Admin & Curric networks -a different spin on the old problem

[eean]

I know this one has come up before but I have a slightly spin on the age old problem:

Primary School

Current setup:

Admin Network - Server 2003. Set up with DIRE security (by a 3rd party company who STILL haven't managed to get the backup working )

Curric network - Server 2000. Set up by me (so is utterly brilliant ).

Me:

I'm just the ICT coordinator so none if this is really my business but it's so cr*p I feel that I ought to do something!

 

They are not directly joined at all, they share the same router for the Internet but have different subnets.

 

Aim: I would like some connection between the 2 networks. In the future I'd like to put in email or something in. I'd like the head to access planning etc.. on the curric network. It would also be handy for curric network to be able to print to admin machines via the wireless network.

 

Extra spin: I'm joining staff laptops to the curric network with files stored on the server and made available offline via synchronisation. Hopefully, I can set up a VPN for this to be done over from home. Problem is that some staff keep sensitive files (eg staff performance management) on their laptops or pen drives(!) and they are rubbish at locking computers and having good passwords. That ain't going to change and it isn't practical to ask them - pc's drive the whiteboards and staff will inevitably leave them logged on all day.

 

So, hows about:

1. Join the networks. What's the best way? Just put them all on the same IP range? (I would quite like to keep them separate, mainly so the curric network doesn't get 'blamed' for causing problems on the admin network.) How does this work with handing out dhcp addresses? Or something better/more secure.

then

2. Give staff a username on the admin network (with complex password requirement). Can I then make it so they connect to the admin server from the curric network but are prompted for their admin password on the (rare) occasions they want to access admin files? Can they also keep the admin files offline on their laptops? How will that work when you sync back up - will it prompt for the password?

Can I make it so that the admin password CANT be saved by ticking the box?

I would quite like to enable encryption for the admin files. If I log onto the curric network then map a drive to the admin (using an admin password) will windows be able to decrypt the files? i.e. will it use the share password for the key or the windows password? (If it is the latter, can it be made that the admin and curric usernames can both decrypt the files?).

 

Or, just KISS and use some sort of 3rd party folder protection for sensitive files - recommendations?

 

I know there's a lot of issues here. Thanks for reading!

[blackcat]

I'm not even an ICT co-ordinator, but from what I understand of our place, the two networks are now one. Curriculum pcs use DHCP and admin pcs, including laptops have a fixed IP on a separate subnet (I think). The sensitive stuff is on a separate logical drive and permissions are set as appropriate, so that only those pcs within the fixed IP range have access to the sensitive stuff. This means staff have to use a laptop or pc in the staff rooms to access admin data. . Staff have one login and can access everything from the staff pcs. Don't ask too many techy questions in reply, but I'll try find out. Hope this makes sense.

[djm968]

Have a look Domain Trust Relationships

 

http://technet2.microsoft.com/windowsserver/en/library/108124dd-31b1-4c2c-9421-6adbc1ebceca1033.mspx?mfr=true

[eean]

Thanks for your replies so far.

so that only those pcs within the fixed IP range have access to the sensitive stuff.

I think we'd need it accessable everywhere but via an extra password ontop of the normal windows password.

Anyone else got some ideas on this one?

[Guest monkeyx]

I menioned this in another post yesterday.

 

In theory it would allow you to assign different password policies to users groups at a domain Level.

 

Not had a chance to test it, so can not verify how well it works.

[eean]

Thanks, but not really going to solve my problem. I'm not looking to have 2 domains so that I can enable complex passwords for some users.

What I'm trying to do is add an extra layer of security above the teacher's standard logon. Windows won't let you connect to the same server with 2 different usernames, so it's going to have to be cross domain.

[nicholab]

It a good argument to tighten security on both networks. If you are using SIMS it requires you to log on again. Joining the network will improve security and patch management. How do you think it will interfere you are just going to be turning your admin server into a member server. You can do static DHCP by assigning ip address based on mac address. Have you tried a server in the no inheritance container in AD we had a problem with are nas box and you could not access files.

 

If people have accounts on both networks you got your work cut out.

[Guest monkeyx]

Article is about apply multiple passwords in a single domain ?

 

Found this google. Not sure if it works on Windows Server though

[MkII]

We have 2 domains staff & pupils, all interconnected. We have strong passwords set on the staff domain, relatively loose 5 character p/ws on the pupil domain. There's a one way trust between the domains, staff can see both, pupils can only see their own.

 

Staff PCs are used by pupils by SMT decree. Logins and NTFS permissions determine access.

 

Our weakest point is if a member of staff were to let a pulil use their login, or divulge their paswords, which does happen. This is a matter for SMT to sort.

[sparkeh]

First off let me put my hands up and say I’m dead against joining the admin and curriculum networks. Having some responsibility for Data Protection in my role makes me very cautious; if I have to pick up pupils reports and performance management reports that are left lying around the printers who knows what teachers leave on their laptops for anyone to see! The penalties for breaking the Act can be severe. Currently all the schools I work at have a single physical network separated into admin and curriculum via VLAN. Access to the MIS is restricted to those who actually know what they are doing so we don’t end up with a school full of pupils named George

 

I'd like the head to access planning etc.. on the curric network

 

To achieve this at one school we simply stuck another NIC in the Head’s desktop (one to admin and one to curriculum) so that she could access the files on both networks.

 

In the future I'd like to put in email or something

 

Could you clarify how this is affected by the network config? I assume you want to run an email server?

 

Just put them all on the same IP range?

 

Now I ‘m not sure on this as I don’t get involved in the admin network much but I believe that where I work, the admin stations need to be on IP addresses fixed by the LA so that your MIS works correctly (ie sending and receiving data to LA). Starting to alter admin machines could cause a lot of probs. Again I’m not sure but worth checking before you get going.

 

I realise that one of the motivations behind the trend to join networks is so teachers can easily get at data from the MIS. The way I am approaching this is by waiting for the implementation of our VLE. Once this is up and running teacher will be able to get at the info for the children that they need, and not alter it!

 

I know that this post hasn’t really helped you with your question on *how* to do it but may be of some use when thinking about *whether* to join the networks or not.

[Geoff]

VLAN's are not an effective security measure. If you wish to separate two networks, do it correctly with an air gap.

[sparkeh]

VLAN's are not an effective security measure. If you wish to separate two networks, do it correctly with an air gap.

 

Ah I didn't say it was, just that's how its setup around here and probably a lot of other places - before I started working in my schools the LA told everyone to buy VLANs, so they did! Every school I've been in in this LA has one.

 

Anyway given that I work in primary schools, I'm not too worried about the kids launching a VLAN Hopping attack

[Guest monkeyx]

I still can not accept that 2 domains is more secure. I am still fairly new to education sector, it seems to me that staff that have spent more time in the education sector as it has evolved, are pushing the 2 domain model, so there could be some issues I am not aware of. In my LEA there were 2 domains in the schools at one point for political reasons not technical

 

I have worked on some projects where security was much higher than in schools. Not many schools use smart cards for staff logins, which would help improve security. In most other sectors giving your password to someone else when working in a secure environment or leaving a terminal unsecured was a major issue! That does not seem to be the case in most schools. So implementing two domains in that instance works around the fact that staff are breaking security procedures, and is not improving security

 

Perhaps under BSF, the private sector IT firms will be allowed to enforce higher securtiy standards, as the network will be secured and enforced by them, rather than the school itself.

[MkII]

I realise that one of the motivations behind the trend to join networks is so teachers can easily get at data from the MIS. The way I am approaching this is by waiting for the implementation of our VLE. Once this is up and running teacher will be able to get at the info for the children that they need, and not alter it!

 

Teachers have access to the MIS here to take registers every lesson. Management want kids to use that computer too as otherwise it's a lump of expensive plastic and metal going to waste.

 

MIS Systems have permission systems, so only assigned individuals have access to change details.

 

If staff are logged into a VLE - the exact same problem exists... sensitive data exposed.

 

 

Perhaps under BSF, the private sector IT firms will be allowed to enforce higher securtiy standards, as the network will be secured and enforced by them, rather than the school itself.

 

It's not a technical problem really, more a problem of getting staff to carry out basic security themselves.

[sparkeh]

@monkeyx

 

You are right, working in school is very different to working in industry. I have done both and its an eye opener.

 

And yes you might be right that the two domain model reflects on the users inability to follow procedure. However, I am happier to use the two domain model and remove those problems than try to change the prevailing culture. Don't get me wrong, I am trying to build in good practice, but not on something that is terribly important. If users can demonstrate good practice then perhaps in the future I would consider a single domain, but we aren't there. Perhaps sounds patronising but I think we all have horror stories to tell

 

In essence I think its about providing a solution to the problem at hand. Technically a single domain might be better but it means nothing if, practically, you end up in the mire because people can't follow the procedure.

[sparkeh]

Teachers have access to the MIS here to take registers every lesson.

 

 

MIS Systems have permission systems, so only assigned individuals have access to change details.

 

Really? That's interesting. What MIS do you use and what phase do you work in?

 

If staff are logged into a VLE - the exact same problem exists.

Well as you pointed out above, they will not be assigned to do that.

[MkII]

Really? That's interesting. What MIS do you use and what phase do you work in?

SIMS .net > Capita

11-18

 

Well as you pointed out above, they will not be assigned to do that.

 

They can view sensitive documents needed to carry out their job. Just because it's on a VLE rather than a network share offers no more security when PCs are left logged in and unattended.

[sparkeh]

They can view sensitive documents needed to carry out their job. Just because it's on a VLE rather than a network share offers no more security when PCs are left logged in and unattended.

 

 

Sure, but was I more talking about the altering of data. My point was that if a teacher left a machine logged into the MIS then a pupil could potentially cause havoc. The way I want to set things up is that there is a one way link from MIS -> VLE meaning that yes, if the teacher leaves a VLE session running, the pupil can get at the data but not alter it. Still not good, granted.

 

Of course now I know that permissions can be set on the MIS this does alter things.

 

Obviously there is a great difference in the way that primary and secondary schools work. In my experience, with primary schools being much smaller, if a teacher needs some info, it is an easy job to pop to the office and request it. The risk of opening up the admin network does not bring sufficient benefit. In a secondary school, perhaps this is not the case.

[MkII]

Wreaking havoc isn't such a problem, that's what backups are for!

 

No - it's the laws regarding data protection that concern me, and that huge policeman that stands in the shadows with those shiny handcuffs.

 

Yes Secondary teachers are a lazy bunch, walking to the office breaches the workload agreement dontchaknow

[ctbjs]

From Sparkeh

 

First off let me put my hands up and say I’m dead against joining the admin and curriculum networks. Having some responsibility for Data Protection in my role makes me very cautious; if I have to pick up pupils reports and performance management reports that are left lying around the printers who knows what teachers leave on their laptops for anyone to see!

 

Why. The reason schools had two networks in the "old" days was because of the security vulnerabiliites inherent in the NT4 platform. Server operating systems are far more robust and security enhanced than ever before. I think you hit the nail on the head when you say "if you have to pick up pupils reports ..." and "who knows what teachers leave on their laptops"

 

This will happen whether networks are split or united, this is not a network issue it is more an educating the educator issue. Providing all the appropriate security measures have been taken by a responsible network administrator in terms of permissions and password complexity/policy there should be no reason why a school cannot operate on a single domain. The overriding problem in any school will be the neglect by teaching staff and indeed admin staff of their responsiblity towards confidentiality. This might be because of disruptive students causing them to forget to secure their pc but it is not an excuse. We have to do this on a daily basis when responding to calls (I am assuming you all Ctr-Alt-Del k) each time you leave your workstation?!!) and it is no different for staff. The discipline for this needs to be initiated and followed through by SMT.

 

Sure, but was I more talking about the altering of data. My point was that if a teacher left a machine logged into the MIS then a pupil could potentially cause havoc.

 

We also use SIMS and have created our own permissions for teaching staff that are read only and therefore, even if data is left open it cannot be changed.

 

I can understand those that are concerned with unauthorised access to data with the potential to change and delete items however, if, as mentioned above you are a responisble network administrator these things are part and parcel of your every day work and we should not be afraid to exercise our skills.

[sparkeh]

however, if, as mentioned above you are a responisble network administrator these things are part and parcel of your every day work and we should not be afraid to exercise our skills.

 

I'm not sure if you are calling my sense of responsibility into question here, I sincerely hope not, but think I am acting in rather a responsible way.

 

Depends on how you operate doesn't it. I maintain a solution that works and people are happy with. It might be more convenient to have a single network, but knowing how the users operate it will introduce problems, and where data protection is concerned quite serious problems. As I said, if I encourage staff to develop a more responsible attitude, as I am doing, and they demonstrate they can work in the correct manner then I will consider it. But I won't now.

 

I think an irresponsible manager would open it up knowing that there are potential problems but do it anyway.

[Oops_my_bad]

I just think some people are scared of change

[contink]

Taking all the opinions and examples of working practice into account... I'm wondering if one possible approach might be something like this:

 

- Limit access to a number of specific workstations (eg: staff room, PPA room) and accounts.

- Usual complexity, length password requirements for these accounts.

- Accounts with high level access have password screensaver setup to activate after short periods of time and autologoff after 30 minus

- Differentiation of accounts for classroom teaching vs' SIMS and other sensitive access

- SIMS access from other workstations is read only for staff accounts - unsure if this is possible but it might help with the "accidental editing".

- Forget about laptop access as a rule and provide it only as an exception when the staff member has proven they can handle the responsibility

 

Beyond that all the SMT backup, training and the like... ?

[ctbjs]

@sparkeh

 

I'm not sure if you are calling my sense of responsibility into question here, I sincerely hope not, but think I am acting in rather a responsible way.

 

Not at all, your sense of responsibility was not the topic of my discussion. It was merely to state the point that "Any" responsible network administrator should not be afraid to exercise their skills.

 

I am in agreement with you in that it depends upon how you operate and I for one am extremely mindful of Data Protection, hence teachers only are provided with read only versions of SIMS.net and are reminded of the need to ensure that their workstations are secure from access by students. I would reiterate that this is the underlying problem we face with regards to information being available to unauthorised personnel and that, like many other things in life, it is not going to be until someone is found with information they shouldn't have before it is taken seriously. In the meantime we must keep educating the educators.

 

@contink

 

I think the idea of having a SIMS logon account for a workstation in a classroom is a good idea as the teacher would only log on to that workstation to access sims and then have to log off and log on with their teacher account in order to carry out their lesson. It may cause them some frustration at having to do so but perhaps with some education and guidance they may realise the reason for doing so is in their interests.

[contink]

Further to that idea I figure setting the desktop wallpaper for the staff/SIMS account so it has something like "RESTRICTED ACCESS" or something obvious displayed that staff can recognise so they don't make any mistakes.