Data, Policy, Stakeholders, and Governance Amy Brooks, University of Michigan – Ann Arbor Bret Ingerman, Vassar College Copyright Bret Ingerman This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Bret Ingerman Vice President for Computing and Information Services Vassar College Poughkeepsie, NY

Here to represent the small schools (under 5,000 FTE) EDUCAUSE Small College Constituent Group

Vassar College Founded 1861 Highly selective, residential, coeducational, liberal arts college 2,475 students –95% live on campus 240 tenure track faculty 680 staff

Vassar College 7,000+ devices on network –4,000+ computers –80 + central file servers –??? Distributed servers All major operating systems (win, mac, unix) SunGard / SCT Banner (on Oracle) Central IT staff of 45

Small isn’t always small

“IdM Stone Age” “Authorization: The Early Years” “[some implementations] Not too fancy, but it does the job.”

20,000 foot view

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

“Most campus constituencies are unaware of identity management systems…” True for non-IT staff Also true for some (many?) IT staff –Though may not know it is called this –Many (most?) campuses engage in this… Small schools usually don’t attend these types of sessions –What size are your institutions?

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Policies?

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Policies.

Policies?Policies. We have surprisingly few IT related policies –We have surprisingly few policies in general! Not even sure the process to approve policies –Strong faculty governance for faculty policies –Negotiations for union policies –Fiat for students –??? for staff

“Policies should drive how identities are disseminated.” Ideally… …but that’s not how it works –at small schools –at large schools, too? Small schools depend less on policies… …and depend more on people …and on practices

Policies “We’re a small college, not a university” –“We’re a small university, not a big university” –“We’re a private/public university, not a public/private one” –“We’re a university, not a corporation” –“We’re a local corporation, not a huge multi-national one” –Etc.

Policies Phone calls and casual conversations How do we bring rigor to this? Should we bring rigor to this? Is this the “small school way” ? An example…

Adding Accounts How many have a formal policy on this? –How many of you are at large / small schools? How many don’t? –How many of you are at large / small schools? What is the policy Of those with a policy… –How many will also accept phone requests? –Never? –For new faculty (superstar researchers), or senior admin. ?

Adding Accounts How do you disseminate new credentials? –In-person – –Phone For those who said “no” to or phone –Are you sure? –Are you really sure? –Have you tried calling your Help Desk to see?

Policies For me (read “small schools”): Policy less important then practice… …initially Reason to want to change practice –Within IT, fiat may be acceptable / necessary –Externally will take conversations Encourage, reward, nurture the changes

Policies and Governance With strong faculty governance: Easier to change practice than policy –Mostly internal Next, document the successful practice –Write internally –Share externally

documented practice = de facto policy

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Stakeholders All the usual players False sense that because we are small… …we either own all the data, or …we know everyone that owns data We would be wrong

Stakeholders We don’t think about: –Dean of Faculty office (faculty contracts & salary) –Security (parking information) –ID Card office (one-card info, door access, photos) –Health Services (medical records) –Others? Small size may make actually make it harder to identify all sources

Who are some of the more “unique” stakeholders on your campus?

Stakeholders Do the stakeholders feel ownership? –Data “managers” vs. data “custodians” Do you have a “stakeholders” committee? –BISC

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Communicating the Importance One place where small may be an advantage Centralized administration Decisions (relatively) easy to push out –Once made… Although not always the case –Even some small schools are “federated” –“Common Services”

Communicating the Importance Main focus for me is on IT staff Need them to see the value of IdM Need them to see it as important Need them to see it as more important

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Decision Making Small schools –Frustrating at best –Non-existent at worst Large schools –Frustrating at best –Non-existent at worst To put it into perspective…

A vote of 7 to 1 is a tie 1

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions. Data

Who has it? –Where are the authoritative sources? –How do you know they are the authoritative source? –Do they know they are the authoritative source? How up-to-date is it? –How do you remove people from “the system”? –Have you audited it? How secure is it? –ImageNow…

Abstract Most campus constituencies are unaware of identity management systems, yet because of their broad impact campuses must define new policies or update old ones. Who are the stakeholders, and what strategies can institutions use to communicate the importance of identity management to them so appropriate decisions can be made? What types of policies are affected by identity management implementations? This session will provide answers to these critical questions.

…provide answers to these critical questions.

…provide critical questions to these answers. …provide answers to these critical questions.

There are no right (or wrong) answers. There are no easy answers.

Thank you!

Questions?