NYCDOE Division of Instructional and Information Technology Oren Hamami Chief Information Security Officer New York City Department of Education

NYCDOE Division of Instructional and Information Technology Agenda  General Approach  Detailed Analysis  Example: Provisioning  Special Cases  Next Steps New York City Department of Education | Division of Instructional and Information Technology | November, 20092

NYCDOE Division of Instructional and Information Technology New York City Department of Education | Division of Instructional and Information Technology | November, General Approach: The Matrix The single most important step in creating the roadmap is defining, and getting agreement on, the scope: What types of users will be served by this program? With what services will these users be provided? The answers to each of these questions are then arranged to form a matrix, with columns representing user types and rows identifying services.

NYCDOE Division of Instructional and Information Technology General Approach: The Users 4New York City Department of Education | Division of Instructional and Information Technology | November, 2009 Columns in the NYCDOE Matrix: EmployeesPartnersStudentsParentsSchool Apps Web Services

NYCDOE Division of Instructional and Information Technology General Approach: The Services 5New York City Department of Education | Division of Instructional and Information Technology | November, 2009 Rows in the NYCDOE Matrix: Provisioning – Users Provisioning – Entitlements Provisioning – Self-Service Authentication – Single Source Authentication – Externalized Authentication – Single Sign-On Authorization – Web Apps Authorization – Web Services

NYCDOE Division of Instructional and Information Technology Detailed Analysis: The Cells 6New York City Department of Education | Division of Instructional and Information Technology | November, 2009 For each cell in the matrix, the following components were identified: Solution and product or prospective vendors Maturity (from 0 to 5, 0 being not decided and 5 enterprise deployment) Projects depending on the solution Timeframes driven by these projects Potential obstacles to implementation

NYCDOE Division of Instructional and Information Technology Example: Provisioning 7New York City Department of Education | Division of Instructional and Information Technology | November, 2009 EmployeesPartnersStudentsParents Provisioning - Users Solution: Autoprovisioning Product: IBM Tivoli Identity Manager Maturity: 4 Projects: All Timeframe: Now Obstacles: All employee accounts are created through this process, though several areas for optimization have been identified. Solution: Autoprovisioning Product: IBM Tivoli Identity Manager Maturity: 3 Projects: SESIS Timeframe: May 2010 Obstacles: Partners need to be added into a system of record before they can be provisioned. Solution: Autoprovisioning Product: IBM Tivoli Identity Manager Maturity: 1 Projects: Student Timeframe: Sept 2010 Obstacles: Licenses would need to be purchased. The only student provisioning being done right now is manual. Solution: Autoprovisioning Product: IBM Tivoli Identity Manager Maturity: 1 Projects: Parent Timeframe: Sept 2010 Obstacles: Licenses would need to be purchased. The only parent provisioning being done right now is manual.

NYCDOE Division of Instructional and Information Technology Example: Provisioning 8New York City Department of Education | Division of Instructional and Information Technology | November, 2009 EmployeesPartnersStudentsParents Provisioning - Entitlements Solution: Role-Based Access Control Product: IBM Tivoli Identity Manager Maturity: 2 Projects: SESIS Timeframe: May 2010 Obstacles: Requires thorough business analysis of entitlement assignment process and approval workflows. Solution: Role-Based Access Control Product: IBM Tivoli Identity Manager Maturity: 2 Projects: SESIS Timeframe: May 2010 Obstacles: Partners role assignment is subject to the same business analysis requirements as employees, in addition to lacking systems of record. Solution: Role-Based Access Control Product: IBM Tivoli Identity Manager Maturity: 1 Projects: Student Timeframe: Sept 2010 Obstacles: Licenses would need to be purchased. Scalability might become a factor depending on number of roles. Policy decisions needed on what entitlements students get and who can assign them. Solution: None Product: N/A Maturity: N/A Projects: None Timeframe: N/A Obstacles: Parents typically have only one role, and entitlement provisioning is expected to occur as part of user provisioning.

NYCDOE Division of Instructional and Information Technology Special Cases 9New York City Department of Education | Division of Instructional and Information Technology | November, 2009 The scenarios fall within the context of identity and access management but, because they focus on applications, do not necessary fit the same access model that can be applied to individual users. School-Based Applications Constrained by scale Public user directory (Higher Education model) Virtual directory Web Services Separate category of technology Publication to the internet Authentication (SAML) Authorization (XACML) Transactional security (signing, encryption)

NYCDOE Division of Instructional and Information Technology Next Steps 10New York City Department of Education | Division of Instructional and Information Technology | November, 2009 Select solutions and products to complete matrix Gain agreement on and approval for complete matrix Break each solution into components to be phased Develop phased timeline based on project dependencies Identify funding requirements and sources Obtain funding and resources where necessary Implement! Remember that the roadmap is a living document! Be prepared to revise it as phases complete and requirements evolve.

NYCDOE Division of Instructional and Information Technology Oren Hamami Chief Information Security Officer New York City Department of Education Questions & Roundtable Discussion