pete

Add in "Can I tell if HR have saved files with sensitive personal data somewhere they shouldn't / taken them somewhere they shouldn't?" "If I'm using file-based encryption, is it configured in such a way there's a get-out-of-jail mechanism if Fred (in HR) gets hit by a bus?" "Have I got auditing* turned on for shares / folder trees containing personal data?"

We're looking into it, but probably just going to poke and prod it about this year and (depending on how it performs) maybe use it next year. There's a couple of problems with it from my (data protection / security) point of view. It doesn't have a means to automatically honour the restraining order / removal of parental responsibility in SIMS. SLG did (does?). Parents who should no longer have access to information about a child still do until someone manually intervenes. Removing a student in SIMS local (or making them a leaver) doesn't automatically remove them from Options Online. Requires manual intervention. I had a ticket open to see if I can restrict staff/student logins to just our Office365 tenancy so access is removed when someone leaves. This thread has prompted me to check and the answer is "No, it's a whole-platform setting", which I've pushed back on. I think it's a step backwards in security from SLG and if we're choosing to make people's personal data available via an online service, we should have visibility into how it's being accessed and some insight into authentication failures. Social networking accounts should not (IME) be used as a source of authentication for pupil data that we're responsible for when there's a better auditable source of truth (our Office365 tenancy) already in place.

They're not bad either, though the automated billing/domain expiry required intervention from Emma to cope with .sch.uk domains.

Google suggests KB4048953 is the culprit and the solution may be to modify the service parameters:

Depends, are they willing to learn and develop their skills? Do they pick up information quickly? Sometimes you have to work with what you've got and you'll have to guide and educate them as they go.

If the school nursing team is providing vaccinations in bulk (BCG), they don't know that the Fred Bloggs in 9J who's just about to get his BCG is the same Fred Bloggs born on 01/09/2005 who lives at 29a Acacia Rd and is a patient of Dr Nick at Parkside Surgery in Nuneaton. And anecdotally, the school nursing team (for values of Lincolnshire) is sometime left in the dark by the rest of the NHS.

I'm not considering it, but I'd want a pay rise linked to the extra work and responsibility, taking into account how much time it'll consume initially (Payment 01*) and the year-on-year once it's running smoothly (Payment 02). *at say an hourly rate.

Your network team could set the URL of the SIMS document server as a trusted location in a GPO. Windows will treat simsserver:1234, simsserver.school.region.sch.uk:1234 and IPADDRESS:1234 differently when it applies the "is this from the Internet?" check. You can set trusted locations in Office and Windows via group policy, so it may be worth checking how the document server URL is configured and then whitelisting it as a trusted location. (NB: SIMS portnumber is not usually 1234, but when I put a colon and then "portnumber" next to each other I get a smiley).

That's good to hear. Lots of school retention falls under "just in case" or "can't be bothered to have a clearout", rather than the "can actually point to a legal need to retain this data". While some may find it helpful to have a last-ditch "was quite good at football" reference from an old headteacher, that doesn't justify the school keeping information on thousands of people long past them having an operational need to do so. Retention for 7 years after the date of leaving should cover all but the most unlikely requests. GDPR covers living identifiable people, not the dead - see Recital 27. Member states can add specific language about it if they wish*, but there's nothing there by default. *https://www.twobirds.com/en/hot-topics/general-data-protection-regulation/gdpr-tracker/deceased-persons

Try setting proxy options in DHCP (252 WPAD) and DNS (wpad.school.region.sch.uk) on your DHCP and DNS servers. If that doesn't work, set the default gateway of the connected PC to your proxy server, filter the logs by the IP of the PC to see what it's trying to contact and then set auth exceptions / allow rules as appropriate.

If you're changing an already-completed register it asks, IIRC.

Links to videos and transcripts. https://www.usenix.org/conference/lisa17/conference-program I'm currently enjoying the Danger of Celebrity in Tech (listen with headphones, commentary is occasionally NSFW unless the kids have gone home).

Our A2C installs point to \\server\sims\ExamConfig for their config, which is secured appropriately.

You can (Routines > Student > Delete Student), but only one at a time while referring to a "leaver, now older than 25yrs" report and each time it resets the search results and orders them alphabetically (when ideally you want by admission number). Which probably means our admin staff will be hunting @PhilNeal with pitchforks, as there's been CR* open for years about improving this functionality. *1402-1279373 and 1611-3557429, for example.

Try this as a starting point: IRMS Schools Toolkit - Information and Records Management Society (scroll down for the PDF).

56 > 57 update on Sierra and it worked fine all of yesterday. Launched it today and every tab I open crashes, whether I turn off recent tabs / history or not or fiddle with incognito options. Reverted to ESR for the time being until I have time to mess about with it.

Not to contradict the mods @elsiegee40, but Cisco do have a policy of making some security fixes available without a contract if you can point to a valid Cisco security advisory. You may not get release 7.0, but if it's a security vulnerability, Cisco may make available a software release that has a fix included. More info here: https://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html Specific section: I've used this in the past for a customer who was woefully out of contract. You do have to do all the legwork proving your case with TAC, but it does work.

Any of the following phrases from external senders: environmental information regulations FOI request FOIA request Freedom of Information Freedom of Information Act Subject Access Request unless any of the following phrases are in the email: "The information contained in this email may be subject to public disclosure under the Freedom of Information Act 2000" "[email protected]" (which is in a *lot* of corporate / LA email signatures). The signal/noise ratio is pretty good and it catches requests from anyone considerate enough to explicitly point out it's a FOIA request in the subject or message body.

We get a couple a month via email, mostly journalists or advocacy groups looking for data to support their argument. We have foia@ and dataprotection@ email addresses that are copied to a distribution group. We also have transport rules that check the main enquiries@ mailbox for things that look like FOIA requests and CC's them to same distribution group (finance director, IT, school administrator). NB: if you do the above, your LA probably has something about the FOIA in their default email footer - make sure you exclude that specific wording in your rule.

The normal staff AUP. It's deliberately worded so that it covers everyone.

At the risk of this thread turning into a measuring contest.... I was reviewing the security / data exfiltration detection options in Office 365 and poked around with the Secure Score shown here: https://securescore.office.com/#!/dashboard ...made a few easy changes to our setup and got a "your score will update in 24 hrs". Over a week later, it doesn't look like it's rescored any of the items I've changed*, historically or ~48hrs ago. So is it working for anyone else? *Mailbox auditing, client forwarding rules, MFA for admins etc.

You've a few options: 1) Provision more storage 2) Profile your storage so you can work out your yearly churn, projected increase from (more?) photography students and see if it'll fit. 2a) If it's an option, turn on deduplication. 3) Spend student, teacher and IT time resizing photos We don't use quotas here as it balances out - for every 50GB photography student, I've got 50 other students who barely break 500MB.

We've noticed (via a SIMS > SomethingElse sync routine squawking) that data in CTF files is being imported when we've chosen to deselect it. So far the common theme appears to be anything that's generated via RM SMS using CTF version 17.0. Anything from RM SMS using CTF version 15.0 imports correctly. Has anyone else noticed this? It was fine last September and (as far as I can remember) for any mid-year entries.

I notice there's a kensington lock slot just above one of the USB slots. Can you find a lock end and a padlock the right size to go through the lock end and the keyring hole of the dongle?

You can get USB-over-IP boxes (Digi make them) for dongles. They come up on eBay occasionally, but are otherwise rather expensive. There is, but you have to enable it (it's off by default). You can push it out via a GPP reg entry or scripting wevtutil. Application & Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational log