Getting to Silver: Practical Matters for CIC Universities Tom Barton University of Chicago © 2009 The University of Chicago

Committee on Institutional Cooperation 1.University of Chicago 2.University of Illinois 3.Indiana University 4.University of Iowa 5.University of Michigan 6.Michigan State University 7.University of Minnesota 8.Northwestern University 9.Ohio State University 10.Pennsylvania State University 11.Purdue University 12.University of Wisconsin- Madison 2 The CIC: 12 large midwestern US research universities

 Comparable to NIST LoA2  Based on OMB M and NIST  Covers all aspects of the IdM operation  Two audits required  Every 2 years – confirm operation follows documented policy & procedure  One time – assess documented policy & procedure for Silver compliance  InCommon keeps letter from Silver compliance auditor and publishes the fact of that IdP’s compliance 3 InCommon Silver

 CIC CIOs decided in August 2009 that all CIC schools should be Silver certified by Fall 2011  Why?  Sustain adoption of fundamentally sound campus business practices and technologies in Identity Management  Expand inter-institutional collaboration  Support emergent trends, relationships, needs on the national identity scene and elevate prominence of CIC in those dimensions  Project leads: Renee Shuey & me 4 The CIC and InCommon Silver

Which campus people need Silver assurance? 5 Timeframe sooner later User group size smaller larger NIH apps TeraGrid OSG CILogon NSCNat’l Labs CIC storage cloud CIC CourseShare Payroll caBIG Benefits Student Loans

 Piece A: Documentation of policies and procedures and standard operating practices  Piece B: Strength of authentication and shared secrets  Piece C: Registering identity subjects and issuing credentials to them 6 Pieces of Silver

Documentation of policies and procedures and standard operating practices 7 RequirementsIssues or risks Comprehensive IdM policies and procedures No one really knows, unclear who gets to decide, weak documentation practice Formal authorityLack of clear governance Criminal background checks for IdM staff New mandate for Human Resources Department Bi-annual auditScheduling & funding

Strength of authentication and shared secrets 8 RequirementsIssues or risks Password complexity & lifetime Resistance to change Account lock-outResistance to change Passwords stored appropriately How campus portal handles passwords Passwords only in secure channels Remaining legacy systems

Registering identity subjects and issuing credentials to them 9 RequirementsIssues or risks n/aWhich user groups are in scope for the campus Silver project? Identity vetting & registration Change existing process for on- boarding students or staff –OR– Implement a new IV&R process Store breeder document numbers Increase exposure of Personally Identifiable Information Credential issuance process Change online credential issuance process; new link with existing business processes

 Energize collaborative efforts across the CIC  CIC campuses provide best possible support for scientific and scholarly collaboration  CIC campuses poised to take full advantage of cloud/shared services  For a large university, achieving Silver compliance can boost confidence on campus too 10 The view from Fall 2011