
Have been considering IT security within schools recently and in particular password security. Schools have a number of different systems each requiring users to have login credentials in order to access them. This includes the schools Management Information System (MIS), computer login or Active Directory credentials, Parents evening booking systems and a multitude of other possible systems.
The ideal setup has always been to have an integrated environment meaning that login credentials were synchronized across different services. This would mean that users only have a single password which they need to remember, which would therefore allow for users to be encouraged to use a more complex and secure password. A systems Admin could even set policy to require a certain level of password complexity. I am no longer as convinced as to the merits of this approach.
As we look to make use of more systems within schools we engage more companies as the providers of the services we need. Each new service increases our digital footprint in terms of the risk to which we are exposed. We may have a reasonably high level of confidence as to Microsoft or Googles security, however can we say we have the same level of confidence with regards the provider of our SMS system, room booking system and school app? Just consider the number of services impacted upon by Heartbleed. If we have lesser confidence in the security of these service providers, we are accepting they are of a higher risk yet we are entrusting them with the synchronized user credentials for all services. Should these services become compromised then Microsofts, Googles and all other services, no matter how good their security is, are also compromised as the hackers have the appropriate login credentials. An integrated environment is therefore not as secure as we believe.
I do not have an answer for the above issue however the approach I am currently examining is the use of password managers such as LastPass and 1Password. They allow the user to have a single master password however this then manages a whole set of passwords which are different for each service being used. Should a less secure service become compromised this would not impact on other services. There is still the risk of the master password becoming compromised however you would hope that the service providers providing password managers are significantly more focused and capable on security than the provider of a schools library or similar systems. This leaves the users selection of their password and it I think that’s an important point to finish on.
Ultimately the weakest link in the security chain is that of the users themselves. The above may help in addressing security however the most important issue in IT security is and continues to be educating users to be aware and vigilant plus and to select passwords which are suitably secure.


Started experimenting during the last couple of weeks with Skype for Business. On Friday for example I had a meeting with a colleague to discuss some ideas he had. As we both work on different sites and I knew my colleague was eager to get things moving and have a meeting at the earliest opportunity I suggested a Skype session to allow for discussion. Midway through the discussion he asked if I had another computer to look at as he was going to send me a link for a web page to look at. At this point Skype for business came into its own as I suggested he should use the “present” option.
The first week back came and went in a whirlwind of activity. I had forgotten quite how manic the first week, and I suspect the second, can be.
That was until the other morning, when I decided to park my car on the other side of the school campus due to attending an event in the evening at that side of the school and wanting to leave directly from there. The walk across the school took around 10 minutes and according to my phone accounted for around 850 steps, most of which being uphill. Then it hit me, here was an easy solution at least to make some progress towards improved fitness; to park at the other side of school every morning and walk across the campus. This would amount to regular exercise without have much of a significant impact on my working day. Yes I would need to get up slightly earlier however it would also give me the opportunity to network with colleagues who I suspect would be around campus in the mornings, as well as allowing me to take in the lovely grounds of the school. I would be getting exercise, appreciating the surroundings and also improving my overall visibility and presence on site.
Now the A-Level and GCSE results are out the usual sets of analysis and observations based on the data have started making an appearance. As usual causal explanations have been developed to explain the data, using what Naseem Taleb described as the backwards process. The resulting judgments have been established to fit the available data without any consideration for the data which is not available.
Having read various articles following the recent A-Level and GCSE results I cant help but think that schools and more importantly education in general needs to make a decision as to what we are seeking to achieve, and stop acting re-actively to limited data which has been used to draw generalized conclusions.
I have written a number of times about my feelings with regards standardized testing. (You can read some of my previous postings here –
It was last night that I finally found out that I had been included on Microsoft’s list of Microsoft Innovative Educator Experts. My original self nomination and supporting materials had gone in a couple of months earlier and it had been with some nerves that I awaited the originally advertised release date for the list of the 1st August. It was again that I nervously waited for the revised date of the 15th August. This date arrived and the working day came and went. I saw a tweet suggesting the date had again been changed this time to the 16th so it looked like the nervous wait would continue. Then at around 10pm on the 15th I saw another tweet this time including a link to the new list. I promptly downloaded the document and scrolled through to the UK section where I was pleased to find my name. The wait is over.
As Director of IT I am often directly involved with our School Management Information System (MIS, sometimes referred to as a Student Information System, SIS). Throughout my career I have encountered and worked with a number of different MIS vendors. My general opinion is that they are all “much of a muchness” as although they have different features, strengths and weaknesses, when you average them out the benefits and drawbacks are equal in terms of their magnitude.