Explore insights and strategies for CTOs and CIOs in education. Discover tools and resources to support technology leadership and innovation.
Do you use a single-sign-on (SSO) solution to get your students and staff logged into multiple systems? If so, you will want to read this blog entry. On Wednesday, May 31, 2017, OneLogin notified its 12 million customers (BBC, 2013) that their SSO solution had been breached:
OneLogin, a company that provides customers with a single sign on for logging into multiple sites and apps, appears to have compromised customer data, including the ability to decrypt encrypted files. The company notified customers via email Wednesday that the incident stemmed from unauthorized access to one of its U.S. data centers. (Source: Threatpost)
“The service says all of its data centers in the US have been hacked, with customer data ‘potentially compromised.'” (Source: C-NET)
Before we explore the implications of the breach, let’s revisit why SSO solutions are so important.
SSO Makes Learning Possible
Only the smallest school districts can manually maintain usernames and passwords for all students and staff using online teaching and learning systems. Each requires staff and students to maintain a unique login and password. For all tasked with memorizing and tracking these login credentials, it requires a Herculean effort.
SSO simplifies keeping track of forty or more usernames and passwords for digital textbooks, online systems, and more. Popular SSO solutions include Classlink, Encore*, Identity Automation, Lenovo/Stoneware, OneLogin, and Tools4Ever. Solution providers deliver services such as Single Sign-On (SSO), Self Service Password Reset, and User Provisioning/De-Provisioning. Other services include IT Productivity, Applicant/Parent Self-Registration, Cloud Security, Multi-Factor Authentication, and more. These are essential services. A data breach of your school district’s SSO solution can mean the exposure of sensitive data for students and staff.
*Please note the statement Encore makes at the end of this blog entry about their recommendations. Statements from other SSO solution providers are being sought.
OneLogin Breach Opens the Door, Again
An established solution, OneLogin’s breach opens the door to 5,000+ valued services (e.g. Blackboard, Moodle, Google, Office365) for those affected school districts. Here are some relevant quotes:
“…the company gave more details about the breach, and revealed that all customers served by our US data center are affected; customer data was compromised, including the ability to decrypt encrypted data.…That’s kind of a big deal.” (Source: Solutions Review)
“Gartner Inc. financial fraud analyst Avivah Litan said she has long discouraged companies from using cloud-based single sign-on services, arguing that they (cloud-based SSO providers) are the digital equivalent to an organization putting all of its eggs in one basket. “It’s just such a massive single point of failure,” Litan said. “And this breach shows that other [cloud-based single sign-on] services are vulnerable, too. This is a big deal and it’s disruptive for victim customers, because they have to now change the inner guts of their authentication systems and there’s a lot of employee inconvenience while that’s going on.” (Source: Krebs On Security)
“The breach is the biggest security hiccup for the company since last August, when it admitted an attacker managed to take advantage of a bug in its system to read notes thought to be private in its Secure Notes feature. That incident was two-pronged. A bug in the system the company used for log storage and analytics caused all notes in Secure Notes to be stored in cleartext for one month. During that period, in an unrelated incident, an attacker successfully compromised the password of a OneLogin employee, something that allowed them access to the logging system where the notes were being saved.” (Source: Threatpost)
OneLogin’s Recommendation for the Affected
If you are an education or business customer, OneLogin is quoted as offering the following steps:
- Force a OneLogin directory password reset for your users;
- Generate new certificates for any apps that use SAML SSO;
- Generate new API credentials and OAuth tokens;
- Generate and apply new directory tokens for Active Directory Connectors and LDAP Directory Connectors;
- Update the API or OAuth credentials you use to authenticate to third-party directories like G Suite (Google), Workday, Namely, and UltiPro;
- Generate and apply new Desktop SSO tokens;
- Recycle any secrets stored in Secure Notes;
- Update the credentials you use to authenticate to third party apps for provisioning;
- Update the admin-configured login credentials for apps that use form-based authentication;
- Have your end-users update their passwords for the form-based authentication apps that they can edit, including personal apps;
- Replace your RADIUS shared secrets.
As The Register points out, this is quite a list. Imagine school districts struggling to get this done by themselves.
If your district is using an SSO solution, what can it do going forward?
Planning Ahead
Encore Technology Group’s President and CTO Michael Knight, a recent speaker at TCEA’s Technology Leadership Summit, was reached for comment. He said “This type of breach demonstrates our position that districts should operate an IAM, Rostering and SSO Platform that is completely within their borders and control so that the district can have complete logging, auditing, analytics, and visibility into the data, transmissions of the data, and data access. The log, auditing, and analytics data can then be fed into a central logging and monitoring platform (ex. SIEM – Security Information and Event Management) that will allow the district to detect and ultimately prevent data breaches.”
*Note: Enboard does not operate on a Central Cloud frame like the provider described in the breach.
Each customer has a completely separate platform with independent security contexts where all Identity Data, Federation Constructs and Metadata, Encryption Keys, Multi-factor Authentication Details, Logging, Auditing and Administrative Credentials/Access are stored separately and are completely unique. All end user SSO credentials are stored encrypted with a dual, unique key in the customer’s Active Directory.
Most importantly, the district has complete control of all data, controls, management, auditing, logging and can restrict all access from providers including access from Encore Support.
Safeguarding sensitive data goes beyond digital citizenship for an organization. When schools work in loco parentis, they have accepted care of our children. Yet districts, even large ones like those that use OneLogin’s solution (e.g. San Jose School District), find themselves outmatched. “Brace for impact!” may be the only advice you can give security-conscious school districts. In these cases, the keys to their respective kingdoms have been lost.
Statement from Identity Automation:
“RapidIdentity, from Identity Automation, is designed to make our customers more secure. And to do that, we’ve taken significant steps to ensure the security of our system itself, especially when hosted in the cloud.
Like OneLogin, RapidIdentity can be hosted on Amazon AWS. Unlike OneLogin, we’ve implemented strict security protocols enforced by RapidIdentity’s Privileged Access Management capabilities that ensure no individual has direct access to a hosted implementation, and there is no backdoor. Any access must be requested and approved by a separate Identity Automation Service Manager, meaning that no individual can breach the system alone. Furthermore, access is granted for a very limited time (the specific time withheld for security reasons), preventing breaches via accidental loss of credentials or access.
Beyond this, RapidIdentity has numerous built-in measures to ensure its security. In addition to requiring second party approval, privileged users are required to use multi-factor authentication when accessing any part of an installation and are limited to a single customer implementation. A combination of symmetric, asymmetric, and hashing cryptographic methods are also used to ensure the confidentiality and integrity of customer data and credentials.”
-Troy Moreland, Co-Founder & CTO, Identity Automation
New information was added as of 06/04/2017.
There are also many other communities for Google Certified Administrators on Google Plus. The benefit of joining several communities is that you get diverse perspectives and insights. For example, John Sowash asked in one Google Plus Community “What advice do you have for completing all the Google exams?”
send the network engineer up that big ladder to clean the video camera lens?” That’s the question that comes up when a fuzzy picture appears or there’s a network connectivity problem. Providing in-district support can lower costs, depending on the total number of cameras you have in your district. You may want to either hire a media technician or re-task a portion of an existing technician’s time. Here is a description of what they need to be able to do, along with a chart to use as a starting point.
The headline is too good to be true. I think my favorite example in this category is “17 Cats Who Should Be Running for President.” Really? Cats for president? What’s the point of this article? If it’s too ridiculous to be true, it’s too ridiculous to be true and isn’t worth your time.
Taking on new skills and the learning curve that goes along with it may be a frightening and/or frustrating task for your staff members. When possible, always try to set them up for success. They may not know how to break the skill down into manageable pieces, for example, so you may need to help model that aloud. Depending on the skill, you may also need to provide additional resources or training to help them become confident and successful. Put yourself in their position and consider what might be helpful in order to stretch…without breaking.
Talk to your staff about the additional tasks and the need to grow and take on new skills. Having an open discussion can alleviate some of the fear that comes from encountering something new, different, or unknown. When possible, ask questions to find out what they think. They may have a completely different understanding based on their past experiences (or lack thereof). Open dialogue should not be constrained to a single staff meeting however; encourage the conversation to continue. Let your staff know that you want to hear their ideas. Though you may have no control over the growth that needs to take place, you do have a great deal of influence on how well they develop capacity to meet that need.
When talking with a friend about building capacity in his team, he mentioned that he has a few people that can juggle six or seven major things, and he has one person that can only juggle four. No matter how much he wants the four-task-juggler to grow into a five-task-juggler, he realizes that it just isn’t going to happen. And the best thing he can do is recognize it and use it to both his and his staff member’s advantage. In doing so, he needs to set realistic expectations for each individual staff member. Just because you and I find certain tasks easy to juggle doesn’t mean that a another staff member will obtain the skill with ease. If we think back over our experiences, we probably had much more time (and resources) to build capacity in that area. With that in mind, consider how you can adjust expectations, but still arrive at the required destination.