OARN Database UPDATE – SEPTEMBER 2015

We’re Live – and Testing  The site is up and running in Google’s data centers:  The site has been secured:  All communications, between the user to the web server and between the web server to the database are encrypted.  The data itself is stored on encrypted media.  Access to the servers has been restricted: Two factor authentication has been enabled for the Google account, which is only accessed on an isolated, dedicated machine that is run from a CD rather than a hard drive. The password for the Google account is stored on an encrypted thumb drive that can only be accessed via a pin code, and which will destroy the password if more than 10 incorrect tries are attempted. Password based authentication for the webserver has been disabled. You need a set of encryption keys which are only available through the Google interface. A firewall is in place that allows only web traffic and the administrative access. The database server is restricted so that it will only communicate with the webserver.  A test migration of random data (several thousand families) has been performed to provide the beta testing team something to work with.  The database committee is currently testing the system and we’re working out the bugs.

The GNU Affero General Public License  We have released the source code under an open source license designed to ensure its future availability.  The usual GNU public license requires that modifications to the source code be made public if the software is distributed, e.g., by download over the Internet.  Because this is a server based application, I selected the Affero version of the GPL to ensure that if someone does not distribute the software, but simply allows access to it over a network, they still must share the source code.  I will be uploading the source code to GitHub once beta testing is complete.

Migration Steps  Approval of the universally shared reference table values by the database committee.  A point person at each agency (starting with the database committee) will be identified, and any agreements (e.g., a BAA for HIPAA covered agencies) will be put in place.  I will send out spreadsheets with the fields that need to be populated in order to migrate data into the new system.  Once I have data from a given agency, I will do a dry run on a test database to help ensure there are no errors and gather data about the migration (e.g., how many records of each type were migrated). The test database will immediately be destroyed after the dry run.  After working hours, I will make a backup of the production database, run the migration, and compare the results with those of the dry run.  If all looks well, I will work with the point person at the agency to test data from several families and verify that the migration was successful.

Still to come:  There are features to the user interface that still need to be added:  The assessments  A waitlist  Classroom attendance  The report server needs to be completed