[Development] An Open Source Parent Gateway

[PiqueABoo]

Nit-pick: pen is an abbreviation not a TLA.

 

Mixed feelings about that, on the one-hand discouraging amateurs lacking a "security mindset" from exposing the crown jewels to the world is probably a good thing, but it reads like "You can't afford to do this so don't even try".

[CyberNerd]

discouraging amateurs lacking a "security mindset" from exposing the crown jewels to the world is probably a good thing

 

One of the reasons I was advocating the use of tried and tested framework such as moodle

[pcstru]

I recommend that every iteration of what you implement is externally PEN tested by a recognised organisation - the fines on the school for exposing data to the wrong people are crippling. Make sure you deal properly with court orders; once a court order is issued the excluded parent must not be able to see any details of the child.

 

Thanks Phil. If we can learn from the mistakes of others, it's always useful. It's like standing on the shoulders of giants. Every iteration must be particularly expensive for an organisation using Agile development methods?

[matt40k]

Sorry, the cost of PEN testing vs the fine alone makes it worth while. Not before you think about damage of data getting into the wrong hands. If it's only internal then it's a different matter. If you're opening it up to the internet PEN testing is a must. Remember, if you're on a LA connection, they will regularly PEN test the connection and they may be able to give you reports for your sites. Just note this won't be application testing, so it won't be as detailed. But it's a start, before you go live you may want to look at getting it specifically tested - this is the bonus of using Moodle (like cybernerd said) or similar, as this would have been tested by others.

 

PS: You wouldn't be making many changes to the live site surely? Only the dev site would be changed regularly, other then (hopefully) content.

[pcstru]

Sorry, the cost of PEN testing vs the fine alone makes it worth while.

Say what? When I worked for a software company, commissioning external 'penetration' testing of a specific application cost £20K a pop. For that a company would essentially provide an indemnified certificate against a specific version on a specific configuration. If you were ISO9000 or similar that actually matters - maybe.

Not before you think about damage of data getting into the wrong hands. If it's only internal then it's a different matter. If you're opening it up to the internet PEN testing is a must.

Right. Err ... you don't think INTERNAL threats are an issue - in a school? Good to know no students are going to be having a go, from the inside as it were.

Remember, if you're on a LA connection, they will regularly PEN test the connection and they may be able to give you reports for your sites.

Will they indeed! I've never seen that in an LA contract and I would have expected to given that doing so without the schools permission might lead to criminal prosecution under the computer misuse act.

Just note this won't be application testing, so it won't be as detailed. But it's a start, before you go live you may want to look at getting it specifically tested - this is the bonus of using Moodle (like cybernerd said) or similar, as this would have been tested by others.

I doubt that Moodle actually qualifies in the sense of professional quality standard driven PEN testing. I couldn't point anyone toward certification of testing, test scripts ticked off, QA sheets signed by professionally indemnified persons. With moodle, apache, MySQL, Linux, Ubuntu/Red Hat/Centos/Debian etc, Perl, PHP - I'm going to have my work cut out putting together a platform that complies to any reasonabe quality standard without actually commissioning 3rd party testing for my environment - sudo forbid that If I actually did, I could then ever afford to apt-get update. It's interesting though that you think Moodle is secure given the lack of certification. Good job people like me don't contribute to the code writing mucky old SQL! No, luckily it's all done by consummate professionals ... err ... somewhere via... err, some ... err ... API ... thang ... or summat.

PS: You wouldn't be making many changes to the live site surely? Only the dev site would be changed regularly, other then (hopefully) content.

 

No. Lord forbid anyone even so much as changes their password lest I have to get the whole network signed off by an external agency ... again. Perhaps ... oh, I dunno, Capita could offer a service of something. Save us from our data and deliver us our hosting, for thine is the securely-penetration-tested-cloud, the bandwidth and the latency, forever and ever, ahmme..., profits! Trebles all round!

Edited March 24, 2012 by pcstru

[matt40k]

@pcstru - For a smart person you are being extremely dumb. We are giving you free advice that will prevent you and your school getting into trouble. I hope someone who knows where you work informs your employer\LA and ensure you follow the correct procedures. Otherwise we look forward to reading about it in the newspaper and we'll be posting our comments of "I did warn him...". I'm amazed Phil Neal actual posted as he normally stays clear of such posts - he does refer them them later on however

 

Internal use is limited to physically being onsite (unless you have some external access) and users are subjective to the ICT policy, UK law etc. If a student or member of staff hacked into something, they would be subject to school discipline procedure (and UK law etc if required) and could be easily dealt with (ie sacked, "slapped"), a person in China hacking in would be much, much more difficult to deal with and would take a lot longer too.

 

LA PEN tests everything it controls - part of GCSX, COCO, PCI-DSS and all those other policy's they must follow and standards they must meet. If they've already got a package for external testing, my comment was to ask them if they could include your website in the list - ie extend what they do currently by testing your website (assuming it's hosted at the school\LA?)

 

Moodle and others, are just frameworks, following a framework means that the underlying technology is dealt with by someone else, you just deal with the content and add-ons - allows you to be more agile too. It's smart way to work and that's why nearly every major player does it. Apache\Perl\Linux blah blah blah is just a pointless comment, it's getting onto managing the server which isn't part of the discussion, if you do it all, you need to follow security alerts and ensure the server is patched regularly and you've hardened it correctly and a million other things. If you buy a hosting package, they should be doing it otherwise you shouldn't be using them for sensitive data. Google\Microsoft offer such services, your LA will most likely offer web hosting too. It may or may not meet the requirements for what you want to do.

 

IMHO your a failed software developer (possible your old work went bust so perhaps a harsh complete) and your trying to make your current job into something you want rather then what it is, what it needs to be. I find it extremely disrespectful that you find Capita numerous interface useless, the Capita team have more knowledge, experience and understanding then you could ever hope to have, which is why I don't get why you blatantly ignore it. Even if your LA refuses to assist, which to be fair, they might not be able to support so it's a reasonable thing - actually they won't 99.9% of the time. But if you were determined to do this and your school was backing you, you contact Capita - a quick look on Capita's website gave me the name and contact details of the person in partners team at Capita. I've dealt with him before, so has Penfold, ok he might not be willing to give out everything to anyone who asks, but they will help. You'll have to start off slow and build up to the large bits, but shortly that's how all programmers work?

 

I know no-one likes following all the polices and procedures - I personally really hate it. But we all must do it, so we do. It took me over a year to get our SOLUS3 server setup, it took me longer to do the first design document then it did to build and configure it! If policy wasn't needed, it wouldn't exist and although it may seem silly to you or others, it is important and must, MUST be obeyed.

 

Sad facts. Most open-source software (on here anyway) are one developer. The project dies when the developer moves on, gets bored or gives up. If you've (anyone reading this) had a "unique" idea*, your most likely not be the first one to come up with it, there are 22,000+ schools using SIMS, all doing the same thing - running a school. There are, Capita claim, over 200 partners - someone has most likely already build that "unique" idea. My first draft of this post, most of it got lost.

 

* By unique I me anything other that what Capita should be doing (ie not a bug fix).

 

I REALLY don't want to read in paper about a pedo who hacked (or paid someone to) into a schools parent gateway because some lazy (explicate word) couldn't be bothered to follow a few simple rules and build it the right way. Don't cut corners, it will cost later. If you honestly don't think it'll never happen, I hope your right. But personally, I would NEVER risk it.

 

PS: Plus if anything bad did happen, it would mean we would all hear about it again and again from Capita as they try to sell us some more rubbish add-on.

Edited March 25, 2012 by matt40k

[pcstru]

@matt. You are probably right. I do recognise that I have vast oceans of ignorance at my disposal and since despite your best efforts to help, I remain confused, I must be being extremely dumb.

 

I’m perhaps most confused about the API and mandated use of it. If I use the API, I will use it to extract data which I will then import into the other database (a fairly common approach as I understand it, or at least that seems to be what a number of different suppliers systems do – Parentpay, nationwide, truancy call, moodle, ParentMail, etc etc). So I might pay the supplier for the API, learn to use it which will probably take a week or so (maybe a lot longer for a failed software developer ), craft some specific procedures together so that I can make the API calls in the way that the API demands which will probably take another week. After all that I might have the data sitting in the other database, a task that took me 5 minutes and cost £40 with the tool that I initially ‘recommended’. As far as I can see, I’m no better or worse off in terms of security, since the API was only used to transfer data, in bulk, out of the MIS. It’s doing nothing for me at the application side – how could it? But I have just spent a few weeks of taxpayers money to get somewhere my ignorance could have taken me in five. Ignoring all the other fluff – can you please explain a bit more what I am doing wrong there – where exactly is the flaw in my plan?

 

I find it extremely disrespectful that you find Capita numerous interface useless, the Capita team have more knowledge, experience and understanding then you could ever hope to have, which is why I don't get why you blatantly ignore it.

 

I had to read back over my posts because I don’t remember being disrespectful towards the SIMS API. I don’t see it reading them again, so perhaps you could point it out? I actually blatantly ignore Capita’s API because we do not use SIMS, as I said in an earlier post (which you obviously took care great care to read).

 

I hope someone who knows where you work informs your employer\LA and ensure you follow the correct procedures.

 

And people wonder why some folks value their anonymity.

[vikpaw]

I wont be using a live database for this Its all on a test SQL instance for now.

 

Is there any official documentation for these API's? How do I get hold of them?

 

Contact @David_Grashoff with specifics of what data you want to access, and he'll be able to advise.

 

Command Reporter will work well for most things though, if you read on some of the other specific threads there are some complications and limitations, especially when automating it. Certain reports that work directly in SIMS, wont necessarily work automated.

 

Personally, i don't see anything wrong with porting a backup of your data to a test server that is internal only and locked down. Then extracting what you want with your own queries. It's a pain making sense of the structure and you have to change what you've done if they rearrange the data in the system during upgrades.

 

TBH you only want really basic info out anyway and that can all be dumped on a report. Accessing linked documents might be harder and how you make them available, but the concerns with wrong parent etc. are equal in any system. So long as your public site is locked down to a high standard. Go for separate parent logins though as recommended.

 

BTW @matt40k - @pcstru is a CMIS guy, so chill - we don't care if he mucks up 'their' system.

[GrumbleDook]

@matt40k and @pcstru

 

The reference to LAs performing penetration tests is a little misleading and will vary from LA to LA. If your schools connects into the NEN (and hence to JANET) there is a duty by the RBC / LA to ensure that the network is not left vulnerable and so are likely to actively monitor traffic and what is open on the various ports. This can include doing remote system checks to see if there are common vulnerabilities open. This does not require anything specific to be tried to see if it can be 'broken into' and the aggressive testing on specified IPs is something different and most will only do it on request.

 

It is also worth saying that you are on *their* network. Depending on what type of school you are you are technically part of the same organisation so before anyone starts throwing round things like Computer Misuse Act it is worth finding out what is checked, who has authority to do so and why. If you are on a network that crosses over onto a GSi family connection (GCSx, N3/N4, etc) then I would struggle to think of any school that could operate fully with the agreed CoCo ... and connection into it is likely to be limited, heavily controlled and with a lot of caveats. Having spoken with a number of LAs involved in ContactPoint (before it was binned) and eCAF ... those who were allowing schools to connect in their GCSx lines only did so via a Citrix / virtualised front-end ... we certainly didn't go down that route and kept schools and LA very, very separate ... which kept the LA IT folk happy and meant that unworkable restrictions where not put on schools ... but a lot of advice to schools was given and the attitudes of many for security was very scary.

[PiqueABoo]

One of the reasons I was advocating the use of tried and tested framework such as moodle

 

I was just responding to the preceding post.. wasn't a comment on the pros/cons of earlier comments.

 

---

 

I REALLY don't want to read in paper about a pedo who hacked (or paid someone to) into a schools parent gateway

 

FUD glorious FUD. Things I think are true, anyone is free to correct:

 

1) Not pointing any fingers in any particular direction, but I've tripped over exploitable serious security vulnerabilities in some stuff from some large vendors. Far as I'm concerned none of 'em deserve your trust simply because you've heard of them, it's a long-standing product with some discernable market share, they say it's wonderfully secure, you haven't heard about it being hacked or whatever. For the most part proprietory school systems/software has had an easy ride re. security because folk who hack things well generally have more interesting targets.

 

2) I'm not aware of a school being fined by ICO for anything relevant yet, as opposed to undertaking to pull their socks up. We had the publicised school with password reuse issue last year where hacked credentials retrieved from one system got them into an independent (MIS) system - you really ought to think very hard about the implications of user password reuse, also of AD integration.

 

3) The main risk reading data out of anyone's undocumented DB is of course interpreting it wrongly e.g. you may have to decode the meaning of obscure content in several fields to accurately decide whether some Widgit record is active, whether it should be collected or ignored. The main benefit of APIs then is that they ought to do that work for you. However the DBs I've pillaged don't have APIs I can get, so I've just painstakingly reversed stuff like that and OMG(!) one vendor update even changed the contents of a rather critical field once, but ::shrug::

Edited March 25, 2012 by PiqueABoo

[matt40k]

Microsoft released Windows XP with over 10,000 bugs, the were aware of them and they believed that they could fix them before they became a problem. Pretty much every software company does this. OpenBSD is the only people I know that won't release software that hasn't be audited and fix. Let's face it, it's pretty limited - ok you can install on top of it, but it doesn't make insecure software automatically secure.

 

When you buy software, you buy the fact that when that bug is found someone will be working on it until it's resolved. With open-source software, this may take longer as developers have lives outside of the project - they need to pay the bills like everyone else. You have to weigh-in the fact that you may have to switch it off until it's fixed. That they give you no warrenty, no SLA, just software that may or may not work for you. You should also accept the fact that you may have to switch to another project if they stop developing it.

 

Still it's the same as buy from a company. Just it's less risky (apart from the money aspect).

[zag]

Way to derail a thread people

 

Keep it on topic of development of an opensource parent gateway please. You can discuss the rights and wrongs of data use in another thread.

 

The work I have done is coming along well. I've got a template up and running, managed to get a test user parent logging in and looking at his sons report.

 

The main problem is the Command Line Report Exporting Utility can only do one file at a time at the moment.

[matt40k]

Way to derail a thread people

 

Well gave you time to work - so, where can we download it? Have you been submitting to github or such?

[zag]

Well gave you time to work - so, where can we download it? Have you been submitting to github or such?

 

I've never quite worked out github (I'd love a newbie guide if anyone knows of one?)

 

I'll make a new thread it in the web development section and host on google code like my other projects. Hopefully then people can start contributing to it.

 

I'll try and make it as modularized as possible to for example people can change the way they get reports into the system.

[matt40k]

The one they do is pretty good to be honest, once you've setup the directory, just use the GUI version to commit. I used subversion before and I did like the whole local repository thing. It's also alot better for forking (lovely word).

 

Will have a look at what you've done so far if I get a chance.

[vikpaw]

Will have a look at what you've done so far if I get a chance.

Don't trust him, he'll subvert your code, then charge schools that use it a bomb to fix the bugs he put in

[matt40k]

Shhh.... you'll blow how we're going to cover all our bonuses this year!

[Sivadam]

Shhh.... you'll blow how we're going to cover all our bonuses this year!

Don't forget my 10% for all the help I have been giving you!

[matt40k]

ROFL, you'll get a xmas card like the rest and you'll be happy!

[Sivadam]

ROFL, you'll get a xmas card like the rest and you'll be happy!

...... like the rest?

 

Just how many 'out of your area' schools are supporting you, so that you can support your own schools? No wonder your Team has a good reputation with lots of us guys around!

I bet you buy the xmas cards in bulk too! (or do you get the schoolkids to make 'em?)

Edited March 26, 2012 by Sivadam

[matt40k]

Na, we have a good deal with Capita. We pay them in xmas cards.

 

Ooo that's an idea.... could save a few pennies.

[bantonia]

Hi,

 

Thought I'd throw my 2 peneth in, I've been extracting SIMS data for some time now using the command reporter tool. I have a Java RMI server running on the SIMS server (could be a SIMS client) which runs the commandreporter.exe program as and when required, passing the parameters for the reports. These requests have been made by various Java clients, one example, updating Moodle students, staff and classes. The Java RMI server traps the output and sends the data as an object back to the client. I've also, as a proof of concept, created a "Learning Gateway" like site running servlets on a Glassfish server through the same interface. Obviously no write back.

 

It can be done, the only problem is the speed of running SIMS reports!

Edited March 26, 2012 by bantonia

[zag]

Hi,

 

Thought I'd throw my 2 peneth in, I've been extracting SIMS data for some time now using the command reporter tool. I have a Java RMI server running on the SIMS server (could be a SIMS client) which runs the commandreporter.exe program as and when required, passing the parameters for the reports. These requests have been made by various Java clients, one example, updating Moodle students, staff and classes. The Java RMI server traps the output and sends the data as an object back to the client. I've also, as a proof of concept, created a "Learning Gateway" like site running servlets on a Glassfish server through the same interface. Obviously no write back.

 

It can be done, the only problem is the speed of running SIMS reports!

 

Thanks for this.

 

I'm glad someone else is doing this with success!

[zag]

Would there be any interest in a "mass mailing" function.

 

Basically it would match the student reports to the parent and email them.

 

Are people doing this in another way already(don't want to reinvent the wheel)?

[matt40k]

The umm, SIMS Document Management Server (DMS) - IMHO - is dated and needs Capita to update it. The way Capita deals with it with regards to SLG is the get the end user to upload to SLG. Which you could argue means DMS is pants, or you could say they don't want everything avalible via SLG unless you explictly want it.

 

Just a thought...