X-Road application guide Anti Alman Quretec OÜ 24.08.2016

Purpose Main question Intended audience How to enable and enhance business processes using X-Road? Intended audience Process owner Systems architect (Public sector) X-Road application guide fills the void of materials intended for process owners It is difficult to explain X-Road to a non-technical person Knowledge about X-Road values is not well known and the values were not well explained anywhere Knowledge about becoming membership is rather low Becoming a member Responsibilities Initially the intended audience was new members form the public sector During the project we moved away from focusing only on the public sector (Public sector needs the materials for new employees) Existing materials were rather technical and hard to read We assumed that the reader does not need to have an IT background The application guide is intended to be more of a light reading material

Creating the application guide Primary input Existing X-Road materials Marketing materials X-Road regulation Interviews Discussions with RIA employees Existing x-Road materials. Some that could be mentioned: RIA blog „Introduction to X-Road“ – Probably one of the lightest reading materials The application guide is somewhat harder to read Usage guide for X-Road – Integrated into the application guide Gives a good overview, but can be harder to read MKM (Green book of public services etc.) – Mentions X-Road very superficially Marketing materials – The application guide is in some sense a continuation of the marketing materials Basic ideas in the marketing materials are specified in the application guide Main connection is the section about values X-Road regulation Legal texts are rather hard to read Regulation in force at 22.08 leaves many questions unanswered The new regulation improves things significantly Draft of the new regulation is used for the application guide Interviews covered on next slides Discussions not covered in the presentation (Main goal was to clarify the vision and overview of intermediate results)

Interviews Interviewees Purpose of interviews Mainly public sector Mainly process owners Purpose of interviews Scope adjustments Validation of the application guide structure Discovering example solutions Overview of X-Road issues Interviewees mainly from public sector and mainly representatives of the business side Comes form the initial scope Knowledge about designing X-Road related processes is higher in the public sector Interviews fulfilled multiple goals Scope – Determining if the material is needed and what potential readers would expect to see Structure – Intermediate results were shown do the interviewee for feedback purposes Example solutions – We wished to find and include realistic examples Issues – Asking about the issues of X-Road allowed us to better fit the application guide to readers needs Some of the interviewees were Andmevara Töötukassa Haigekassa DataMe and cloud.ee

Interview notes X-Road members Quick and easy solutions are preferred Own knowledge evaluated as high Low knowledge about solutions of others Quick and easy solutions are preferred „Unfair“ criticism of reliability Problems of other systems attributed to X-Road We will briefly stop on some of the main points, before introducing the result Some of the info could not be included into the application guide It is important to note that the notes are the subjective impression of interviewer The things that stood out the most Own knowledge and solutions are evaluated as being high, but little knowledge about the solutions of others Knowledge about different solutions does not seem to spread well X-Road community is rather „distributed“ X-Road services are kept rather simple There is a tendency to avoid more complex solutions Most services are simple data queries Problems beyond ones security server are attributed to X-Road If there is an error then it is mostly seen as an error of X-Road Members do not differentiate if the error was in security server to security server communication or at the information system on the other end (There are even instances where a faulty message is sent to security server and the flaw attributed to X-Road)

Defining X-Road In the context of the application guide Technical solution Compatibility Ecosystem Rule set Security requirements Differing opinions on what exactly X-Road is Mostly seen only as a technical solution Compatibility and ecosystem are seen rarely as a part of X-road The unified rule set and security requirements are often not seen as a part of X-road We decided to view X-Road as a composition of Technical solution – Relatively universal data exchange layer Compatibility – Ability of different systems to exchange data and to relay on each other's business processes Ecosystem – There is a large number of X-Road members which means that one can take advantage of some already existing solutions Rule set – All X-Road members adhere to the same rules Security requirements – concrete security requirements allow every member to be more confident in other members security measures

Values Distributed Flexible Secure Reliable Easy to use Allows cost-savings Compatible This is the list of main values that we have identified and should be used to describe X-Road Values are identified based on X-Road knowledge materials Opinions at RIA Interviews Values are described more in depth in the application guide If a value is only a keyword then it is not as useful Application guide tries to describe every value in more detail Values will not be described during this presentation Some examples: Distributed – Data is not centralised. Data moves directly between parties and no third parties can see the data Flexible – One member is not dependent on the technology used by other members Reliable – There are no critical single point of failures

Usage options Four main options Describing the options Simple membership Security server as a service Service mediation Software as a service Describing the options General description Responsibilities of parties Example scenario There are four main usage options Simple membership – Company is a member of X-Road, has it’s own security server and information system Security server as a service – Company is a member of X-Road, has it’s own information system but outsources the security server related tasks Service mediation – Company is not a member of X-Road, but uses some X-road member’s capabilities Software as a service – Company uses some one else’s information system, that is connected to X-Road Spread of usage options At the moment by far the most common is simple membership Security server as a service is somewhat used Service mediation is somewhat used, but at the moment unregulated Software as a service is probably not used For each usage option we describe Where and how it can be used – Main focus is on the idea itself and important considerations Responsibilities of parties – Each usage option consists of multiple parties (except simple membership) each of whom has different responsibilities Example scenario – The aim is to give the reader an rough idea about the costs associated with each usage option

Example solutions Main purpose Describing the example solutions How to use X-Road to enable business processes? Describing the example solutions Focus on process and idea of the solution Data exchange simplified Low on technical details The main purpose is to answer the question „How to use X-Road to enable business processes?“ X-Road is often seen as only a data query tool We wish to make the reader think about differed scenarios in which X-Road can be used Focus is on the basic idea of the solution We do not aim to provide ready-solutions for the developer We aim to build a general sense of how X-Road works and how it can be used to gain extra value In order to make the examples more readable: Data exchange is presented in a simplified way Most technical details are omitted (XML, SOAP, Security server etc.)

Summary X-Road is more than just a technical tool Understanding X-Road values helps to advertise X-Road Interfacing with X-Road is not as difficult as some seem to think Introducing X-Road to process owners leads to better solutions https://moodle.ria.ee/course/view.php?id=10 Instead of „Thank you for listening“ slide I decided to finish with some general thoughts X-Road is more than a technical tool It is important to give some content to the X-Road values in order to better advertise X-Road Different companies estimate X-Road costs very differently The direction if developing information systems is often decided on a higher level, thus it is important to talk to process owners