Changing Server Dates to change OD entry?

For users or potential users.
Post Reply
spolevoy
Posts: 74
Joined: Wed Oct 17, 2012 4:45 am

Changing Server Dates to change OD entry?

Post by spolevoy » Sun Oct 25, 2015 2:13 pm

I have employee permissions set in such a way that they can't edit an day-old entry.
But if they change the date on the server, they can edit it freely.

So naturally I should make sure that only I can change the date on the server -and that's what I'll do.
But for the past - is there a way to determine if any entries were changed this way?

User avatar
dgraffeo
Posts: 147
Joined: Wed Sep 24, 2014 3:19 pm

Re: Changing Server Dates to change OD entry?

Post by dgraffeo » Mon Oct 26, 2015 9:21 am

The only thing I can really think of is that some of our tables have DateTStamp columns which gets inserted when the row is inserted, then updated any time the information is updated. For instance with the procedurelog table there's the DateTStamp then also the DateEntryC (which is when the procedure was set complete). I suppose it is possible to see if the DateTStamp is earlier than the DateEntryC and go from there. I would think if the server time was backdated there would likely be records with strange dates but other than that I don't really think there is a way to tell.
"To understand what recursion is, you must first understand recursion."

David Graffeo
Open Dental Software
http://www.opendental.com

spolevoy
Posts: 74
Joined: Wed Oct 17, 2012 4:45 am

Re: Changing Server Dates to change OD entry?

Post by spolevoy » Thu Oct 29, 2015 8:07 am

thanks.
So out of curiousity, how does OD prevent tampering with records?

User avatar
dgraffeo
Posts: 147
Joined: Wed Sep 24, 2014 3:19 pm

Re: Changing Server Dates to change OD entry?

Post by dgraffeo » Thu Oct 29, 2015 9:31 am

Well we can't do much about physical computer security. We have to trust that people set up important computers with restricted access appropriate for what they use them for. The server, for more reasons than just changing the date, should be locked down tight. If they have the know-how and access to the physical server computer they could potentially run MySQL queries and completely bypass anything that OpenDental does for security because they won't even need to use OD. Within OpenDental itself we have a lot of security permissions and one of the most important is limiting people so they can't run command queries through the custom query interface in the Report tool (they can only SELECT information for viewing, they can't UPDATE, DELETE or INSERT records). In addition pretty much every aspect of the program has some sort of permission that allows access and/or editing of information as well as time restrictions for certain things. We also create security log entries (accessed through the Audit Trail) for most actions users perform when editing, creating, or deleting important information so if something seems off you can likely discover when it was edited or created and by who. When it comes to our software's security it's pretty tight, but again we can't do anything about physical computer security other than giving advice since that's really the job of an onsite (or nearby) IT professional.
"To understand what recursion is, you must first understand recursion."

David Graffeo
Open Dental Software
http://www.opendental.com

tgriswold
Posts: 122
Joined: Fri Jun 07, 2013 8:52 am

Re: Changing Server Dates to change OD entry?

Post by tgriswold » Thu Oct 29, 2015 4:01 pm

Additionally for reference:
Security in OD: http://www.opendental.com/manual/security.html
Networking Security (IT related setup): http://www.opendental.com/manual/comput ... setup.html
Mysql Security (IT related setup): http://www.opendental.com/manual/securitymysql.html
Travis Griswold
Open Dental Software
http://www.opendental.com

Post Reply