Secure Connection, necessary for a learning platform?

[maniac]

Do others consider it necessary to serve their learning platform to the outside world over a secure connection, or is this really a bit overkill for the type of service it is?

 

I launched the process of our school choosing a learning platform to our subject leaders today, and immediatly got a barrage of questions I hadn't really prepared for, security of it was one of them!

 

So what do others do, HTTPS or not?

 

Mike.

[Sylv3r]

Our Learning platform currently does not work over https however once we incorporate the SIMS Webparts over the summer holidays it will run behind a ISA box and run using https.

[sahmeepee]

According to BECTA (who know everything, natch):

 

When data is required by an authorised user from outside of the school premises – for example by a teacher working from their home –they must have secure remote access to the management information system (MIS) or learning platform.

(their emphasis)

 

Becta Schools - Leadership and Management - Data protection - Information security guidance for schools

 

They aren't 100% clear on what they mean by secure, but if you don't enforce strong passwords OR use https I think you'd have a hard time describing it as secure. That's not a criticism btw - I know our new VLE will be insecure, but I doubt there is anything we can do to change that other than lobby the provider.

[jcollings]

https here via LP+

[PiqueABoo]

https helps, but doesn't make it especially secure. It's the authentication you really need to fret about i.e. if you must use them, those passwords.

[CyberNerd]

https is an absolute necessity when you have a internet facing server that you expect people to log into with their details.

If a student could get hold of a teachers login through sniffing or man-in-the middle there would be a serious security breach. it is easy to stop this with a simple ssl certificate, I suggest it would be a breach of data protection NOT to use one !

[sahmeepee]

Our BECTA-approved VLE (name withheld for obvious reasons) allows pupils to put pretty much any javascript into their eportfolio pages, which renders other security problems fairly irrelevant as any visitors to the page are vulnerable to having their session cookies stolen.

[PiqueABoo]

Last real-world compomise I had some glancing involvement with was done over https - 11 yr-old student had guessed/shoulder-surfed the head's password - head had insisted on being an admin.. fill in the dots.

 

If a student could get hold of a teachers login through sniffing or man-in-the middle

 

What between Teacher's home and the school? How are they going to do that? By all means use https because it is helpful, doesn't cost too much and if nothing else will let some folk tick a box that makes them feel all warm/fuzzy, but pragmatically if Student can pull off that MITM in the first place then Teacher is probably already stuffed in 101 other ways.

[maniac]

I'm pleased most reponses are pro-HTTPS, as I was fully intending to use it anyway, but I wanted to pose the open question to see what other peoples opinions were.

 

The risks with passwords will always exist I think, the weakest link is any security chain is always the user! This will be combatted by educating users in good password parctise, turning off the ability to save passwords in web browsers for staff, we will enforce strong passwords when we go live with whatever learning platform we choose, and also they will be forced changed every xx number of days I think, annoying maybe, but necessary - I think so.

 

Are there any learning platforms on the market that offer authentication other than just a simple password, particulalry for staff and admin accounts? I will be posing the question to the different companies when we approach them to offer us a solution anyway, as with the potential for attendance, assesment data and other information to be contained within the system, I think it could be good to consider security other than just passwords.

 

Mike.