non Capita Personnel Database

[User3204]

So.

 

Our Bursar has expressed concern that the Staff personnel details are being stored in the same database that all the Student details are being stored in.

 

She is worried that some staff (support staff) are able to access names, addresses, etc, etc, for the staff (IE other teachers).

 

So, I have been tasked to see if there are any other Personnal software(s) available, which there are, boatloads no doubt. But, obviously, I want something that is as easy to use as possible, doesn't link through to the SIMS .net database, but is stilll able to output files externally for the Census / pulse returns(or whatever the stupid thing is, that has the staff names), that we have to send up to the DCSF/LA every term.

 

Basically, she doesn't trust Capita to make sure that SIMS .net has enough security, or that it is working.

 

 

What does everyone else use ?

Has anyone else expressed concerns about this access ?

 

Does anyone have any useful solutions, that don't involve me being rude to the Bursar ?

[tmcd35]

Surely its the job of the NM to ensure that all users have the appropriate security set? That being the case if the staff are not alowed access to those details thier accounts on the MIS should be denied access to that area of the MIS? If this is not the case then the NM is at fault for not setting the MIS security permissions correctly.

[localzuk]

We use SIMS.net, like most people - the permissions system in SIMS.net is pretty robust - people can only see staff details if they are given permissions to! If some staff are able to see those things, and they're not supposed to, then their permissions have been set incorrectly. Any software will have this problem - ie. garbage in garbage out errors.

 

I would suggest that the Bursar needs to go on a training course regarding the system manager module, to be shown how graduated the control is, so her mind is put at ease. (I assume it is the bursar who is in control of the permissions in SIMS.net, as that's how it is here - our Bursar is also our SIMS.net manager. If not, then the bursar needs to speak to the person who does do this and get it sorted).

 

Also, pointing out that the majority of schools in the UK use the module would indicate there isn't a problem!

[SteveB]

Please also consider the headaches that will occur once Workforce Census is in full swing and you are having to manaully calculate from a Third Party app. Set the permissions so staff can't see any staff contact details.... done.

[jcollings]

As localzuk says - SIMS personnel is pretty robust. Most of our staff can't see personnel details such as addresses. The ones that can are meant to! It is pretty easy to make it that way and I can't imagine you'd find a product that is much different.

[Ric_]

AFAIK you would have to keep at least a subset of the information in SIMS anyway because of the way that Personnel ties in with the timetabling functions.

 

I believe there's also ways to leverage your Personnel data in FMS too so that you can do budget forcasting for wages, etc. Perhaps your bursar doesn't realise that there are additional benefits like this?

 

Another way to set their mind at rest would be to give them an account with the same security set as the person they don't trust and let them see what can and can't be accessed.

[GrumbleDook]

A good exercise to do to understand data ownership is to view all the present options and groups within System Manager and create your own groups rather than the Capita pre-defined groups. You can then document what access you have given to what groups and who is a member of those groups.

 

It will also help your bursar understand how granular access can be.

[vikpaw]

Agree with Localzuk and the others. I made a video yonks ago demonstrating editing sims permission groups.

 

See these threads, maybe even direct the bursar to the threads.

 

http://www.edugeek.net/forums/mis-systems/14949-restricting-access-sims.html#post150403

 

http://www.edugeek.net/forums/mis-systems/13003-sims-support-groups-permissions.html

[Sivadam]

The Permissions in SIMS as defined by System Manager are EXCELLENT.

 

Sometimes this cannot be said of the ability of the person appointed as System Manager. It is vital that this person fully understand how SM works so that fears expressed in the original post are allayed.

[Jamman960]

I guess this is similar to how many schools had Admin and Curriculum networks and have since(in most cases) scrapped one of the networks in favour of having one network with good security in place to ensure people only see what they need to see. As above I'd stick with the one database for everything and ensure the security is configured correctly.

[MattMitchell]

Sims has good granular control over access - for example, I'm data manager at our site but I can't view employees' personnel records, because I don't need to. It's quite a fine level of control.

 

As others have said, things work better when you use sims's personnel features fully. Rolling your own system will probably be far less secure.

[User3204]

Ah so I take it everyone uses SIMS for this stuff then.

 

It's funny I bet no other industry stores its internal personnel data in the same software database as their sales/customer data... but anyway.

 

 

The trouble is recently we've started putting these details into SIMS .net and it has become apparent that certain groups have more access to data than we expected them to, for example the "School Administrator" group can see all the staff details (which in hindsight makes sense), but we found that we have had to give out this level of access to enable certain support staff to do their job (the KS5 support assistant needs something in this group to enable them to do the EMA, but we can't see what it is).

 

...and before you ask the previous system was paper based... but with the workforce census, it means we have to computerise it all.

 

 

Part of the issue is that there is no single person in charge of SIMS, for good reason, as we tried to spread the responsibility when the last SIMS Manager left, so we all knew what was going on. What we need to do is spend a week on working out what the SIMS permissions are, what the staff need access into, and then creating the requisite groups.... but I was hoping for an easier solution. We've looked at the permissions spreadsheet before and fact that it runs to 15 pages (a3) means yes it is really granular, but I have problems knowing what the things mean and it will take a while to go through stuff.

 

The easiest, quickest and most secure solution is to pull it all out of SIMS put it into a new database, and only allow Personnel staff access to this new database. We use Sage for payroll for this exact reason and in this way, there are only 2 users able to use Sage, and I'm not one of them.

 

Oh, and just because no one else has complained about something doesn't mean that no one else has noticed (or knowing most users, grumbled quietly in the corner).

 

Thanks anyway, I think I'll keep looking around, possibly CMIS could help.

[localzuk]

Sorry, but if you don't care to learn how to set up permissions, then any solution you implement will still be full of holes. Why not simply do as suggested, and learn how to use the software? Security by obscurity is not true security.

 

The integration of the various parts of SIMS.net are there for a reason - to make running a school easier. Personnel is integrated into Nova-T, it is also able to keep track of all your different census requirements easily. Why make your life more difficult in the long run because you can't get your head around the permissions in the short-run?

 

If you're unsure about it, why not contact Capita and have them set it up how you want? I'm sure that'd be cheaper and more effective than licensing an entirely different system.

 

Our finance officer has no access to personnel. There is no reason you can't set this up correctly!

 

And, comparisons between industry software and education MIS systems don't work - schools are not businesses, plain and simple. A SME doesn't normally have a piece of software tailored directly to their enterprise type. A large business would, but they'd have a lot more staff than a school has. So, MIS's are there to make the 'business functions' of a school simpler, by integrating them.

[K.C.Leblanc]

It's funny I bet no other industry stores its internal personnel data in the same software database as their sales/customer data... but anyway.

 

Apart from any accounts package that does both payroll and invoicing.

[Jamman960]

I really don't see the issue with having both employee and customer data in the same place - keeping students out of sims is just as important as ensuring staff members don't see each others details.

 

One thing you could try is creating a cloned custom group with the same permissions as the school admin group. Then all you'd need to do is remove the excess permissions.(create a custom group then in the group permissions tab select add role then choose school admin). This should take all of 10 minutes and provide a quick fix

Edited October 26, 2009 by Jamman960

[skunk]

You should have a policy that shows the person running SIMS who should have access to what. I would start with saying no one has accesss to anything, then add the permissions that they require to perform their job.

 

IIRC if you create your own permissions groups then with regards to Capita support, you are on your own.

[MattMitchell]

It's funny I bet no other industry stores its internal personnel data in the same software database as their sales/customer data... but anyway.

 

No, only the ones with effective software for management do.

 

Most business management software, ESPECIALLY where interactions between staff and customers are managed (e.g. sales management, support ticket systems), will link some of the personnel data to some of the customer data to some of the "interaction" data. The alternative is to have the same information stored in separate locations, which is a severe no-no for data integrity, and really does not work well in terms of scalability.

 

The way to do it, is to have a sufficiently granular and sophisticated access control system that allows staff (and sometimes customers) to see what they *need* to see, to change what they *need* to change, and not to access what they do not need to.

 

You could do this by implementing a second system, in parallel with SIMS: one major drawback to consider, is that you would need to update SIMS from the personnel system, or to update the personnel system from SIMS. How would you implement this? Obviously, having someone copy the data manually is unacceptable from the point of view of accuracy (as humans make mistakes quite frequently).

 

Another solution would be some kind of import/export script that copied data out from one system and then into the other. If you went this route, then you'd have to restrict the access, so that the script was only allowed to output the data it needed to. How is this a better solution than making sure that the relevant staff can or cannot access the data directly from within SIMS?

 

I'm assuming that you have students' work, internet email traffic, student assessment data, teachers' files, and administrative data (finance, personnel, etc) all on your network. Do you run each set of data on a separate set of physical wires, along with separate network cards on each machine, etc? I'm guessing the answer is "no", because you have access control measures in place instead.

 

SIMS (and any other decent MIS) can do this as well. To be honest, to have completely separate personnel, finance and academic management software systems would be a severe backwards step, and is likely to raise far more issues of security and data protection: I'll bet large sums of money that staff will send sensitive data of various sorts around in things like excel files, emails, and printouts.

 

Learn the permissions system in SIMS, consult to find out who needs to know what (you may want to change things from the defaults), and set up your permissions accordingly! It'll be a lot simpler, more effective, less painful, and also cheaper. If training or knowledge is an issue then get some training/consultancy/manuals. It's cheaper than trying to write an in-house system, and it's far better than trying to link a third-party solution. If you have trust issues with data management/admin/it staff then these should be addressed, and installing two software systems will not fix them.

[matt40k]

Totally agree. Part of SIMS's biggest problem is the fact they make it too easy to export data, I know someone's going to argue with me, but if actually think about it, any technical person with enough time on there hands could setup a "text parents" or whatever company without getting any checks etc and get a number of schools to buy into it.

 

At least Capita cares even if the Government doesn't about checking out providers, you think they have a partner scheme for software developers and for photographers.

[Ric_]

Totally agree. Part of SIMS's biggest problem is the fact they make it too easy to export data, I know someone's going to argue with me, but if actually think about it, any technical person with enough time on there hands could setup a "text parents" or whatever company without getting any checks etc and get a number of schools to buy into it.

 

At least Capita cares even if the Government doesn't about checking out providers, you think they have a partner scheme for software developers and for photographers.

 

Totally agree with you on the export thing... I've thought for some time that it should be possible to audit who's exported/printed what. Surely it would be good to know that Mrs X or Mr Y has exported a list of all the kids in the school for instance?

[matt40k]

I like the idea of using API keys, just think Capita can't do it as others would moan.

[localzuk]

I like the idea of using API keys, just think Capita can't do it as others would moan.

 

The issue is this - if users can't access their data via MS SQL, they need access in some other way. There are many legitimate packages that require this access, regardless of whether you think they should have access or not. If Capita introduced some form of API key requirement etc... then all that would do is force companies to fiddle with the MSSQL database instead.

 

Also, we all know that such a scheme, were it implemented, would inevitably incurr a charge of some form. This would not be acceptable to anyone who is doing open source coding.

 

It potentially would even mean that they'd end up in trouble for anti-competitive behaviour.

 

You can't have it both ways.

[MattMitchell]

Audited exports is probably the best way - although it's always possible to get round that by accessing the backend RBDMS directly. There will be times when it's reasonable and necessary for someone to export a list of contact addresses to other software, or get a contact list for a school trip; maybe the trick is to make sure that if you don't feel you can trust someone with that kind of information, then they aren't allowed access to it/a school/children...

[matt40k]

Be nice to have the API key, I mean WordPress does it, at least then you have a list of companies that can access SIMS and some basic details, even if the process was an online form. Pulling out stuff like Staff bank details ofcourse would need a special key, unlike getting firstname\surname.

 

Solving the accessing the database issue is quite simple actually, depends how evil you want to be about it. Best way would be to encrypt the database... isn't that an option is MSSQL2008... oh wait, that's enterprise ed.

[User3204]

Oh dear, I seem to have upset a lot of people, infamy, in-for-me, they've all got it infamy....

 

 

Still, the problem is the scale of the permissions spreadsheet and the fact that Capita are due to upgrade the System Manager soon, I'd have to check the timeline to know when. So I'm not overly keen on learning how the old system works only for them to change it. Especially when Phil Neal (the Man himself) has a comment in another thread saying how it is not something they are proud of - check the phrasing but this was the gist.

 

Currently we have all the SIMS accounts integrated with our domain accounts, which I have managed to match up so that staff in finance are in the "finance" group and receptionists are in the "reception" group etc. So I can give finance access to the finance shares/sage based on this reception staff have access to the late sheets. The trouble is, I don't know what they do within SIMS, the only way to find this is to check with the Admin Manager who has to spend a lot of the time micro managing them (because some of them need it - you know what I mean).

 

I'm also not in charge of SIMS, the main SIMS coordinator also has to do timetabling (and we've made his job harder by introducing the IB - which has caused more grumbling by people). So between them two and myself trying to arrange when to get together for a long time to work out what staff need to access and then how to give them access.

 

 

So really, what is the simple and quickest solution.. really.. ignore it and wait for Capita to catch up with Sysman ? I was working on this plan, until the Bursar mentioned her concern.

 

 

Yes, yes, security by obscurity, well it works for the systems you have. One of the things that came up in the little meeting we (our internal ICT support) had was, if you want to find the details of a staff member who has a child (or even just used to) at the school, all the details are there to all staff, as it is acceptable for the teachers to be able to see the pupils/parents home details (but not apparently the other staff). If this is not a concern of your SLT/Bursar then okay.

 

 

I can't see any reason why anyone would use the same database for the personnel and whatnot, as most people use different accounts for paying salary an invoicing, we all must have different databases for SIMS .net, SIMS FMS, Tucasi (for invoicing students), Sage (or whatever payroll package is used) and then we have another software for contacting the bank. I know this as there is no single package to do all this. Ideally it would be all clever enough to map it all together so it all knew that person1 on X package was also person1 on Y package - but it doesn't all map into the LDAP domain like that yet.

 

 

As to the auditing, I would like to be able to see who made changes etc, as it would have shown up which muppet decided to change a students forename back and forth between 3 different names (and not just spellings, but completely different names) about 10 times.

 

 

 

 

 

 

 

 

....and this is the longest post I've ever written... I'm off for a nap...

[matt40k]

Right, SysMan 7 should have been out by now, or at least the beta. No such luck. I did comment to the SIMS release manager that they are planning rather a lot for August and bucket loads for Autumn.

 

I keep hearing mix things about SysMan 7, I know it's a pain to do, not sure why, but then again, I'm not a programmer. I've heard, not until everything is .net, i've heard not until silverlight, no idea why you would need silverlight for SysMan 7.

 

I really can't see how SIMS permissions is that much of a problem, I know there are bugs etc, but generally it's alright. I personally give everyone Classroom teacher access then go from there. This gives them access to most pupil data, there own staff record (i believe) and not much else.

 

Who ever does timetabling, gets timetabler, whoever does census gets school administrator (believe this gives you import lookups), personnel officer for the person who adds staff and does the workforce census.

 

Finance stuff we use FMS, which pulls the staff details from SIMS to work out pay commitments.

 

People may moan about Capita, but it's the biggest for a reason, it's the best... 99% of the time anyway.