Ephelyon

Buy everyone on EduGeek their very own hand-engraved Clue Bat? You'd be a popular man!

It's spam?

I imagine this will become another of my hallmark screen-filler posts and most will TL;DR. Before I joined the big wide world of the grown-ups and began to use my skills for good, I had a "background" in this. I freely admit that because it was a long time ago and now provides me with insights I can use in a professional capacity, and I was only ever white hat. I'm going to give a number of relevant examples from intrusions I made, obviously without referencing exactly where. In one environment (educational), a VNC server was installed on all workstations as part of a bigger package from a major vendor. Naturally this was inherently a problem as VNC stores server passwords and the manner in which they are obfuscated is insecure. It was only because I was able to issue commands like RegRead() that this mattered, however. Otherwise, and assuming no physical access to the box as ought to be the case, the password could have been stored in plain text for all the difference it would have made. It wasn't a problem until an attacker was provided with a way to read the data, which otherwise could not have occurred. The consequence was that I was able to view the screen of almost any workstation on campus, with all the obvious confidentiality implications that brings. In another (Citrix sales demo environment), a domain admin account had what we might call a very guessable password. This was not the problem, however. The problem was that, owing to lax Group Policy restrictions, I was able to begin building up information on the target environment (server names, AD policies, virtual or not, etc) and eventually gained a list of usernames. Both the username and the password are ciphers to an outside attacker, which is why Windows doesn't tell you which you got wrong if you make a typo. Without knowing the username, it wouldn't have mattered at all that the choice of password was poor. The one problem wasn't relevant until the other existed. Because I was able to gain access to information that I shouldn't, lax security further down the line became relevant, and only then. The top and bottom of it is to never assume that you or a colleague have not slipped up somewhere else - the key is to make sure no potential attacker can find out about it! The amount of times I have been able to exploit the tiniest, most seemingly irrelevant detail to discover a more major problem down the line is unreal. This is no insult to anyone's skill or experience; it's the guideline I maintain for myself professionally as well, precisely because a significant proportion of intrusions I have carried out were possible SOLELY because someone in the equivalent of what is now my job made a silly mistake, was lax or lazy with security, didn't anticipate how information could be (mis)used or was generally a bit cr*p at their job. The implication here was that a critical sales tool could have been taken away from staff during presentations, causing no end of embarrassment and damage to the company if it happened regularly. In another (Local Authority), the practice used to provide Internet access to many local schools through their broadband network was to give them all a username and password (which they had to type in EVERY time they opened a new browser session - unimaginable nowadays!), or in fact one set for admin, one for staff and one for pupils. These credentials were actually AD accounts in a central domain maintained by the LA, and were authenticated by a Windows-based proxy server which naturally had to have a domain computer account. On a lot of systems, an account will be created that has access to create, delete, disable or otherwise amend computer accounts, and solely to do specifically that. It will be created as a Domain User or Domain Guest, and the AD Delegation of Control Wizard will be used to give it the access rights required to the OU containing workstation accounts. It's typically used as the credentials for adding/removing workstations from the domain. That was the case on this system, except the security was misconfigured; those access rights had been granted at the root OU for all computer accounts, not just workstations but servers as well (Problem 1). Unfortunately, whether it was down to inappropriate routing or firewall port rules, it was possible to access shares on member servers of this central domain from individual schools (ports like 53 would have been needed, but why 139 as well?) - Problem 2. Anonymous enumeration of information such as user account names was also enabled on the domain controllers (Problem 3). One user account had the name "Public" - used for libraries and suchlike - and its password was easily guessable (Problem 4). This allowed me to connect to shares permitting read-only access to all Domain Users (not uncommon on larger systems). Lying around on one of those shares was what looked like an old, template SysPrep.inf file, containing the credentials of the domain-joining account (Problem 5), which were still valid (Problem 6). As a result, it was possible to disable the computer account used by the proxy server, such that no school Internet usernames/passwords could be authenticated, effectively taking down Internet access for the bulk of local schools. Despite being white hat I must admit I PoC'd this for two minutes, then reported the problem anonymously. But I've skipped ahead a little here because between Problem 2 and Problem 3 lies the Real Problem: I was able to run GFI LANGuard against the domain controllers. If that Real Problem of being able to run unapproved software (or, if you know what to look for, writing a simple programme that checks for these specific things) had not existed, then none of the rest would've mattered because I wouldn't have been able to glean the information in the first place. The problem with allowing both programming environments (that can read Registry keys, check for open ports, open a WMI connection to access data etc) and the execution of unapproved (compiled) software is that you enable problems that previously didn't matter, to now matter. You take all the Group Policy restrictions and etc that were specifically created to prevent this and effectively throw them out the window. Consider one potential impact of illicit access to data here. Little Freddy dislikes Little Johnny and wants to beat him up but is wary of trying it in school. It's a big city and Freddy doesn't know Johnny's address. If he or a friend compromises the system and accesses this information, Johnny might find himself in hospital. If that event is ever causally linked back to the school, the people responsible will lose their careers and either way we are talking about an assault on a child. The reason I mention this is that during my own little phase, I had contact with others doing similar things. Not all were as white hat as I was; one of them was in the habit of actively selling the information they acquired (they had a few "personal issues") to whomever would pay enough for it; sometimes they wanted it for trivial reasons (egging staff's houses for example), other times for more sinister ones. To come to the point, you're right to question whether that sensitive, personal data on minors and their families is really safe. Never assume it is. I can well imagine that the administrators of the systems I was able to compromise thought much the same thing. Having personally been that one factor that was missed, or not thought sufficiently important, a good few times, and knowing that children can be trained "groomed" by older hacker communities (as I was), the argument that school security breaches are either pretty much a myth or that their importance is overstated will never, ever wash either with me or with anyone else who has seen it, been it and done it.

A good point - if pupils question why it works that way we would be in a good position to tell them, and from experience too. That solution almost makes me wonder if a customised version of XP Mode on Windows 7 could be an option, deployed only on the relevant workstations.

If virtualisation is the answer the school will use, it could be a good idea to look at automating snapshots and reversion every day/week, sort of like a poor-man's VDI. Over here we're very keen to support an exceptional group of pupils in learning about Python programming and, going forward, console access to a Ubuntu Server instance. I'm going to make it happen but I'm also going to be very conscious of all the security implications and I'll definitely be making sure that I can script/automate periodic snapshot restores from time to time. Gareth, depending on the system setup we have to consider certain realities and at the end of the day we don't have to like it. The system exists to ensure that the school does; at the end of the day T&L is only one process among many from an org. man. standpoint. We know that schools exist to educate children but we can't afford to get ahead of ourselves in that respect when we consider the potential consequences of security breaches. I'm always quite explicit about that because in principle a security breach means nothing in itself (barring a lot of work for IT staff); what's important is the consequences of it. I do support the principle of a learning-focused organisation but I'm not going to pretend that it's okay to risk disclosures of sensitive personal data on staff, pupils or their families just so a few children can learn a few things that they could easily learn at a later stage in college anyway.

There's a helpful discussion of this problem with a possible solution here: Gmail as default Windows mail program (not same as `mailto:`) - Super User You may also find this useful as a partial solution depending on the exact requirements: https://support.google.com/mail/answer/10966

Naturally, but it's just an alternative if the specific issue is how to continue providing some kind of access to IT kit if classes have to be turfed out of suites. There's no easy one and, yes, the issues mentioned will be incurred pretty much regardless of how the school proceeds there. Disruption is inevitable but there may be ways to minimise it.

That's another way, but could be expensive too and you haven't then got the use of it at other times.

They can rely on it full-time bar exam periods, having been due notice and understanding of this well in advance.

Oh true, but as an emergency substitute for IT endpoint access during exam time it's surely better than nothing.

One way to combat that is to go for bookable laptop/tablet trolleys so some access to computing resources can still be maintained even if you're not in a suite.

And they do. But I suppose we've found ways of making that manageable by reducing the instances of it down to within what we've decided is an acceptable margin of error. I imagine something similar will happen if we now do it with tech; some cheating will still happen but so negligibly that we're alright with it overall.

I think the difference with written notes is that getting them out, passing them around etc constitutes a physical action, visible from afar, that doesn't mimic legitimate activity, whereas screen-sharing on a laptop/tablet would look much the same as normal exam work from a distance unless you're paying very close attention to at least one of the screens if not both (difficult if they're on opposite sides of the hall), AND you know what you're looking for. Technical training for invigilators would be required there, and as always the cat-and-mouse game of illegitimate tools mimicing legitimate ones would come into play very quickly.

Oooh I must've been REALLY tired last night :$

I'm sure I must be missing something here. 'Excellent' surely refers to the fact that that's the ISI term for the top grade, so 'every category' means each category inspected by the ISI... but the Early Years provision would've been inspected separately by Ofsted and their term for the same is 'Outstanding'... so it's not really all that wrong is it? Apologies if I'm missing the point but it's 2am...

It would be a bit difficult to close the school to everyone except Years 11/13, considering Years 10/12 are at a critical coursework stage as well.

Obviously these are valid problems and, if the Government and exam boards do decide they're going down that route, come what may (cannons to the right of them, cannons to the left of them), then as the issue gets discussed more widely the solutions will have to be found. If we in educational IT are wise, we'll get in on those discussions in good time to ensure the best result and minimise the amount of crud falling on our plates that we hadn't been aware of. Ironically, those IT suites designed with six or so computers on a hexagonal-shaped desk, which have been criticised so heavily from a T&L standpoint though many schools still have them, could actually prove ideal for an exam setting in terms of sneaking a sly glance at someone else's screen. Adaptive testing will also help there. The remaining questions seem to focus on "What do we do when something unpredictable happens?", so if there is a technical problem or if the school loses power. As for bugs in the testing software, the responsibility for that lies with exam boards and at some point there has to be some trust in their internal QC procedures; if they fail, it's not on our heads. On the subject of technical problems with a particular workstation, that could be remedied through an online testing package that uses technology similar to Google Docs to auto-save almost constantly. The local IT team would need to have "hot spare" devices to swap in within 5-10 minutes, which is a manageable amount of extra time to allocate to a pupil at the end of an exam. They could then sign back in on the spare device and continue their work. The matter of "hot spare" devices for the IT environment in general is a strategic issue to discuss with SLT because it involves both resource management and money spent. A power cut is a highly disruptive event that I don't have an answer for at the moment, barring even more versions of an exam to cope with it. Naturally there's also the issue of a sudden outage at the ISP's end, such that all the fancy cloud stuff I've just mentioned is rendered useless. That leads me to conclude that, because we can never rule out IT issues, the point of view from which change must flow needs to be how we address - nationally - the issue of pupils needing to resit all or part of an exam because of unavoidable circumstances. I expect that's not something we can answer here and now though.

If you do it as above though, you don't need a massive new infrastructure as you can then fit it into your existing labs without too much disruption (and let's face it, there's always some disruption around exams time so that's nothing new). Also, I'm not sure just how much extra work there would be for the exam boards as essentially it's just an extension of existing practices. Add to that the exam boards' savings (both in money and effort) in printing and delivering all those papers - plus the schools' savings in buying and storing them - and I'd imagine it would at least balance out.

Not necessarily. You can have e.g. A, B, C and D papers for the same exam, each balanced appropriately to equalise the difficulty and with separate marking/moderation teams for each (or they all "revise" the lot). After all, barring Government fiddling, the English GCSE from 2010 should be roughly the same in difficulty as the exam from 2011 because the level of qualification is the same, so surely it's perfectly possible to have different questions that each test a candidate's ability in the same way and to the same degree. They would just issue those four separate versions of the exam, turning a cohort of 200 into 50 per session, so that's only two labs' worth at a time, perfectly feasible (here at least) and it doesn't matter if they talk to each other in between because the questions are different.

Then they'll make it cloud-based and all use Chromebooks...

Perhaps even open that file in Excel in the meantime, wait for the user to edit it, then resume the script?

Well, our staff usernames are their staff codes in SIMS (i.e. initials), so there would need to be a report in SIMS that pulls out forename, surname and staff code. The Windows batch scripting process would then be: * Output the list of usernames with no FN/SN as above to File 1; * Output the full staff list from SIMS (using CommandReporter.exe) to File 2; * For each staff code in File 2, check if it matches an entry in File 1; * If it does, take the FN/SN entries in File 2 and use dsmod to enter them for that user. Is your setup in a configuration that something like that could work with?

If usernames already have some semblance to personal data stored in SIMS, would you be interested in a bolt-on that pulls out the relevant details from the MIS and populates those user fields automatically, tying the whole thing together?

No worries Is it so you can add names in for those without them?

I think I'm already approaching burn-out despite having no right to be at my age and stage