re: Information Security – information so secret, nobody’s heard of it…

sprince — Wed, 18 Jun 2008 19:31:46 GMT

It's wonderful how BECTA pump out this advice so readily. Unfortunately we tax payers are paying some ridiculous amount of money for these people to produce it.

For example, this statement:

"When data is required by an authorised user from outside of the school premises – for example by a teacher working from their home –they must have secure remote access to the management information system (MIS) or learning platform."

Is that guidance? Subtracting their favourite buzzwords, it doesn't add up to much. For example, the majority of learning platforms they have endorsed in THEIR OWN accreditation programme do not mandate an https login and some don't even have it as an option! Are we saying that "secure remote access" now means "needs a password"? I'm getting that feeling.

They then put the nail in the coffin with:

"The Information Commissioner’s Office recommends that data controllers ensure that any solution meets the current standard of FIPS 140-2 approved encryption products"

which was also in the original document released straight after the missing discs incident. Not terribly helpful really.

First off, BitLocker - possibly the most applicable and well-known technology in this area - has only had FIPS 140-2 validation for 3 weeks (since 2008-05-22 according to csrc.nist.gov). BECTA don't feel the need to specify a level either (BitLocker reached level 1 of 4). Are the staff of schools and LAs expected to trawl through this drivel and search through the vast NIST archives to find out if their copy of Winzip can encrypt to a high enough standard? I'd say that's unrealistic and will be ignored by at least 99.9% of schools. Remember, the people most likely to put school data at risk are not those that run the network and know what the word encryption means!

It all smacks of someone fresh off a degree course putting a document together in a hurry on a topic they have no prior experience of. I get that feeling regularly from BECTA tbh - heavy on (mostly incorrect/irrelevant) detail; light on common sense.

re: Information Security – information so secret, nobody’s heard of it…

arichards — Wed, 18 Jun 2008 14:01:54 GMT

Interesting you can't find anything on the Hannigan reports.

I emailed BECTA directly once your first blog appeared to ask them for clarification. I received a very nice response saying my email had been passed to the relevant department.

However I think that department was the 'Bermuda Triangle' because I haven't heard anything since.

It's OK publishing guidelines that reference other material, but shouldn't they then gives us at the coal face access to those referenced documents.