Andrea Beesing Karen Schultz Thomas Black

2 Cornell Case Study: Student Identity Life Cycle Andrea Beesing Assistant Director, IT Security Cornell University

3 The Cornell student context > 100,000 applicants About 20,000 students enrolled Around-the-world sites – Ithaca, NY; New York City, and Washington, D.C. Doha, Qatar, Singapore, Beijing; Paris, France; Rome, Italy; Seville, Spain; London, England; Dublin, Ireland; and Geneva, Switzerland and Geneva, NY, and others

4 Student Services and Identity Management Shared Goals Provide access for the right people to the right information, at the right time, from any place Replace paper-based, manual processes with online self-service options Improve user experience when accessing services, regardless of who hosts service Protect security and privacy

5 Student identity life cycle Prospect Applicant Accepted Applicant New Student Alumnus Time Student 5

6 Focus on challenges at this phase Applicant Accepted Applicant New Student Authentication required Short timeline Remote locations Volume of applicants Time

7 Undergraduate Applicant Communications WhatWhenHow ApplicantID and activation code Upon processing of application or letter Status of application, missing items Through application deadline Online using ApplicantID Admission decisionMarchOutsourced to ApplyYourself

8 Accepted Applicants Communications WhatWhenHow Class of 20xxEnd of MarchClass of site using ApplicantID Cornell BoundEnd of MarchCornell Bound site using Applicant ID Housing information End of MarchOnline using ApplicantID Financial Aid award info End of MarchBy letter – This takes too long!

9 New Student Communications WhatWhenHow NetID and activation code Early April through early August By letter – This takes too long! IT policy Copyright awareness At NetID activation Online using Manage Your NetID Health History Cornell Card Dining Plan Early April through August Online using NetID

10 Current Challenge for Cornell ApplicantID is low assurance (bronze) credential –Issued via with attendant exposure –Is financial aid information too sensitive to release solely on the basis of this credential? NetID is higher assurance (silver) credential –Releasing this information solely on the basis of successful authentication with the ApplicantID reduces it to bronze –How can we balance customer needs with security and strategic goals?

11 Addressing the Challenge Exploring use of cell phone and telephone number of record for communicating temporary password Considering what additional confirmation of identity can used in conjunction with the ApplicantID to release financial aid data –Capture secret with common app supplement –Tie the use of the ApplicantID to a financial transaction

12 Guidelines for IdM practice InCommon Identity Assurance Profiles NIST Electronic Authentication Guide 63/SP800-63V1_0_2.pdf

Karen Schultz University Registrar Penn State University CAMP, February 4 – 6, 2009

Why do students leave? Graduate Withdraw Leave of absence Stop out temporarily Transfer to another institution Dismissed for academic or disciplinary reasons

Former students need services too Transcripts Verification of enrollment and/or degree Reporting CE credits to state Dept of Ed for teacher certification Loan billing and repayment Payment of delinquent balances Access to 1098T tax information Aid exit counseling

Transcript service FERPA requires signature Current students can authenticate with userid and password; electronic signature permits online ordering How to provide this service to students not in attendance

Former students’ accounts Former student with active account Account expires 6 months after graduation or 45 days after failure to enroll Former student who had account at one time Forgotten userid and password Account expired Former student who never had account

No account... No service? Must former students order transcripts on paper? People expect online services Online services reduce workload Can we establish mechanism to provide account which satisfies electronic signature requirement?

How it works now Former student without still-active account must create new account Separate account system New userid and password How do we ensure that account qualifies as electronic signature? Former student not on campus, cannot provide photo ID

How it works now Former student must complete form and sign, then fax to us When signed form is received, we activate account and notify former student Former student can use account to visit web site and place order

Better solution Student leaves university Retains userid and password Access to Transcript request Enrollment/degree verification Financial records Loan repayment Aid exit counseling

In a perfect world... Student has one account for life Account remains active but access to services varies based on student status Account migration seamless for student Provides access to appropriate services at appropriate time

In a more perfect world... Single account established as prospect/applicant Admitted students use account to access pre-enrollment services (AlcoholEdu), registration Enrolled students have access to all services Former students order transcript

Are we there yet? Penn State has launched IdM project Beginning with student lifecycle First step is mapping

Thomas Black University Registrar Stanford University CAMP, February 4 – 6, 2009

Three Use Cases Federation Model: standards compliant, predefined trust relationship, and no separate arrangement A.S.P.s Admissions Service Providers Authorization of identity in perpetuity

A.S.P.s (Application Service Providers) CollegeNet: What Do You Think? On-line Course Evaluation System Students and Faculty Access Surveys and Compiled Reports National Student Clearinghouse On-line Enrollment Certification & Degree Verification Students and Staff Access Student Data

W.D.Y.T. (course evaluations) Point of Dependency: File Exchanges Participants must be introduced to the system in advance of launching the site each term. Enrollment and Instructor data must be current at the 11 th hour...

Data File Exchanges Must send files to CollegeNet to “prime” W.D.Y.T.

Portal Log-in

Local Authentication

Navigate to Courses

Vendor’s Service

N.S.C. Manual Account Setup and Active Account Problem: Institutional contact faxes the identity information to NSC to set up accounts. Institutional contact is charged with notifying NSC if an account should be removed

LSAC & AMCAS Local authentication and authorization… for transcripts Students, Graduates Stanford University AMCAS / LSDAS / any school  add info  request document electronic request & response identity data requestelect. doc. xmision

Ongoing Identity Services Permanently Active Authorization Services School to School: transcripts & certifications Out-of-Boundary? Vendors: music; videos, cars; tech components; journal clearinghouses Services: insurance