Enhanced Form Retrieval Options in eGovHub V2.2

Introduction

As a part of the continued improvements provided to the online forms we provide we have, in this release, added whole set of functionality dedicated to increasing the options for form retrieval with a focus on additional security options. This is an upgrade to the form's framework. Meaning every form has the ability to leverage this functionality. 

But it important to note a new version of the form is required to use this functionality. Details of the forms and versions which have this set up right now are provided later.

Please ensure you read the VERY IMPORTANT section later. It is later as without context it will be difficult to understand. 

Existing Settings

For context the following are existing settings to provide flexibility on security options for a person retrieving their online form which has been saved for later/submitted and evidence to be added subsequently. 

When the current EnableSecuredRetrieve option is set to true, it means a customer has to provide this prior to being able to start their form. This is illustrated below:

Everything in this release makes the level of control much more flexible. All of this done as a part of our continued desire to maximise our compliance with security best practice. 

New settings introduced

The following are the new options introduced as setting based functions in this release:

Some illustrations of these

Example 1 - changing the reference number format

In the following example, the settings are set such that:

TransactionNumberRandomStringCharacters is set to: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890

And

TransactionNumberRandomStringLength is set to: 24

The combination of these mean that the reference number will be 24 characters long and contain a mixture of the a-0 character list. See how this is created below:

As one can see this is absurdly long but does illustrate the flexibility you now have. 

Example 2 - Password modifications

If we set these settings as follows:

• SecureRetrievePasswordOnly                            true
• SecureRetrievePasswordLengthMin                    7
• SecureRetrievePasswordLengthMax                   12
• SecureRetrieveNumberMixOfUpperAndLower      true
• SecureRetrieveNumberOfLetters                        3
• SecureRetrieveNumberOfDigits                          1
• SecureRetrieveNumberOfNonAlphaNumeric         1

Then it means the person will only be allowed to proceed if there are a minimum of 7 characters, a maximum of 12 and it should have a mixture of upper and lower case letters. There needs to be at least 3 letters, 1 number and 1 special character. I.e. with the above the following would be allowed:

All0w3d#

But:

all0w3d# would not as there needs to be upper / lower case mixture

All0w3d would not as there must be 1 special character

Al03d# would not as it is below the minimum of 7 characters. 

I.e. an enormous amount of flexibility is present.

Where a person erroneously provides a password that does not meet the rules they will be presented with a message that reflects how you have set the settings. The following screen shot:

Is where the minimum is 8, max is 16 and 1 letter and 1 number is provided. I.e. the help is dynamic. 

When the person wants to retrieve their saved form or go to add additional evidence they will need to provide their reference number and their password. They need to provide both of these at the same time now meaning both are required to be correct in conjunction with one another rather than previously where they were checked in isolation. 

If the person provides incorrect details on either the following is presented. I.e. it tells them they have done something wrong but for security does not explain what they have got wrong:

VERY IMPORTANT

Any current in-progress forms without security questions will become un-retrievable when this is enabled. This creates a catch 22 but basically at the point at which you go live with this you will likely have some in progress forms where this is the case. These users will be unable to retrieve their claims from that point onward so will need to start a new one. So you may want to email them or make it clear for 1 month post the change on the guidance notes of the launch page that they will need to start a new one. 

Also and mainly for information, the answer (password) the citizen provides now have true password box behaviour, meaning characters are masked as they are entered.

Example 3 - Captcha when trying to retrieve an online form

When the following setting is google and the associated values are added by IEG4:

SecureRetrieveCaptchaControl

The following will be present on the online form in the 'Continue a form' section:

When clicked the user needs to answer the visual questions like this below:

It is important to note that this can be used as well as or instead of a password if you have made the reference number complex. 

Forms with this built in right now

• eClaim - Benefits - version 2.4
• eChanges - Benefits - version 2.5
• Calculator - Benefits - version 2.2

The Council Tax forms will be those, which get this next. Benefits were done first owing to the sensitivity of the data and that they are more likely to be saved for later. 

eGovHub Release Version Details

The following are the release versioning details: