School platform sign-in security: questions to ask

Why does sign-in security matter when choosing a school platform?

School platform sign-in security matters because the sign-in is the door to every record the platform holds: student details, attendance, marks and messages to parents. If a teacher's or an administrator's password is guessed or stolen, whoever has it sees what that person sees. Sign-in security is one part of evaluating a school platform before you buy.

A schools standard calls it a critical line of defence. The UK Department for Education's cyber security standards for schools and colleges say: “Protecting user accounts and related data is a critical line of defence against cyber incidents and attacks.” The standard expects schools to work with “any digital technology suppliers to make sure they are also compliant with this standard”, which is why the questions below belong in a platform evaluation.

Passwords alone are not enough. CISA explains on its MFA page that multi-factor authentication makes it harder for an attacker to get in “even if passwords are compromised through phishing attacks or other means”, and that attackers “take advantage of passwords you reused on other systems.”

The UK and US sources here are not Malaysian law. In Malaysia, the Personal Data Protection Act 2010 (Act 709) sets out its own Security Principle, in section 9; the personal data questions to raise in the same meeting are in privacy questions for a first platform meeting.

Which accounts should need multi-factor authentication?

A school platform should require multi-factor authentication for at least every staff account that reaches it over the internet and every IT or platform administrator account. Multi-factor authentication asks for two or more pieces of evidence, such as a password plus a code or a tap on another device. Ask the vendor which accounts can be made to use it, whether the school can require it rather than leave it optional, and which methods are offered.

The UK schools standard names the accounts. It says multi-factor authentication “secures your account by asking the user to provide 2 or more pieces of evidence to verify their identity”, and that multi-factor authentication “must be enabled for all” “staff accounts with access to cloud services or remote access to on-site systems” and “IT administrative accounts”. The UK schools standard adds that enhanced security such as multi-factor authentication should always be used “where staff are handling confidential, personal or sensitive personal data”.

The NCSC puts privileged accounts first. Its password policy guidance says accounts with highly privileged access, or that are reachable from outside such as cloud services, are “especially attractive to attackers”, and that “MFA should be the primary method for protecting these accounts.”

CISA's ranking is plain: “phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA.” The UK standard also asks schools to consider “alternatives or extra support for anyone with accessibility needs or disabilities”; the wider accessibility questions are in school platform accessibility checks.

What password rules should a school platform support?

Ask whether every user has their own password, whether the platform stops the most common passwords, what it does after repeated wrong guesses, and whether it forces regular password changes. The sources favour unique passwords, a limit on guessing and no forced expiry.

One person, one password. The UK schools standard says passwords must be “unique to the user”, “protected from unauthorised access” and “supported by technical controls that reduce the risk of compromise”. The standard gives an example of such a control: “allowing no more than 10 guesses in 5 minutes, or locking devices after no more than 10 unsuccessful attempts”.

Slowing guesses is gentler than locking people out. The NCSC says: “Throttling is preferred, because account lockout can leave legitimate users unable to access their accounts, and requires access to an account recovery method.” Where lockout is used, the NCSC recommends allowing “between 5 and 10 login attempts” first. The NCSC also suggests a password deny list “that prevents the most common (and therefore easily guessed) passwords being used”.

No forced changes every few months. The NCSC heading is “Don't enforce regular password expiry”: “Regular password changing harms rather than improves security.” A platform that forces users to change passwords at regular intervals, which the NCSC says is typically every 30, 60 or 90 days, “imposes burdens on the user” without the security benefit. The NCSC also says “all default vendor-supplied passwords that come with any system, software or device should be changed before deployment.”

Should the platform work with single sign-on?

If staff already sign in to several school systems, it helps if the new platform can use the same school account, so there is one password to protect and one account to close when someone leaves. Ask the vendor whether it supports single sign-on with the accounts the school already uses, and whether multi-factor authentication then comes from that school account.

The UK schools standard says: “If staff access a number of systems, you should consider using a single sign-on solution that allows you to sign on once and access all applications.”

Our practical suggestion: ask who enforces the second factor. Ask which side enforces it, whether the platform's own password can still be used to get round it, and what happens to a person's platform access when their school account is disabled; then test that in the demo. In Malaysia, DELIMa is an official example of a digital education platform serving pupils, teachers and parents, so a school may also want to know how a new platform sits alongside the accounts its people already use there.

How should young students and parents log in?

Young students should be able to log in without a password where they cannot manage one, for example with a PIN code, while each student can still be identified. Young children, students with special educational needs and students still learning the language may not manage a password or a code sent to a phone, so ask the vendor what the platform offers instead.

The UK schools standard suggests other ways in. For “younger children, users with special educational needs or disabilities, or for those with English as an additional language”, it suggests considering “other means of logging on, other than passwords”, such as a PIN code, or “a separate account accessed by the teacher using the student's login so that the student can still be identified”. The standard's list of second factors marks the text-message code as “for staff only”.

Parents need their own login. The standard says passwords must be “unique to the user”. Our practical suggestion: ask how parents are invited, whether each parent gets their own account rather than sharing the student's, and whether the school can ask parents to turn on a second factor.

What each role should see once signed in, including parents, is covered in evaluating teacher, student, parent and administrator access.

What should happen to accounts when people join, move or leave?

An account should exist only while someone needs it, carry only the access their role needs, and be closed the day they leave. Ask the vendor how accounts are created and closed, whether that can follow the school's own records automatically, and how administrator accounts are kept separate from everyday use.

The UK standard's account rules. The standard lists “creating accounts only when required”, “limiting access privileges to only what the user needs for their role” and “disabling accounts as soon as someone leaves their role”. The standard suggests “tools that link to the management information system (MIS) to automatically create or delete user accounts”, and asks schools to review accounts “every term to identify changes that might have been missed”.

Administrator accounts are for administration. The standard says “global or administrative accounts are not used for routine business”, and the NCSC says highly privileged accounts should not be used for day-to-day activities such as email or browsing. Our practical suggestion: ask how many administrator accounts the school would have and who can create more.

How can a school check sign-in security in a demo?

Ask to see the sign-in settings, not just the sign-in screen. Our practical checklist for a demo or a pilot: turn on multi-factor authentication for an administrator and sign in with it; enter a wrong password several times and see what happens; reset a password and see who is told; sign in as a young student the way the school would; then disable a test teacher and confirm they can no longer get in.

Two more questions belong in the demo:

• Recovery: who can reset an administrator's password or a lost second factor, and how is that person checked? The UK schools standard asks for passwords that may be compromised to be changed immediately, so ask how fast the school can force a reset.
• Logs: can the school see sign-in activity? Instead of forced expiry, the NCSC recommends “monitoring logins for suspicious behaviour” and “automatically locking out inactive accounts”.

Put the written answers next to the others from the questions to ask in a school platform demo, and carry any gap into the contract checklist.