Smartcards?

[FN-GM]

Hi there,

 

Does anyone here use smartcards for staff? If so what is your feedback?

 

Thanks

[Antp]

i was just about to post a topic on this.

does anyone use them and whats your setup?

[Domino]

seems li

e a recipe for disaster to me.

 

as soon as kids learn teachers need something they'll scupper it

[sukh]

what type of smartcards and what is your goal for using them?

[FN-GM]

nothing in mind yet just would like to know opinions of others. Want to use them in one of my schools to reduce students accessing staff accounts.

[sukh]

interesting, but why use smartcards when you can use MS security, assuming you're using MS servers/clients on yr network? Spend money on other ICT investments :-)

[FN-GM]

Nothing else to spend money on really. What other security settings can i do to stop students shoulder surfing or staff telling them passwords?

 

All the laptops have smartcard readers, have some keyboards with built in ones so got the stuff.

Edited December 9, 2008 by FN-GM

[DrPerceptron]

Put in place an AUP which implies serious consequences for staff allowing their usernames/passwords to be used by students - perhaps hiding all their work to emphasise the issue.

 

Although you can't do it in 2003 networks, in 2008 you can enforce a seperate, password policy for staff (or whoever you want) so they can be forced to use an 8 character, multi-case password etc.

 

We haven't got that kind of problem here, maybe because our staff are aware of the risks - partly because we had an incident which came about through leaving a laptop unlocked with nobody in the room....

 

 

I never saw much point in the smart card approach - surely it's easier than a password to get hold of? plus I can guarantee staff would lose it (I don't even know what one is )

 

What about fingerprint readers? although I don't know how you'd centralise all of that and make it stick at logon...

[FN-GM]

Put in place an AUP which implies serious consequences for staff allowing their usernames/passwords to be used by students - perhaps hiding all their work to emphasise the issue.

 

we have it but students still look

 

Although you can't do it in 2003 networks, in 2008 you can enforce a seperate, password policy for staff (or whoever you want) so they can be forced to use an 8 character, multi-case password etc.

 

in place all users change passwords regular

 

 

It is possible to use both smartcard and password.

 

Nothing is set in stone i just want peoples personal experiences.

[sukh]

You can use w2k3 to enforce password with minimu chracters, lengths, requiremts etc...same as w2k.

 

Smart cards are a pain, what would be nice is biometrics. Very easy to set-up and straight forward. I'm only saying that because most banks/retails miust comply with PCI DSS. This way no-one can lose thier finger/eyes and it certaininly cant be shared. You can extend this to allow access to your schools and implement a automatic payment scheme for children who have school dinners etc...no more bullying for lunch time money (at some schools) and kids wont lose thier money.

[FN-GM]

You can extend this to allow access to your schools and implement a automatic payment scheme for children who have school dinners etc...no more bullying for lunch time money (at some schools) and kids wont lose thier money.

 

We have it for dinners, infact our school was the first in the country to introduce it.

 

I don't want to use biometrics as not all of our laptops have integrated readers in them.

[DrPerceptron]

You can use w2k3 to enforce password with minimu chracters, lengths, requiremts etc...same as w2k.

In 2003 you can have 1 policy, set at domain level, In 2008, you can have a different policy for every student if you wanted and had the insanity to do so.

 

 

 

Then I would say, if students still look, educate your staff in asking them not to look - I bet they wouldn't let their students look at their bank PIN if they were around at the time, this isn't much different.

 

Perhaps it's time to bring out the red mist and perhaps 'fake' a data security incident with a member of staff or ask a willing SMT to send an email about it.

[Domino]

 

It is possible to use both smartcard and password.

 

well, if you can do one without the other then you're not gaining anything from it...

[sukh]

In 2003 you can have 1 policy, set at domain level, In 2008, you can have a different policy for every student if you wanted and had the insanity to do so.

 

 

 

yes your right, read your post quick, thought you were confused about password/account settings in w2k/3

[EduTech]

I hope i get this right...

 

But we were thinking of implementing smartcards for staff, but only to use at home and accessing our VLE (still in development) this is because we were informed that accessing the school externally there has to be 2 sets of authentication.

 

Pretty sure thats right.. but that is the only way we were thinking of using smart cards.

 

James.

[Gatt]

Have considered trying smartcards - but maybe on things like our PCs & servers first and a few select classrooms....

 

Question is - how much?

[SYNACK]

Biometrics with fingerprints are a joke, a determined student would probably have an easier time of compromising the security by lifting a print than by swiping a card. At least you can see that the card is missing.

 

Two factor authentication would be the best bet for increasing the security by requireing both a password and a card or a password and a print. I don't think that the basic Windows authentication stuff handles this though and you would need to implement a third party solution to be able to require and store both centrally.