EDUCAUSE | Identity Management

Free EDUCAUSE Webcast 10/22/08 on Identity Theft Rules

Rodney — Wed, 08 Oct 2008 19:26:45 -0500

New federal regulations to address identity theft go into effect November 1, 2008, and are likely to affect colleges and universities in nuanced ways. Compliance will require careful study and collaboration among business officers, human resources, legal counsel, student services, IT, and other affected campus units. The rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency. They also require that institutions develop and implement an Identity Theft Prevention Program for combating identity theft in connection with new and existing accounts.

Who is subject to and must comply with the regulations on ID Theft Red Flags and Notices of Address Discrepancy? What business practices at colleges and universities are covered by the rules? What are some of the things that entities subject to the rules must do? What role does IT play in compliance with the rules? What are the penalties for failure to comply? On Wednesday, October 22, from 2-3 p.m. U.S. Eastern Time, EDUCAUSE will host a webcast featuring Naomi Lefkovitz from the Federal Trade Commission (FTC) to address many of these questions and more. For details and connection instructions, visit http://connect.educause.edu/term_view/ID+Theft+Red+Flags. This webcast is open to the public at no charge and no registration is required. It will also be archived and accessible to all.

Brought to you by EDUCAUSE, in cooperation with the American Council on Education (ACE), Coalition of Higher Education Assistance Organizations (COHEAO), College and University Professional Association for Human Resources (CUPA-HR), International Association of Privacy Professionals (IAPP), National Association of College and University Attorneys (NACUA), and the National Association of College and University Business Officers (NACUBO).

Identity Theft Rules Cover Non-Profits, Including Institutions of Higher Education

Rodney — Wed, 08 Oct 2008 12:38:53 -0500

The "Red Flags Rules" apply to "creditors" with "covered accounts", according to guidance issued by the Federal Trade Commission. The guidance indicates that "where non-profit and government entities defer payment for goods and services, they, too, are to be considered creditors". It also explains that a "covered account" is alson an account "for which there is a foreseeable risk of identity theft." It is quite possible that student or employee loans, including the payment of tuition over time, are examples of accounts that are covered by the new rule. The rule requires the development and implementation of "a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account."

A related rule requires users of consumer reports to "develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency." This provision would likely cover credit checks, possibly including criminal background checks, that are conducted for employees.

Institutions who are striving to come into compliance should consult the Final Rules, FTC Guidance, and seek the advice of legal counsel.

For more information, consult a Resource Page established by EDUCAUSE.

Indiana University and Others Announce the Creation of the Center for Applied Identity Management Research

Rodney — Tue, 07 Oct 2008 13:52:42 -0500

The Center for Applied Identity Management Research (CAIMR) was unveiled today at a National Press Club event in Washington, D.C. CAIMR, hosted by Indiana University, is a coalition of corporate, government, and academic institutions "focused on developing research and solutions for society's most daunting identity management challenges such as cyber crime, terrorism, financial crimes, identity theft and fraud, weapons of mass destruction, and narcotics and human trafficking."

CAIMR's founding members include Indiana University, U.S. Secret Service, LexisNexis, Lockheed Martin, IBM, Cogent Systems, Visa, and Intersections. Dr. Gary R. Gordon, a Senior Scholar in Identity Management at the Indiana University School of Law in Bloomington, will serve as Executive Director of the Center. The Center will undertake applied research projects concentrating on the identity management aspects of: 1) public safety; 2) national security; 3) financial and corporate fraud; and 4) individual protection. Additional members include Fair Isaac, University of Texas at Austin, Wells Fargo & Company, U.S. Marshals Service, Dragnet Solutions, ID Experts, Identity Theft Assistance Corporation (ITAC), Information Technology Association of America (ITAA), and National Center for Missing and Exploited Children (NCMEC).

In a press release issued today Michael A. McRobbie, President, Indiana University, said "Indiana University is delighted to not only be part of CAIMR, but to serve as its academic home as well." He continued, "As a National Center of Academic Excellence in both Information Assurance Education and Information Assurance Research, IU is committed to enhancing the science and the practice of identity management. CAIMR's collaborative approach to these issues, and the partnership it reflects among key stakeholders in government, industry, and academia, will be invaluable to achieving that vital goal."

The Center, heralded as "the first of its kind", will bring together cross-disciplinary experts in criminal justice, financial crime, biometrics, cyber crime and cyber defense, data protection, homeland security, and national defense to address identity management challenges that impact individuals, public safety, government programs, and national security. More information is available at www.caimr.org.

Spotlight On Identity Management: Identity Management at USC: Collaboration, Governance, and Access

ckeller — Fri, 08 Aug 2008 10:30:48 -0500

Identity and access management (IAM) at USC has been a policy-driven, grassroots effort for the past five years. During that time collaborative committees with representatives from many academic and administrative units have enabled the accelerated growth of applications relying on identity data while governing the release of that data. With the backing of the university data stewards in the offices of the registrar, provost, and personnel services , policies have been implemented regarding the release of identifying sensitive information to both internal departments and external vendors. The speakers will discuss the composition of these committees, the governance policies that have been implemented, and some of the dozens of applications that have been enabled securely through this process.

August 8: Free Web Seminar on Identity Management at University of Southern California

cluckett — Fri, 01 Aug 2008 15:54:42 -0500

The EDUCAUSE Live! Spotlight on Identity Management series is a six-month series that will feature one or two speakers from a campus that have analyzed or solved a problem in a way that many people will find instructive.

Identity and access management (IAM) at University of Southern California (USC) has been a policy-driven, grassroots effort for the past five years. During that time collaborative committees with representatives from many academic and administrative units have enabled the accelerated growth of applications relying on identity data while governing the release of that data. With the backing of the university data stewards in the offices of the registrar, provost, and personnel services, policies have been implemented regarding the release of identifying sensitive information to both internal departments and external vendors. In this free web seminar on August 8, Identity Management at USC: Collaboration, Governance, and Access, presenters Brendan Bellina, identity services architect and manager of enterprise middleware development, and Margaret Harrington, director of the Office of Organization Improvement Services, both at USC, will discuss the composition of these committees, the governance policies that have been implemented, and some of the dozens of applications that have been enabled securely through this process.

The event is free, but registration is required and virtual seating is limited. Register now.

Spotlight On Identity Management: Engagement and Partnerships: Identity Outreach at Indiana University

ckeller — Tue, 15 Jul 2008 09:03:11 -0500

In this session we will talk about identity management in the context of this announcement and how it relates to the values that are driving the mission of Indiana University today. Our primary focus will be the partnership between Indiana University and Clarian Health and the challenges faced by doctors, nurses, and medical students who constantly float across organizational boundaries.

Tune In July 15: Free Web Seminar on Identity Outreach at Indiana University

pkurkowski — Tue, 08 Jul 2008 16:13:09 -0500

The EDUCAUSE Live! Spotlight on Identity Management series is a series that feature one or two speakers from a campus that have analyzed or solved a problem in a way that many people will find instructive.

Indiana University and Purdue University recently asked the Indiana General Assembly to create the Indiana Innovation Alliance. This purpose of the alliance is to expand research in the life sciences and also to improve public health. In this free seminar on July 15, Engagements and Partnerships: Identity Outreach at Indiana University, Kim Milford and Alan Walsh will talk about identity management in the context of this announcement and how it relates to the values that are driving the mission of Indiana University today. Their primary focus will be the partnership between Indiana University and Clarian Health and the challenges faced by doctors, nurses, and medical students who constantly float across organizational boundaries.

The event is free, but registration is required and virtual seating is limited. Register now.

Organizing a Campus Change: Planning for Identity and Access Management Improvements at UF

drupal — Thu, 12 Jun 2008 12:37:34 -0500

Leading change across distributed IT service providers requires extensive engagement. Implementing identity and access management (IAM) changes requires involvement of a broad spectrum of constituents. Using techniques developed during ERP and other large-scale change initiatives, we engage the university community in developing requirements and architecture for successful IAM changes.

UABgrid Identity Infrastructure

drupal — Thu, 12 Jun 2008 12:37:34 -0500

This presentation will describe the identity management infrastructure of the UAB grid computing project, known as UABgrid. Its development is based on accomplishments of two NSF middleware projects at UAB, which focused on building NMI-enabled, open source tools for support of collaboration within virtual organizations that span institutional boundaries, are autonomous, and are collections of attributes. The middleware solution is known as myVocs and uses Shibboleth for identity management and attribution distribution, Globus for distributed computations, and GridShib to bind Shibboleth and Globus. UABgrid is now expanding its grid computing components to include metascheduling of jobs across multiple HPC clusters across the Internet.

Spotlight On Identity Management: How Today's Registrar Demands More from Identity Management Policy and Infrastructure

djacobs — Wed, 11 Jun 2008 16:03:24 -0500

Stanford University's registrar and IT strategist discuss their vision of the future of identity management in higher education. Tom Black and Bruce Vincent will give some progressive perspectives on how their roles complement each other in supporting not only admissions processes but a lifelong relationship between students and universities.

Tune In June 11: Free Web Seminar on How Today's Registrar Demands More from IdM Policy and Infrastructure

pkurkowski — Thu, 05 Jun 2008 13:42:38 -0500

The EDUCAUSE Live! Spotlight on Identity Management series is a six-month series that feature one or two speakers from a campus that have analyzed or solved a problem in a way that many people will find instructive.

Stanford University's registrar and IT strategist discuss their vision of the future of identity management in higher education. In this free seminar on June 11, How Today's Registrar Demands More from Identity Management Policy and Infrastructure, Thomas Black and Bruce Vincent will give some progressive perspectives on how their roles complement each other in supporting not only admissions processes but a life-long relationship between students and universities.

The event is free, but registration is required and virtual seating is limited. Register now.

How Identity and Access Management Can Help Your Institution Touch Its Toes

drupal — Mon, 02 Jun 2008 12:59:58 -0500

Successful IT infrastructures and architectures are expected to nimbly provide the context for protecting and sharing information and identities. In today's world, new legislation, expectations from faculty and students, and managing risk several times a second are all threats to keeping current services relevant and time to market for new services reasonable. Understanding the importance and nature of the intersection created by security, identity, and policy is vital to planning the future of our infrastructures and architectures.

Bridging Security and Identity Management: Can't We Just Get Along?

drupal — Wed, 21 May 2008 10:25:12 -0500

Security staff want to keep the bad guys out, and identity management (IdM) staff want to let the good guys in. This session will explore this generalization and how to bridge issues in technology, policy, process, and reporting structures relating to security and IdM to achieve shared institutional goals.

Spotlight On Identity Management: MCommunity to Improve IT Service Provisioning at the University of Michigan

djacobs — Mon, 19 May 2008 15:11:44 -0500

MCommunity will allow the university to know who is and is not a member of the U-M community, enabling central university offices as well as departments, schools, colleges, and campuses to grant and remove access to online resources as needed and appropriate. It will provide identity management, roles management, data sharing and reconciliation, and directory services for U-M. MCommunity will bring together data from multiple institutional sources and will organize, present, and secure the data in a way that is particularly well suited to managing access to university resources.

Planning for this central resource for a decentralized institution began with an ITCommons group consisting of IT professionals from across the university who identified the need. A governance board of decision makers representing key units such as the registrar's office and human resources, some of the larger academic units, and others continues to provide guidance on related policy development.

Alpha testers from across the university are already testing the first visible part of MCommunity, the MCommunity Sponsor System, which will be released in June.

May 19: Free Web Seminar on MCommunity to Improve IT Service Provisioning at the University of Michigan

cluckett — Mon, 12 May 2008 12:34:49 -0500

MCommunity is a new enterprise directory and identity management system under development at the University of Michigan, a large, decentralized institution. MCommunity will provide a central infrastructure that can be used not only for central IT service provisioning but also for service provisioning within units. Planning for and development of MCommunity is a collaborative effort across both U-M IT units and the many units that will use the new system. In this free seminar on May 19, MCommunity to Improve IT Service Provisioning at the University of Michigan, presenters Elizabeth A. Salley, product manager, and Luke Tracy, MCommunity co-technical lead, both from the University of Michigan, will discuss the issues and concepts surrounding the development of this new system.

The event is free, but registration is required and virtual seating is limited. Register now.

Comments of the American Council on Education on the Family Educational Rights and Privacy Act

elilly — Mon, 12 May 2008 11:21:01 -0500

On behalf of several higher education associations, the American Council on Education submitted comments on the Family Educational Rights and Privacy Act

Comments of the EDUCAUSE/Internet2 Computer and Network Security Task Force on the Family Educational Rights and Privacy Act

elilly — Mon, 12 May 2008 11:07:49 -0500

Comments of the EDUCAUSE/Internet2 Computer and Network Security Task Force on the Family Educational Rights and Privacy Act; Proposed Rule, Federal Register, Vol. 73, No. 57, U.S. Department of Education, Office of Planning, Evaluation and Policy Development

Audit: Not Just for the Finance Guys Anymore

drupal — Wed, 30 Apr 2008 11:20:32 -0500

Auditing is an important and necessary step for establishing trust among relying parities when running a CA, PKI, and IdM system. This session will discuss what implementers should have ready when establishing their PKI, what auditors will expect from implementers, and what auditors will provide to implementers. It will also offer some illustrative real-world scenarios. You'll hear from an auditor from a Big Four firm and the CIO of a PKI shop who worked with auditors.

Identity Management Rollout in a Hurry

drupal — Tue, 29 Apr 2008 10:43:43 -0500

ACID, the Art Center Identity System, was rapidly deployed in three months, from development to rollout. This presentation will discuss how Art Center decided it needed an identity management system, chose Sun JES identity management software, planned delivery, and integrated the identity management system midterm. We'll share some identity management lessons learned that can benefit any institution.

Top-Ten IT Issues, 2008

elilly — Mon, 14 Apr 2008 12:41:46 -0500

EDUCAUSE presents the top-ten IT-related issues in terms of strategic importance to the institution, as revealed by the ninth annual EDUCAUSE Current Issues Survey. This year, Security moves back to the top of the list.

Tune In April 18 for a Free Web Seminar on Identity Management at Duke University

pkurkowski — Fri, 11 Apr 2008 17:04:50 -0500

The meaning of "student" is evolving at Duke University in response to many institutional and faculty outreach efforts. This trend is mirrored at many of Duke's peer institutions. In this free seminar on April 18, The Evolving Definition of “Student”: Identity Management at Duke University, presenters Klara Jelinkova, Director, Computing Systems, and Lynne O’Brien, Director, Academic Technology and Instructional Services, Duke University, will discuss the issues, concepts, and solutions surrounding identity management proposed and implemented at Duke University.

The event is free, but registration is required and virtual seating is limited. Register now.

Current Issues Survey Report, 2008

elilly — Wed, 09 Apr 2008 12:57:47 -0500

Security and ERP Systems are numbers 1 and 2; Infrastructure rises; Change Management, E-Learning, and Staffing move into top ten.

Spring Roles: Moving Forward on an Access Management Strategy

drupal — Wed, 09 Apr 2008 10:04:16 -0500

Enterprise authorization requires the management of group, role, and privilege information to ensure consistent access policy across applications. This session will compare and contrast how multiple institutions have implemented this infrastructure and offer an initial view into shared practices for access management.

Identity Engines and California College Of The Arts - The Art of Applying Identity to Network Access Control

drupal — Wed, 09 Apr 2008 10:04:15 -0500

This presentation discusses how California College of the Arts met the challenge of securing an evolving wireless network.

Applying Data Governance in Identity Management: To Serve and Protect

drupal — Fri, 04 Apr 2008 12:00:24 -0500

An identity management system often becomes a critical source of information for electronic services. Demands for data can result in tension between those who collect and safeguard the data and those who leverage it. This presentation will discuss the role that data governance plays at USC to both serve and protect.

Beyond Single Sign-On: Advanced Uses for Shibboleth at USC

drupal — Fri, 04 Apr 2008 12:00:18 -0500

Hear from one of Shibboleth's developers how USC is using Shibboleth to provide web-based services to federated guests and secure access to Google Apps. Additionally, this presentation will describe the Shibboleth test environment at USC that provides a quicker, easier, and more secure means for departments to integrate their applications.

FERPA Notice of Proposed Rulemaking Addresses Changes in IT

Rodney — Mon, 31 Mar 2008 12:52:09 -0500

The U.S. Department of Education has issued a Notice of Proposed Rulemaking with proposed regulations pertaining to the Family Education Rights and Privacy (FERPA). Among other things, "the proposed regulations respond to changes in information technology and address other issues identified through the Department's experience administering FERPA," according to the Notice. Additionally, the regulations are needed to implement amendments to FERPA contained in the USA Patriot Act and the Campus Sex Crimes Prevention Act, to implement two U.S. Supreme Court decisions interpreting FERPA, and to make other necessary changes.

Among the IT-related changes are:

Clarification of what can be included as directory information, addressing Social Security Number (SSN), other student ID numbers, and email addresses
Requiring the use of reasonable methods to identify and authenticate the identity of students, parents, school officials, and any other parties to whom personally identifiable information is disclosed
Recommendations to assist institutions in safeguarding educational records

The deadline for comments is May 8, 2008.

The EDUCAUSE Washington Office is reviewing the proposed changes and welcome your comments or questions. We will provide a more detailed analysis of the proposed rules and any further updates at a later date.

InCommon and the Committee on Institutional Cooperation

drupal — Fri, 28 Mar 2008 10:35:40 -0500

All dozen institutions comprising the CIC recently decided to join the InCommon Federation. This session will describe the motivation for and experience of joining InCommon. We'll also describe some of the use cases, including interactions with the federal government, interinstitutional access, and community source development projects.

Implementing MACE Grouper at Brown University

drupal — Mon, 17 Mar 2008 10:15:00 -0500

Brown University recently implemented MACE Grouper as an integral part of our identity management infrastructure. This presentation will outline the scope of the implementation, discusses lessons learned in the process, and present next steps for Brown's group management infrastructure.

Spotlight On Identity Management: Penn State's Identity and Access Management Initiative

djacobs — Fri, 14 Mar 2008 14:25:22 -0500

With demands for identity and access management (IAM) paralleling the explosive growth in online interactions, it is imperative that existing business systems, infrastructure, planning, and technologies evolve to keep pace with the access needs of the future. Recognizing the importance of developing a comprehensive, forward-looking strategy to deal with this issue, the IAM initiative was formed by Kevin Morooney, vice provost for information technology, in April 2007. The group comprises 27 individuals who span many administrative areas at the university. The group is co-chaired by Renee Shuey, Information Technology Services (ITS) and Joel Weidner, Auxiliary and Business Services.

The group's primary charge was to create an IAM road map (or strategy) for Penn State. A secondary goal was to establish a community of people and organizations from across the university who understand each other's pressures, needs, and desires for developing an IAM infrastructure that will support and enhance academic, research, business, and collaborative processes.

Tune in Mar. 14: Free EDUCAUSE Live! Spotlight Web Seminar on Penn State's IAM Initiative

cluckett — Fri, 07 Mar 2008 17:22:24 -0600

The EDUCAUSE Live! Spotlight on Identity Management series is a new, six-month series that will feature one or two speakers from a campus that have analyzed or solved a problem in a way that many people will find instructive.

In this free seminar on March 14, Penn State’s Identity and Access Management Initiative, presenters Renee Shuey, Senior Systems Engineer and Team Leader, ITS Emerging Technologies Group, and Joel L. Weidner, Director of Information Systems, Auxiliary & Business Services, Pennsylvania State University, will discuss how the demands for identity and access management are paralleling the explosive growth in online interactions, and how imperative it is that existing business systems, infrastructure, planning, and technologies evolve to keep pace with the access needs of the future.

The event is free, but registration is required and virtual seating is limited. Register now.

Bridging Security and Identity Management

drupal — Fri, 29 Feb 2008 13:09:51 -0600

Effective security efforts are composed of a complex set of interrelated components including policies, procedures, and technical controls. The interrelation between components is not obvious, and the technical details of security systems can obscure perspective with respect to other critical systems. Security architectures provide a coherent plan to ensure that we meet our IT security goals. But you can’t build your security model without an accompanying IAM model as a part of it. This session will discuss models for security and IAM and how they interleave.

Authorization Strategies Panel: Leading an Effort to Define Roles

drupal — Wed, 27 Feb 2008 12:04:13 -0600

A step up from using groups, role-based access control enables privileges to be assigned to institutional roles assigned to individuals. Even though this is the brass ring of access control, leading an initiative to define the policy and process guiding this infrastructure is daunting. Questions arise, such as who should be represented in the roles system? You may find you have more than one organizational chart, so which one do you use? Who should decide the roles structure and make the policy decisions? For which resources will you be assigning privileges? And will you list all the roles and their access rights or have the supervisors/area managers assign rights given a set of boundaries? The outcome of the former could be a list of exceptions, and the outcome of the latter could be a pattern that leads to a set of defaults, clustering around the distinct roles. But there is no one way. This panel will explore this complex issue and provide a number of perspectives on how to plan for such an effort.

Lightning Talks

drupal — Wed, 27 Feb 2008 12:04:12 -0600

Do you have a practice or interesting approach to share in the security and identity management space? Or would you like to connect up with someone with a similar challenge and collaborate on a solution? This session will provide a final chance for attendees to discuss a good idea or opportunity for peer networking.

Security and IAM Panel: IT's Better When We Work Together

drupal — Wed, 27 Feb 2008 12:04:11 -0600

Security staff want to keep the bad guys out and IAM folks want to let the good guys in. A hair is being split, to be sure, but it exposes a number of issues rooted in organizational politics and reporting structures. This panel session will explore how a number of institutions have encouraged their security and IAM staff to work together to achieve shared institutional goals.

Minimize Exposure Panel: Correlating Identities Across the Enterprise

drupal — Wed, 27 Feb 2008 12:04:10 -0600

What are the benefits and issues with correlating identities across the enterprise? What are the issues relating to cross walking and characteristics of identifiers? What strategies are there for getting the most out of logging? It’s important to know if an identifier has been reassigned, for instance, when using it for access to restricted spaces. Are there new institutional processes we should consider, such as logging in to register your IP address and binding an IP with a user? This session will explore these questions and offer a set of common requirements.

Web Applications: Development Approaches

drupal — Thu, 21 Feb 2008 12:11:08 -0600

IAM and security must be on the same page regarding web application development to facilitate proper access. What coding practices and assessment practices should web developers use? What tools are out there to help (OWASP)? Do we need cross-site scripting and pup code review to ensure proper leveraging of enterprise IAM or should web applications manage their own IAM/account data? This session will discuss strategies for how to include security and access requirements in the development process and code.

Protecting Networked Assets: Logical- and Physical-based Access Control

drupal — Thu, 21 Feb 2008 12:11:08 -0600

How can IAM be helpful in managing network intrusion and access? A researcher wants to show a national grid-enabled resource to her class, but can’t access it because she’s in a classroom and, by policy, unable to get through the firewall. She then clicks on her research icon, authenticates and, because of her researcher status, accesses the research van that is enabled to use the appropriate ports. Can coupling network capabilities and IAM replace the use of IP addresses as the criterion for access with identity, roles, and related attributes? Focusing in on wireless access specifically, can IAM can help correlate identity to an endpoint device by combining network registration and personal identification? This session will explore these questions and how one can identify the person behind the device or address.

Appropriate Access: Levels of Assurance

drupal — Thu, 21 Feb 2008 12:11:06 -0600

A level of assurance (LoA) refers to the degree of certainty that (1) a resource owner has that a person's physical self has been adequately verified before credentials are issued by a registration authority, and (2) a user indeed owns the credentials they are subsequently presenting to access the resource. The requirements for the level of certainty at both ends of that set of transactions should be driven by a risk assessment based on the value of the resources being protected. This session will describe the concept of LoA, discuss its importance, outline its technical components, and discuss the proposition that roles of the identity management and security staff are critical for a successful implementation of LoA.

Appropriate Access: Privacy Requirements, Regulation, and Working with Auditors

drupal — Thu, 21 Feb 2008 12:11:05 -0600

Personal privacy is about protecting individuals and them control over their personal information. Institutional privacy is about protecting proprietary information. In either case, privacy requirements must reflect campus values and also meet the institution's legal and regulatory obligations. The requirements must be reflected in the identity management system: its flexibility, how it is used to support access to resources, and who makes the decisions about that access. IAM can provide for the externalization and consolidation of roles that can be used to determine permissions and access without that function being built into each resource. This session will discuss these topics from the auditor, identity management architect, and security staff perspectives and offer a case study on how one campus has addressed these issues.

Authorization Strategies Panel: Provisioning, Deprovisioning, and Related Methodologies

drupal — Thu, 21 Feb 2008 12:11:03 -0600

Provisioning access is an IAM function, and deprovisioning that access is a security objective. How might these combined objectives be met with common process, and what sorts of access should be managed by it? Data, applications, networked services, and physical facilities all have particular provisioning and deprovisioning needs. Campus cards, for instance, mitigate risk only when the access information associated with them is current. When a card's rights get out of sync with its bearer's status, the card itself becomes a risk. Addressing this issue, given all the authorization and access points, can be a challenge unless they are tied into the enterprise identity management system.

Identity and Access Management: The Big Picture

drupal — Thu, 21 Feb 2008 12:10:57 -0600

Unsure how all the parts of an identity management system fit together and would like to know more? This non-technical, preworkshop seminar offers a functional model of the campus infrastructure and provide attendees a chance to view it through the technology, policy, and business process lenses. Topics covered include technology model, lifecycle of identity, and policy frameworks and governance.

Federated Environments and Incident Response: The Worst of Both Worlds?

drupal — Thu, 21 Feb 2008 12:10:43 -0600

Incident-response processes and tools are, by-and-large, designed to guide reaction to situations within an organization and are geared toward incidents involving local users and systems. With federated identity, we're now expanding this and entering into agreements and relationships that enable an extended community to access our services and our campus constituents to use off-site services in an authenticated and authorized fashion. In this new context, how do you respond when someone from a collaborating organization is hacking your systems? This session will discuss the challenges in the policy, practice, and technology of addressing incident response and mitigation in a federated world.

Identity Management (IdM)

drupal — Thu, 21 Feb 2008 09:38:28 -0600

Identity management is moving ahead rapidly. Shibboleth and InCommon are making great strides. Representatives from the banking and credit card industries are sitting around the table with federal and state government agencies in the Electronic Identity Assurance Expert Group (EIAEG) within the Liberty Alliance. The Credential Assessment Framework, developed by NIST, the National Institute of Standards and Technology, is being applied to an expanding federation of public and private institutions, including a number of campuses. The Identity Management working group will review these and other current activities of interest and chart a path for future action.

1st Annual EDUCAUSE PKI Deployment Forum: Registration Open

cluckett — Tue, 19 Feb 2008 17:43:03 -0600

A Focus on Campus PKI-Based Services

The 1st Annual EDUCAUSE PKI Deployment Forum, April 16–17 at the University of Wisconsin–Madison, will bring together colleges and universities that have decided to deploy PKI-based services on their campuses. The presentations will focus on the details needed to make PKI deployments successful, covering both technical and policy issues and including related areas such as training, vendor selection, CA options, buy-versus-build decisions, key distribution, and audit. Each year, the PKI Deployment Forum will take place on a different campus where deployment is under way, allowing participants to learn firsthand about what has worked and what hasn't. Registration is now open.

Security Professionals Conference to Focus on Security and Privacy Compliance, Planning, and Trends in Higher Ed

cluckett — Fri, 08 Feb 2008 15:16:52 -0600

Rebecca Whitener, vice president, enterprise risk management and chief risk officer, EDS, and Greg Garcia, assistant secretary for cyber security and communications, United States Department of Homeland Security, will present keynote sessions at the 2008 Security Professionals Conference, May 4–6 in Arlington, Virginia.

The conference program will cover these topic areas, with a focus on higher education:

Forensics and Incident Handling
Policy, Law, and Compliance
Risk Assessment
Security Management and Operations
Technology Solutions
Vendors and Partners of IT Products and Services

In-depth, half-day preconference seminars will spotlight managing security breaches, Windows Vista security, and establishing an information security program, among others. The postconference seminar will focus on developing an effective electronic records management process. Register by April 4 to save money with low early-bird rates.

For more information, peruse security-related resources at the EDUCAUSE/Internet2 Computer and | Network Security Task Force website.

EDUCAUSE and Internet2 Receive NSF Grant to Develop Collaboration Tools

pkurkowski — Wed, 06 Feb 2008 16:27:48 -0600

The EDIT Consortium of EDUCAUSE and Internet2 has received a National Science Foundation grant for ongoing work in middleware, including identity and access management, and infrastructure that organizations use to verify and manage online user identity and access. See the EDIT Consortium for more information. Browse related identity management resources at EDUCAUSE Connect.

Spotlight On Identity Management: The Challenges of Creating an Identity Management Infrastructure for the University of California

ckeller — Tue, 05 Feb 2008 10:10:28 -0600

Using the University employee self-service application as an example, we will discuss the organizational, political, and operational challenges that are being faced in the creation of UCTrust, the University of California's federated identity management infrastructure, including the evolving roles of application owners, identity providers, and audit.

Tune In Feb. 5: EDUCAUSE Live! Spotlight Seminar on Identity Management at the University of California

cluckett — Thu, 31 Jan 2008 15:23:51 -0600

In the February 5 seminar, The Challenges of Creating an Identity Management Infrastructure for the University of California, presenters David H. Walker, Director of Advanced Technology, and Karl Heins, Director of Information Technology Audit Services, both of University of California, using the University employee self-service application as an example, will discuss the organizational, political, and operational challenges that are being faced in the creation of UCTrust, the University of California's federated identity management infrastructure, including the evolving roles of application owners, identity providers, and audit.

The event is free, but registration is required and virtual seating is limited. Those unable to attend may wish to browse related EDUCAUSE resources on Identity Management and Security Management.

Identity Management: User Awareness Is the Key to a Successful IAM Rollout

drupal — Mon, 28 Jan 2008 08:56:20 -0600

This presentation will detail a five-phase deployment strategy for IAM, identity and access management. IAM provides a number of capabilities, including authentication management, authorization management, user administration, resource provisioning, auditing, and reporting to create a comprehensive and efficient approach to managing identities in a heterogeneous environment.