where children are involved.

[webman]

How secure are their home PCs? Have their family been subject to CRB checks?

[Outpost]

Hi,

 

Not quite related to the SIMS issue but calls for accessing school networks from home is going to be more relevant as technology and speed increases.

Many say why?

I wouldn't be a teacher if it was handed to me on a plate. What I often see is staff coming in during school holidays or work late to either catch up on paper work or prepare lessons for absent staff etc and some have to travel a fair old distance as well.

 

How better it would be for them to not have to travel or stay late or leave home if possible.

The technology is there and so is the demand but not the understanding of why there is a demand.

Yes there are many arguments against but I think we use them for our own purposes coz we inherent a secure safe network from our LEA or whatever.

 

I'm not advocating a free for all but I think a more open minded approach from some quarters is needed to see the possiblilities.

 

Cheers

[Chafftech]

Hi,

 

 

I'm not advocating a free for all but I think a more open minded approach from some quarters is needed to see the possiblilities.

 

Cheers

 

I dont have a problem with accessing general work data from home, we have easylink that allows all staff and pupils to access their work. But if SIMS data is available and gets into wrong hands we could het sacked. There have been recent cases of teachers who on the sex offenders register getting jobs, if these can get the data at home unsupervised what are we leting ourselves in for?

[Outpost]

Of course sensitive data should be very secure and I personally would be against home access to that (SIMS etc)

The EasyLink idea sounds great but its not just some techhies who are against home access it can be the providers as well.

[peterduckmanton]

I would not be prepared to allow SIMS over VPN/Thin Client without authorisation from the Borough and also Capita.

I would ask for Borough to provide staff training, and write minimum specification / security documentation.

I would also require a new contract from my boss to say what level of support is provided for this extended service, and what hours of support are provided.

Down time would have to be planned further in advance to take into account remote workers.

 

Good luck to you.

[wesleyw]

I would have thought that Capita for one would be all for it not only do they give you the option of SIMS .Net Teachers Desktop allowing for a local copy o the database for Profiles, Assessment marking but it also includes all the pupils details anyway and if wanted could provide them with all the photos etc... The LEAs I would believe will be behind this too allowing for much of the extra work load ot be done at home. Capita is starting to provide a VLE system whereby you can gain access to their database from home online instead of the offline Teachers Desktop. I think VPN may not be the answer though I can see it being quite slow!

 

Wes

[ChrisC]

We used to run sims.net over vpn, between curriculum and admin networks.

 

It was hell, we used rsa security fobs, and they were useless, it would just confuse staff.

 

In the end, we basically took out the vpn, and connected the 2 networks off, but only opened the sql port between the 2 networks, so staff laptops can connect through to the sql server, but only sql queries to the sims database can be accessed so it is just as secure, but with much less hastle.

 

My experience says do NOT go through VPN, we spent thousands on it on the suggestion of county, and it was useless.