Data, Policy, Stakeholders,and Governance

Amy Brooks, University of Michigan – Ann Arbor

Bret Ingerman, Vassar CollegeCopyright Bret Ingerman 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate

otherwise or to republish requires written permission from the author.

Bret IngermanVice President for Computing and

Information Services

Vassar CollegePoughkeepsie, NY

ingerman@vassar.edu

Here to represent the small schools

(under 5,000 FTE)

EDUCAUSE Small College Constituent Group

http://www.educause.edu/groups/smallcol

Vassar College

• Founded 1861

• Highly selective, residential, coeducational, liberal arts college

• 2,475 students– 95% live on campus

• 240 tenure track faculty

• 680 staff

Vassar College

• 7,000+ devices on network– 4,000+ computers

– 80 + central file servers

– ??? Distributed servers

• All major operating systems (win, mac, unix)

• SunGard / SCT Banner (on Oracle)

• Central IT staff of 45

Small isn’t always small

“IdM Stone Age”

“Authorization: The Early Years”

“[some implementations]Not too fancy, but it does the job.”

20,000 foot view

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

“Most campus constituencies are unaware of identity management systems…”

• True for non-IT staff

• Also true for some (many?) IT staff– Though may not know it is called this

– Many (most?) campuses engage in this…

• Small schools usually don’t attend these types of sessions– What size are your institutions?

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Policies?

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Policies.

Policies? Policies.

• We have surprisingly few IT related policies– We have surprisingly few policies in general!

• Not even sure the process to approve policies– Strong faculty governance for faculty policies

– Negotiations for union policies

– Fiat for students

– ??? for staff

“Policies should drive how identities are disseminated.”

• Ideally…

• …but that’s not how it works– at small schools

– at large schools, too?

• Small schools depend less on policies…

• …and depend more on people

• …and on practices

Policies

• “We’re a small college, not a university”– “We’re a small university, not a big university”

– “We’re a private/public university, not a public/private one”

– “We’re a university, not a corporation”

– “We’re a local corporation, not a huge multi-national one”

– Etc.

Policies

• Phone calls and casual conversations

• How do we bring rigor to this?

• Should we bring rigor to this?

• Is this the “small school way” ?

• An example…

Adding Email Accounts

• How many have a formal policy on this?– How many of you are at large / small schools?

• How many don’t?– How many of you are at large / small schools?

• What is the policy

• Of those with a policy…– How many will also accept phone requests?

– Never?

– For new faculty (superstar researchers), or senior admin. ?

Adding Email Accounts

• How do you disseminate new credentials?– In-person

– Email

– Phone

• For those who said “no” to email or phone– Are you sure?

– Are you really sure?

– Have you tried calling your Help Desk to see?

Policies

• For me (read “small schools”):

• Policy less important then practice…

• …initially

• Reason to want to change practice– Within IT, fiat may be acceptable / necessary

– Externally will take conversations

• Encourage, reward, nurture the changes

Policies and Governance

• With strong faculty governance:

• Easier to change practice than policy– Mostly internal

• Next, document the successful practice– Write internally

– Share externally

documented practice = de facto policy

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Stakeholders

• All the usual players

• False sense that because we are small…

• …we either own all the data, or

• …we know everyone that owns data

• We would be wrong

Stakeholders

• We don’t think about:– Dean of Faculty office (faculty contracts & salary)

– Security (parking information)

– ID Card office (one-card info, door access, photos)

– Health Services (medical records)

– Others?

• Small size may make actually make it harder to identify all sources

Who are some of the more

“unique”

stakeholders on your campus?

Stakeholders

• Do the stakeholders feel ownership?– Data “managers” vs. data “custodians”

• Do you have a “stakeholders” committee?– BISC

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Communicating the Importance

• One place where small may be an advantage

• Centralized administration

• Decisions (relatively) easy to push out– Once made…

• Although not always the case– Even some small schools are “federated”

– “Common Services”

Communicating the Importance

• Main focus for me is on IT staff

• Need them to see the value of IdM

• Need them to see it as important

• Need them to see it as more important

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Decision Making

• Small schools– Frustrating at best

– Non-existent at worst

• Large schools– Frustrating at best

– Non-existent at worst

• To put it into perspective…

A vote of 7 to 1 is a tie

1

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

Data

Data

• Who has it?– Where are the authoritative sources?– How do you know they are the authoritative source?– Do they know they are the authoritative source?

• How up-to-date is it?– How do you remove people from “the system”?– Have you audited it?

• How secure is it?– ImageNow…

Abstract

Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones.

Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made?

What types of policies are affected by identity management implementations?

This session will provide answers to these critical questions.

…provide answers to these critical questions.

…provide critical questions to these answers.

…provide answers to these critical questions.

There are no right (or wrong) answers.

There are no easy answers.

Thank you!

Questions?