With the launch of TimeControl 7, we are gradually working through updating the vast array of TimeControl resource that are available online. This week saw a rewrite of the TimeControl On-Premise Security Architecture white paper which is now available on the TimeControl.com website. Rewriting such material gets everyone thinking about the subject matter so security turns out to be one of our most popular internal conversations this week.
To be fair, security has been a topic of conversation for the TimeControl developers since long before the first version of TimeControl was released. The first ever timesheet that HMS created was 10 years before TimeControl. Our client, Philips Information Systems in Canada needed a timesheet that would integrate with both the Payroll system and the Project Scheduling system. Security was a huge element of the design as the data for Payroll was, of course, very sensitive and the costing information in the project system was information that would have been terribly damaging to the company if it fell into the hands of competitors.
That original HMS timesheet was very secure for its time and there are elements of that design that live in TimeControl still. But times have changed and the threat of data and systems compromise has become ever more sophisticated each year since that first timesheet system.
While the TimeControl On-Premise Security Architecture reveals many of the elements of the TimeControl deign that lend themselves to a safe and secure system, it is primarily a document that lets prospective clients review TimeControl against their own security standards. Yes, we use the latest in many technology designers in TimeControl and we test against the OWASP standards (owasp.org) looking for potential threats and ensuring we protect against them but there are risks that you can implement at that are beyond the security architecture we designed for TimeControl. Here are a couple of basic tips you can think about regardless of your size:
- Have a security plan for your key systems and data and choose someone to be accountable for it.
- Authentication is key. How do people authenticate to your network, to your applications and even to your building.
- Outward facing or inward? Does TimeControl need to be accessible to the Internet or will it serve your purposes just as well being available only within the corporate firewall? Inward implementations aren’t as easily accessible and that can mean they’re safer.
- Don’t forget physical security. If someone can get physical access to the servers, they can get access to your systems.
- Monitor. Make sure you take advantage of the many technologies available to monitor unauthorized access or out of pattern use of your applications, your data and your network.
- Functional and Data restrictions. In TimeControl, User Profiles determine what users can see which data and which users can use or perform which functions. Think about who needs access and don’t be scared to start with less access and later ease up on your restrictions.
- Disaster Recovery. Make a plan for your data and systems being compromised and how you’ll recover from it. Then do an actual practice to make sure your plan works. Iterative and redundant backups and a plan for restoring them is something that makes security officers sleep better.
This is not a comprehensive list of course. There are many aspects to a complete security plan that are better explained by specialists in that field. We’ve been talking about TimeControl for an On-Premise implementation. Next month as we upgrade TimeControl Online to version 7 we’ll be updating our Security Architecture white paper for TC Online and we’ll be sure to talk about that here in the blog.
You can find the TimeControl 7 On-Premise Security White paper at: TimeControl.com/resources/whitepapers
In order to be able to evaluate the content of each timesheet cell and do all the validations that TimeControl is known and selected for, we had to move to a one-line-at-a-time edit. For new users, this was just fine but some users of the Windows-based interface felt that editing each line at a time was slower than they were used to.
Multi-line edit isn’t the only change in the timesheet. The new Options screen allows a number of new selections. For example, users can now decide if they wish to word-wrap header rows. This allows dates and the day of the week to be displayed on two lines but also allows the field to be narrow. Each column can also be defined to be word-wrapped. If you have longer project descriptions or charge descriptions, just click on wrapping that column. You can also define which fields on the left of the screen will be frozen in place in case you scroll to the right. This is particularly important if you have defined longer timesheet periods. If you have monthly periods for example, you’ll certainly want to freeze the project/charge descriptions on the left to be able to fill in columns far to the right!
HMS is in Minneapolis/St-Paul this week where we are the gold sponsors of the Minnesota PMI’s Professional Development Days event. HMS Software’s President, Chris Vandersluis will be speaking on two topics and HMS will have a booth to show off the latest version of TimeControl. The Symposium part of the week is Thursday September 15th and we’ll be auctioning off a big screen TV to one lucky attendee. Stop by the booth and speak to us about TimeControl 7 and how it might help solve your timesheet challenges.
This gives users an easier perspective into data they have access to and to highlight potential assignment challenges in the coming days. The view is highly configurable and is accessed from either the Reporting tab or the MyAssignments tab of each user’s Options page.
If only the TimeControl timesheet had multi-line edit…
Not every organization expects all their staff to fill in a timesheet every single week. Instead, theses salaried staff are instructed to fill in a timesheet only “by exception” meaning only if they were not at their intended post for the entire pay period. If the employee has an exception such as a sick day, vacation, a day when they left early, etc. they must then enter only the exception.
Using the Drill Down Analyzer presents a selected amount of data which can be a small selection or a massive selection into a simple list. But, just like an Excel Pivot table, you can then drag a column header to the top of the screen and the data instantly reorganizes into sub-groups and sub-totals by that column. Drag another column and another level of sub-grouping and sub-totaling appears. It has to be seen to be fully appreciated (which you can do on the 
For users of TimeControl prior to version 6, they will be familiar with the spreadsheet-like reporting tool based on a FormulaOne component that was automatically installed by TimeControl. Using this ActiveX control, you can organize your selection of TimeControl data into groupings, sub-totals and totals and then either print it directly or save the result into Excel for further reporting. The Legacy Report Writer is not viewed by default in new TimeControl systems. It is visible in the Legacy menu area as it will be most attractive for clients who have created many reporting views in that report writer and wish to keep using them while they create new reports in the TimeControl Report Interface.
This is a great question and one faced by any organization that is shifting from paper-based timesheets to an automated system. Signature approvals are designed to have evidence that the person who signed the document actually saw the document they signed and their signature signifies their approval of the content. There are two main areas of reluctance for auditors to accept an automated version of a signature in a computer-based timesheet:
You must be logged in to post a comment.