School Security Audit Issue Flagged

[talksr]

Hi all,

Just looking for some advice....

 

The school I work with has a yearly inspection by an independent security consultant. Both myself and the site manager are the only people listed as having permission to work with the CCTV system (system operators), view, download video etc for SLT members/police.

 

 

We started with Axis CCTV which I had installed. All of the cameras are IP and run to my server cabs where the NVRs are also located in a secure and locked rack along with the Paxton Access Control server.

Since we put in the Axis stuff, the site manager had other ideas and we now have about 5 different NVRs spread all around the building from varying manufacturers, some IP, some analouge in all sorts of random places with un-marked ethernet cables all over the place to all sorts of different cameras and nothing going to a central point.

I had lengthy discussions with the head about removing it all and having a brand new system where everything goes to one central place such as my server room but was told no, there is no budget for this.

 

The original Axis stuff is with me on a computer in the server room, a secure room where the NVRs are locked in my server racks.

The security consultant who isn't really very independent as he is very good friends with the site manager has said that all of the Axis cameras I have on the systemin my server room that cover areas staff or children are captured on, must be accessible by the site manger on his computer. I have facilitated this (makes sense to me so we are all squeaky clean in terms of how it runs) and had them added, even though I don't have access to all of the site manager's NVR's but this is not mentioned.

 

The consultant now states that the three cameras I have in the server room, must also be added to the site manager's computer. Again, no menition of the fact that I can't access all of the camera's that the site manager has around the building or the fact that the site manager has various NVRs scattered all of the place, above doors, in removable ceilings etc.

 

Is this necessary? I am more than happy to do whatever is right but just a little confused at why it is always me mentioned in the report. I used to get a full copy of the report which is helpful to get a general overview of the state of our site security, now I literally get a screenshot of the bit that mentions me.

The report states:

Risk: Possible Missuse of CCTV images through lack of transparency.

Cause: It would appear that access to images captured in the server room is restricted to the network manager.

Impact: Potential negative impact on the school's professional reputation. Loss of trust in the school's use of CCTV and the school could force enforcement by the Surveillance Camera Commissioner.

Actions: Network manager must enable access to cameras' images from the site manager's office.

 

 

The head has been passed this report and said can I either give the site manager access to these cameras or just have them disconnected and removed which means no more server room coverage - that would be a shame as we would have no way to identify if someone comes in and takes hot swappable HDDs from the server or steals our Paxton Access server.

 

Would really appreciate any advice on this.

 

On a site note, I regularly walk into the site manager's office to find he has left the CCTV viewer for one of his NVRs open and in full view of anyone who can walk into his office and he has either gone or left other colleauges watching it who are not listed as being able to view the CCTV on the School CCTV Policy.

 

We were advised that every time we access the CCTV system, we should log the date, time, what we were on it for and if anything was downloaded. This is listed in the school CCTV Policy under System Log. I have kept an Excel sheet from day one and I list everything, even firmware updates to cameras I perform as I am still accessing the cameras which show images. The site manager has no log at all and regularly leaves live camera views up for all to see on his desktop.

[psydii]

I shall just observe the following: The site team office here is the second most secure room in the building. I have keys to almost everywhere but not the site office or the Exam ‘cupboard’.

 

Ok, I have an opinion too. I think the DPO is a stakeholder in a security review. They should perhaps be a useful [emoji639]rd party who should be sharing their perspective on this?

[Davit2005]

All a bit fishy to me. In my opinion wash your hands of it, get things in writing and forget about it with one less system to worry about.

[DavR]

I would comply with what they've asked, as this is a reasonable request. But also raise it with someone, in writing, that a situation exists where this is not being reciprocated, and that there is CCTV equipment that only the site manager can access, contrary to policy. I'd probably raise it with the security consultant in the first instance, because if they're worth their salt, they should take that on board. If not, escalate the matter.

 

Re access logs, up to you whether you whistleblow on that one. Can you prove there aren't any? I'd say that's the site manager's problem, myself.

 

Doesn't sound like a situation anybody would be too keen to resolve tbh (IT problems never are, to management). Flag it, in writing, so if there's ever a problem, you're in the clear.

[dmj]

Risk: Possible Missuse of CCTV images through lack of transparency.

Cause: It would appear that access to images captured in the server room is restricted to the network manager.

Impact: Potential negative impact on the school's professional reputation. Loss of trust in the school's use of CCTV and the school could force enforcement by the Surveillance Camera Commissioner.

Actions: Network manager must enable access to cameras' images from the site manager's office.

 

Doesn't the suggested fix just cause the same problem ?

Seems the consultant is drumming up business for himself. The next report will read

 

Risk: Possible Missuse of CCTV images through lack of transparency.

Cause: It would appear that access to images is restricted to the site manager.

Impact: Potential negative impact on the school's professional reputation. Loss of trust in the school's use of CCTV and the school could force enforcement by the Surveillance Camera Commissioner.

Actions: site manager must enable access to cameras' images from other offices.

Edited October 29, 2024 by dmj

[sigma]

I’m not clear exactly what the report author thinks that the “Biometrics and Surveillance Camera Commissioner” would be enforcing?

[speakercon]

Sounds like a mess, but not an uncommon occurrence, I've seen site staff do this before where they go down to Screwfix and buy the DIY DVRs/cameras and throw them up in the celling voids.

 

You say he is friends with the auditor, if I was being skeptical I might think he doesn't like not having access to your cameras and so has asked him to bung it in the report so he can get access, but I'm sure that's not the case.

 

I do think its reasonable for him to have access, but not reasonable for only him to have access to the other NVR's. I assume he did a privacy impact assessment for all the of cameras he installed?

 

Are they on your network? If so do they have internet access? Are they receiving regular firmware updates?

 

The proper solution is what you have already suggested, replacing all the DIY systems with either more Axis cameras/NVR's or a new system of common manufacturer.

 

If you wanted to try and come to an amicable solution, could you try to work together on installing a new central system, the installation is usually the most expensive part so if you both could run the cables and mount the cameras, you only have the hardware to purchase which would bring the cost down, as well as achieving the central system, equal shared access and secure and safe location of the NVR's?

[sigma]

I’m not clear exactly what the report author thinks that the “Biometrics and Surveillance Camera Commissioner” would be enforcing?

 

Thought I'd find out.

 

https://www.gov.uk/government/organisations/biometrics-and-surveillance-camera-commissioner/about

 

The Biometrics and Surveillance Camera Commissioner's role is to encourage compliance with the surveillance camera code of practice.

 

The commissioner is independent of government. The commissioner has no enforcement or inspection powers regarding surveillance cameras and works with relevant authorities to make them aware of their duty to have regard to the code.

 

Surveillance Camera Code of Practice: https://assets.publishing.service.gov.uk/media/619b7b50e90e07044a559c9b/Surveillance_Camera_CoP_Accessible_PDF.pdf

 

Self Assessment Tool: https://www.gov.uk/government/publications/surveillance-camera-code-of-practice-self-assessment-tool

[ToyHeartsFan]

Do you like working there and how much do you want to rock the boat?

 

 

"the site manager had other ideas and we now have about 5 different NVRs spread all around the building"

 

At the very least the school business manager would have processed the official order and it would have to have been approved by the head, most likely he was told by the head or a member of SLT that they wanted more CCTV cameras and SLT didn't feel the need to consult you.

 

 

"The consultant now states that the three cameras I have in the server room, must also be added to the site manager's computer."

I assume the consultant works for the company that installed the other kit, he has the ear of site manager and as far as the school is concerned the site manager is the CCTV operator.

 

 

"The head has been passed this report and said can I either give the site manager access to these cameras or just have them disconnected and removed"

 

That tells me the head doesn't really think it's your job to manage the CCTV and they might not want you to have access, is CCTV in your job description?

 

You could just remove it as instructed and then wash your hands of the CCTV system, you don't have access and it's no longer your problem. The CCTV consultant might then decide the server room should have CCTV and install a system of their own...

 

 

"On a site note, I regularly walk into the site manager's office to find he has left the CCTV viewer for one of his NVRs open and in full view of anyone who can walk into his office and he has either gone or left other colleauges watching it who are not listed as being able to view the CCTV on the School CCTV Policy."

 

 

Can you prove this or is it his word against yours?

 

You could:

Make a formal complaint against the site manager to the head.

 

Raise it with the school data protection officer.

 

Make a formal complaint to the governors.

 

Make a formal complaint against the school to the ICO.

 

At one extreme the site manager gets fired, the other extreme is SLT don't believe you; expect any job requests you submit to the site team to get lost, any deliveries for IT to be left in a pile in the corner for a week before you get them and your bins never to get emptied. I even heard of a site manager that stuffed a dead mouse behind a classroom radiator when a teacher upset him...

 

 

"we would have no way to identify if someone comes in and takes hot swappable HDDs from the server or steals our Paxton Access server."

 

So the school uses Paxton and putting mag locks on the server room and site managers doors would be a lot cheaper than replacing 5 NVR's, suggesting it might even earn you browny points with SLT if you pitch it the right way.

 

 

"We were advised that every time we access the CCTV system, we should log the date, time, what we were on it for and if anything was downloaded. This is listed in the school CCTV Policy under System Log. I have kept an Excel sheet from day one and I list everything, even firmware updates to cameras I perform as I am still accessing the cameras which show images."

 

 

Great that you do all that, I was told to create CCTV accounts for the head, the business manager and both the caretakers who then decided they needed more monitors so they could leave the screens on despite being told that they are only supposed to be checked if theres been an incident or to check they are working correctly...

 

Before I started the CCTV was managed by the site team then the site team changed, I had a new tech and when the police turned up etc... the site team would bring them to me to view the cam's or export footage for SLT.

 

Then the head got a bee in her bonnet, the business manager got a council approved CCTV compmany in and NVR's started popping up all over the place. The approved CCTV company were given carte blanche to do what ever they wanted, they wired cam's into the back of existing network sockets leaving the socket in place, they set static IP's causing IP conflicts on the network, they set a password on the individual IP cam's that were causing the IP conflicts so I couldn't check or alter the settings and they refused to give the password to me saying they can't because they use the same password at every school... they ran unmarked cables all over the place plugged into comms cabs without permission, added their own mini network switches and left no documentation...

 

 

 

"The site manager has no log at all"

Suggest that as the site manager is now responsible for CCTV it would be a good idea for him to undertake training to obtain a SIA CCTV Licence.

 

 

"and regularly leaves live camera views up for all to see on his desktop."

Why doesn't his desktop screensaver lock the PC after a few minutes?

 

Even SLT incuding the ICT lead would do this at the school I was at despite explaing why they shouldn't; I set a timed screen lock on all office user network accounts, at one point I did try it with teacher accounts with a longer grace period but was told by the head to remove it because too many teachers complained.

 

 

Based on my experience with the council approved CCTV company, some installers are grossly incompetent; I explained to the lead installer multiple times what a DHCP server was and that dhcp reservations are needed. It went in one ear and out the other and he continued installing cams with static IPs with no reservations causing more IP conflicts.

 

 

Only you can decide how much to rock the boat and whether the fall out is worth it; do you even have the time to manage the CCTV should they take the job off the site team and say its now your resposibility?

 

When I complained to our business manager how many problems the cctv installers had caused she just said well you can fix it can't you... Well sure if I had nothing else to do for two weeks I could have gone round the whole school to find where the cams were, factory reset and reconfigured each one, traced and replaced their dodgy cabling. But at that point I was working on my own and simply didn't have the time, the best I could do was use the device Id's, try and find the mac's listed in dns and make dhcp reservations to mitigate some of the problems until the next time they came out and broke something else. One time I found foot prints on top of the server because they had been standing on it to access a NVR another time they stood on a monitor shelf in the server room ripping it off the wall.

 

 

The week I left when I was made redundant the caretakers were begging for CCTV training, I didn't have the time with the jobs the head asked me to do before I left and my post had already been downgraded so training staff wasn't in my job description anyway so not my problem...

 

 

Schools don't value ICT staff, they often don't listen to them when they give advice even when they are in a senior IT Operations Manager GR4 role but will fall over themselves when an external installer that doesn't even know what a DHCP server is clicks his fingers. It won't change until senior IT roles become part of the SLT team which is unlikely to ever happen in small schools with the constant budget constraints.

Edited October 29, 2024 by ToyHeartsFan

[talksr]

Thank you everyone for your really helpful input.

I think the main takeaway from this is as @ToyHeartsFans says...

Schools don't value ICT staff, they often don't listen to them when they give advice even when they are in a senior IT Operations Manager GR4 role but will fall over themselves when an external installer that doesn't even know what a DHCP server is clicks his fingers. It won't change until senior IT roles become part of the SLT team which is unlikely to ever happen in small schools with the constant budget constraints.

 

I have often been told by the head that they consider me part of SLT, I am often spoken to regarding key decisions and my input is valued however in the last couple of years, since the horrific budget cuts, I am rarely asked for input and coming to me for advice is almost a secondary reaction once something they have done has gone wrong.

 

I have taken the decision to not rock the boat, as with all of the budget cuts, I would rather hang on to the job for now than be made redundant, though at the moment, even that isn't probable as the school couldn't afford to make anyone redundant.

The site manager at this particular school has a real hold over the head and does not consult with SLT, he has his own order book and makes orders as and when necessary. He is someone who can get stuff done but very old fashioned and IMO an awful project manager who contacts none of the key stakeholders in a project until the poo hits the fan and he realises he should have involved people he didn't.

The head considers both me and site manager as equal when it comes to set up of cameras and managing them, it is just he is friends with the 'security consultant'.

 

I am going to suggest to the head the following for now...

I add the 3 cameras as requested.

 

We have one physical system that runs Paxton. It is an independent piece of hardware. I propose to add all of the various NVR software packages to this device so that all cameras can be accessed and video downloaded from this one machine. This will involve joining the various NVRs the site manager has installed around the building onto my network and management VLAN which shouldn't be that difficult to do. I will then provide him with an RDC link to the system, I will also have one too. Then all cameras are contained on one system that either person can access as well as Paxton for editing or adding new users. That ticks the box in that either of us can access all cameras.

We will keep the existing software in place on each of our systems so that should the server fail, we still have the other computers as a fall back.

 

And then moving forward...

My original suggestion of one centralised system has been batted back a couple of times because of cost implications so I will again re-suggest it but make it clear that these constant issues arrising re people not being able to view cameras is such a massive waste of time. We wouldn't need the consultant's time if we could just a centralised system, and we wouldn't need these constant time consuming discussions over how to move forward which costs money as we are being paid to work. The server room would be ideal as I have the rack space and plenty of patch slots as well as UPS power redundancy.

 

Let's see what happens, but just wanted to see the opinions of others and I really do appreciate the feedback.

A couple of years ago, I would 100% have raised my concerns formally, but with the way things are in schools at the moment, I am just glad to have my job. I document and note all of these sorts of things, so I have all the evidence to show what I proposed and suggested so there will be no come backs at my end.

 

Thanks again everyone for taking the time to respond. Again to reiterate, I very much agree... schools don't value ICT staff. It is such a shame and things really do need to change.

[mavhc]

CC everyone you can think of when replying with your concerns "but doesn't that violate the CCTV policy we have?" "doesn't having the same password as other schools violate our security policy?" etc. "It's a pity I wasn't consulted before spending all that money, could have saved a lot" "as you may recall in my email on the 25th of 10 years ago, I suggested that using the UPS would be a good idea in case the thieves cut the power"