October 2022 - Introduce Two Factor Authentication and other security and performance enhancements

Two Factor Authentication

In keeping with modern security practices, we are now requiring Two Factor Authentication (2FA) for administrators using the system.  This is a requirement of our security certification for the system.

• You have 30 days to implement it
• Once you have implemented it you can select the "Trust this browser" checkbox and you will only be required to reauthenticate on each workstation/device you login on every 30 days.
• We recommend you use Google authenticator as the authentication device.  If you don't use that already, you can download it from the Apple App Store or from Google Play.
• Email is also an option but is recommended as a backup option.  For example, if you haven't got access to your mobile, you can use the email option.   

Strong Passwords

From now on when you change your password, the new password must be at least 8 characters and contain at least one upper and one lower case character and a special character.  A password strength meter is displayed to show progress.

Other Security Enhancements

A number of other security enhancements have been made, keeping the system compliant with current best practices.  One noticeable change is the encryption routines are stronger - meaning longer response URLs etc. 

Performance Enhancement

We have changed the system, so it no longer recalculates all the scores when each page of the response is saved.  It will now calculate scores:

• When the Finish button is clicked on the last page of the response
• When an Administrator (or others if configured) clicks the Show Scores Menu Item
• When the Calc after scoring checkbox is selected in a calculation.

One of the implications of this change is that you can no longer recalculate the scores by clicking Save Progress on the first page.  You should click Show Scores from the menu instead.

Other Changes

A number of other small changes and bug fixes have also been completed.