EDUCAUSE | CIO (Chief Information Officer )

Tune In May 12 for a Free Web Seminar on IT and Enterprise Architecture

pkurkowski — Tue, 06 May 2008 13:20:28 -0500

In a recent survey, one-third of CIOs polled had a high-level architecture group. Of the remaining CIOs, one-third were planning to establish an architecture group in the next year or two. What role does architecture play in projects and strategic planning? Hear the perspective of an IT/enterprise architect as he talks about the practice and value of architecture. Learn about ITANA, a peer group where you can engage and learn more about architect as practiced in higher education.

In this free May 12 EDUCAUSE Live! web seminar, IT/Enterprise Architecture: What Is It, and What Value Does Leadership Find in Having an Architect at Hand?, presenter Jim Phelps, Senior IT Architect, University of Wisconsin–Madison, will share his thoughts about the practice and value of architecture.

Those unable to attend may wish to visit the archives after the event or browse related EDUCAUSE resources on Enterprise Architecture, Security Architecture, Service-Oriented Architecture, and Strategic Planning.

E07 Podcast: An Interview with Michael Zastrocky from Gartner Inc.

gbayne — Tue, 18 Dec 2007 14:22:38 -0600

In this 7 minute podcast, we feature an interview with Michael Zastrocky, Vice President and Research Director of Academic Strategies for Gartner, Incorporated. He presented a session at the EDUCAUSE 2007 Annual Conference entitled, "IT Leadership and the Role of the CIO: The Annual Gartner/EDUCAUSE Update".

Dr. Zastrocky has more than 30 years of diverse experience in higher education. Before joining Gartner, he was a faculty member at several universities, assistant dean, chief information officer, and served as vice president of CAUSE, the international association for managing and using information resources in higher education from 1989-1995 (now EDUCAUSE). He has served as a consultant for a number of colleges and universities and was a vice president of the Kaludis Consulting Group. He has delivered many keynote addresses around the globe and has served as a faculty member for numerous institutes and seminars. He has been widely published on a variety of technology planning and management topics. He has served as a university trustee and a board member for both non-profit and for-profit higher education organizations. Bachelor's degree from Regis University, master's degree from the University of Denver, and a doctor of education degree from the University of Northern Colorado.

E07 Podcast: IT Leadership and the Role of the CIO - The Annual Gartner/EDUCAUSE Update

kellywalker — Wed, 21 Nov 2007 13:50:02 -0600

This 49-minute podcast recorded during the EDUCAUSE 2007 Annual Conference features Michael R. Zastrocky, VP & Research Director/Academic Strategies, Gartner, Inc. speaking on IT Leadership and the Role of the CIO: The Annual Gartner/EDUCAUSE Update.

The session abstract:

As higher education institutions face a growing shortage of IT leaders, some executives question the need for a CIO while others see this role expanding. During this annual Gartner/EDUCAUSE update, we will look at the role of the CIO and how it has evolved, along with current and future institutional needs for IT leadership. We will also look at how institutions can prepare for the next generation of IT leaders and future models for IT governance.

Second Life: If Only My Avatar Could . . .

tsimpson — Tue, 23 Jan 2007 08:25:10 -0600

I was prompted by the CIO listserv, a session at MARC 07 here in Baltimore, and curiosity to venture into Second Life. I immediately fell right into it and had to fight my way out. I should have known from my experience years ago playing Grand Theft Auto that I would have to limit my time spent. I was fascinated. I went directly to the Berkman Center and have been hanging out there ever since. I have spent quite a bit of time already, but will be setting a schedule for myself soon.

I am really looking forward to researching how this will fit into the work we all do with technology and education.

See you all in world.

Ted Simpson/Harriman Brooks
MICA

Identity Management ...

rowe — Mon, 18 Dec 2006 08:09:37 -0600

Identity Management assembles several streams of activity around identifying members of the university community and provisioning services for those community members. Universities need methods for discovering new members of the community and making sure those members have access to the services that the individual members need. Identity management can be used create a single-authentication environment, moving to a single sign-on environment, and then sharing that authentication among several universities in a federation. When used for service provisioning, access to private or limited resources can be controlled through identity management strategies.

A growing aspect of Identity Management is the creation of access and traffic logs. These logs allow us to differentiate the activities of those authorized community members from activities that are not authorized, particularly those originating from those outside the community. We can trace and answer “what happened.” Compliance requirements (e-evidence or HIPAA, for example) may require retention of logs for extended periods of time.

I like to think that university networks and systems operate within a set of ethical principles. Our networks are open highways where communities are free to travel. There may be limited entrance and exit ramps, particularly to special services (like interstate highways). Cars are licensed to travel wherever the driver chooses, but travel is not monitored or permanently recorded in a log. Some destinations are not easily accessible or have limited access; there are locked gates and perimeter walls.

If a law is broken, evidence is gathered and an investigation is pursued. The investigation is undertaken carefully by specific individuals authorized to handle such an endeavor. These individuals are knowledgeable in the laws that apply to gathering evidence, sharing details and protection of the innocent. Evidence about an individual is not gathered or tracked in advance of an investigation, suspected criminal activity, or an actual crime.

If our networks are the highway and our systems are the destinations, many institutions want to promote free and easy entrance ramps. Once on the highway, you are now free to move around the Internet!

It can sound so good up front to say “We’ll have logs of your Internet travels.” Then, if something goes wrong, we’ll be able to IDENTIFY who did this deed. But the risks to personal privacy and electronic freedom are huge.

I will admit to having traveled through some pretty dark alleys in my Internet voyages. If someone was looking at my track record alone, they may be startled at the places I’ve been. What is missing is “why”? Why did I go to that porn site (investigating a complaint of harassment from Student Affairs)? Why did I go to that racially-biased hate site that spoke of bombing (to prepare for the Public Administration class I sometimes teach)? The “whys” behind my activities are nowhere documented. The presence of my identity in a log is not evidence or proof of wrong-doing on my part.

And I will only be able to defend my actions once someone has reviewed the log of my travels and tells me that they have questions. How will I know when the log of my personal activities is being reviewed? Will a notification to me be required? Who will have the right to review the log? Who will make the decision? Under what circumstances are logs released? To whom?

Perhaps we should build our identity environments modeled on credit reporting agencies. Retained logs need to be available and viewable to those whose identities appear in the logs. Should the owner of the identity be notified when a log containing their identity is released? If the log is retained, can I, as the owner of the identity, add my own annotations?

Our internal IT organization has maintained that we use logs to trend and not police, unless we have an official legal request, authorized by the university General Counsel, to gather evidence. We do not retain personally identifiable information in logs for an extended period (not longer than 30 days). Our log retention issues are helped by not needing compliance with HIPAA. Is "knowing what someone is doing or has done" a component of identity management?

As an IT professional, I am uncomfortable with the idea of tracking everyone’s activity on our networks. I am fully comfortable with protecting destinations, our systems and data, from unauthorized travelers (keeping the keys to the gate). I find the environment similar to surveillance cameras. We have a reasonable expectation of privacy as we travel the Internet. I would be a big fan of posted signs: “Surveillance monitoring present on this network.”

The network director at Oakland University, Brian Paige, reminds me that we need to consider the changing landscape of social perception and laws. What is legal or socially acceptable now may not be legal or socially acceptable in the future (or vice versa). Logs can be kept for long periods of time. What is the purpose of evaluating old logs? Have we fully identified justifiable reasons for retaining old logs and applying new standards to the old data?

The word “trust” is often used in the building of an Identity Management environment. We are trying to give access to those we trust, and as a result, build trusted communities who use trusted resources and trusted networks. That works in reverse, too; we need to build Identity Management structures that are trusted infrastructures. Key to building trust is to announce what data we are gathering, state publicly how data are used, and then use that data only in accordance with that public statement. That trusted environment includes logging, monitoring and other tracking activities.

(Acknowledgement to Brian Paige for his contributions and willingness to engage in this discussion).

May/June 2006 EDUCAUSE Review Security-Related Articles

vvogel — Thu, 11 May 2006 11:20:36 -0500

Read the latest security-related articles in EDUCAUSE Review (Volume 41, Number 3, May/June 2006):

"The Myth about IT Security: Security Is the CIO’s Responsibility" by Diana G. Oblinger and Brian L. Hawkins
"Top-Ten IT Issues, 2006" by Barbara I. Dewey and Peter B. DeBlois

E2005 Podcast: Reminiscences of an Accidental Programmer

podcaster — Thu, 09 Feb 2006 18:06:47 -0600

This 65 minute presentation by Ann E. Stunden provides coverage of the 2005 EDUCAUSE Annual Conference Session entitled Reminiscences of an Accidental Programmer.

Spring EQ Features Articles on E-Learning, CIO Effectiveness

ecoghlan — Tue, 07 Feb 2006 18:24:12 -0600

The latest EDUCAUSE Quarterly (EQ) includes feature articles on the financial and strategic aspects of e-learning, online certification for online teaching, the use of PDAs in the IT curriculum, and CIO effectiveness in higher education. These articles along with the magazine's regular columns are available free online.