1. Information Technology Current Work in System Architecture January 2004 Tom Board Director, NUIT Information Systems Architecture

2. Information Technology Presentation Outline Context Business environment Security Integration Architectural future Operational implications We are heading toward a future that will be based on these ideas.

3. Information Technology Context Self-service. The world expects it. Central digital identity. The basis for service unification and enhanced security. Loosely-coupled systems. Replace tight integration between systems with Web Services to expose functions in standard ways.

4. Information Technology University Business Environment The user’s experience should be of unified access to services through a standard, Web-based portal. Transactions with applications are initiated through this portal. Based upon identity attributes set by Human Resources and the Registrar, institutional roles are defined that create separate views of University systems in that context. This is also a available for basic application security.

5. Information Technology University Business Environment Using portal technology will group functions around the individual’s personal responsibilities. Roles present functions in context and can enforce additional authorizations. Tailoring of role functions can follow specific entitlements granted by service providers. Personalization gives the person control to optimize his or her time and use of information.

6. Information Technology Service and Data Flow The combination of unified presentation, common authorization, and standard connectors will create a seamless service to the end-user. Identity management will be a key aspect of the infrastructure serving the entire network. Authoritative identity information from key systems will define roles and default entitlements. Coupled central applications End-user Portal Common credentials LDAP Central identity and entitlements SES HRIS

7. Information Technology Security NU will need firm management of digital identities to give service units confidence We will need to adapt existing systems, and specify new ones, to achieve desired levels of security.

8. Information Technology Delegated Access Control Unified central identity management allows delegated control of access by service administrators. Entitlements can be based on roles (by job class) or membership in groups or individually through rules. Local service access rules Credentials Application security Portal Sensitive data Application management Central management

9. Information Technology System Integration We should enhance services by coupling enterprise systems to speed processes Portal-based access to services relies upon this coupling

10. Information Technology System Integration SES HRIS Research Advance Financials “Integration” is a perception by the customer of a unified service. A restaurant appears as a unified whole delivering a service. The appearance of integration is realized by coupling systems, not merging them. The cook, waiter, and cashier are separate systems that communicate effectively to deliver a single service to the customer. A breakdown in that communication exposes the internal structure to the customer. An integrated administrative system will deliver a set of services crossing boundaries hidden from the customer through effective coupling of systems. The resulting service structure only appears monolithic, but remains distributed. Each separate system can be a best-in-class solution to its needs, with the necessary requirement that it communicate well to the remainder of the administrative matrix.

11. Information Technology Integration Benefits Integrated enterprise systems can reduce the time to complete services across the University, eliminate manual steps (and errors), and create auditable transaction records. A hiring event can trigger financial and service actions. Some actions could be immediate and others queued for review by service administrators before fulfillment. Later events, such as completed training, can be promoted back into the HR record for the employee. Human Resources System Hiring Event Provision NetID Provision Wildcard Encumber salary and benefits Provision access Schedule training Provision ETES Notify supervisor Subscribe to email lists Queue to ERP Notify supervisor Provision directory Provision calendar Provision local services Schedule training Subscribe to email lists Queue to school Notify supervisor Notify unit fundsmgr Employee Record

12. Information Technology Summary User self-service, reduced manual interfaces, and easier deployments will save effort and reduce errors Unified identity management will create consistency of services and security across the University Vendor adoption of application coupling methods combined with simplified local development will speed deployment of new functions The portal navigation point will reduce confusion and save time

13. Information Technology The Challenge – Application Silos Application silos develop naturally around business systems and software under standard architectural planning and funding. Each business unit invents user management, tracks authorizations, and builds interfaces to other systems. Silos limit views of institutional data, fragment security, require manual re-entry of data and detract from the user’s “integrated system” experience. Business Unit IT

14. Information Technology The Future IT IdM & Portal IT Services and Facilities Business Unit Focus

15. Information Technology Operational Implications Intentional deployment of: –Standardized identity and authentication infrastructure (in progress) –Advanced authorization infrastructure Implies: –End to silo identity management and adoption of the NetID across all general systems –Definition of default NetID entitlements –Delegated user management to maintain security –Deployment of stronger authentication where justified

16. Information Technology Operational Implications Intentional deployment of: –Application portal Implies: –Adoption of NetID across all enterprise systems –Real-time availability of data –Web single sign-on

17. Information Technology Operational Implications Intentional deployment of: –Transaction Bus Implies: –Suitable infrastructure to enable, track and audit transactions –Trained staff to develop and support the infrastructure –Cooperation from enterprise system vendors to deploy services effectively

18. Information Technology Operational Implications Intentional deployment of: –Adequate security Implies: –Standardized identity and authentication infrastructure –Agreement on business rules governing NetID transitions –Agreement on maintenance of desktop systems, deployment of firewalls, physical security of servers, and network authentication