Delegation in Services Using Hawk ID for Authentication

1
Delegation in Services Using Hawk ID for
Authentication

• CITL Meeting
• January 21, 2005

2
The Delegation Issue

• Raised by faculty through the IT Advisory charter
  committee (ITAC)
• Because of authentication, more and more work
  that was formerly delegated is being pushed to
  the individual.
• Make sure that every tech support person on
  campus knows that its never acceptable to
  solve a Hawk ID problem by asking someone to
  use someone elses Hawk ID.

3
Common Delegation Needs

• Library borrowing
• Course Management, Grade submission
• Calendar
• E-mail
• Travel Reports
• HawkIRB (Human Subjects Office Institutional
  Review Board)
• Making copies of internal documents

4
Electronic Delegation Landscape

• No delegation option
• Not available
• Not appropriate
• Delegation options not well known
• Delegation strategy not consistent
• Delegation not what the user wants
• Little control over vended products

5
Adoption of Hawk ID Authentication

• December 2002 eight services moving to Hawk ID
• Today Enterprise authentication for local
  services works!
• Over 100 services known to be using the Hawk ID
  for service authentication

6
Improving Security

• Password improvements as part of the package
• Enterprise Authentication as Maturing Service
• New policies
• Security issues (focus since August 2003
  Reliable Computing goals)
• Now time for focus on delegation to prevent
  inappropriate sharing of Hawk ID

7
The Delegation Action Plan

• Discovery
• Identify existing options
• Identify needs
• Describe characteristics of good delegation
• Information for Users
• Support for Application Developers
• Policy Development

8
Delegation Discovery

• Identify Existing Options
• Inventory services and service characteristics
• 100 services so far
• http//www2.uiowa.edu/ouadmins/HawkIDServices.xls
• Do you have others?

9
Delegation Discovery

• Identify Needs
• Gather needs information
• What are accepted faculty practices in paper
  world?
• What process for change requests when the
  delegation options are deemed not appropriate?
• What is an acceptable solution? How much
  consistency is necessary?
• Describe characteristics of good delegation

10
Characteristics of Good Delegation

• Delegate uses own Hawk ID
• Delegation is auditable
• Automated timeout/expiration of delegated
  authority
• Hierarchy of delegation
• Ability to set scope can have too much
  delegation
• Multiple options, levels of delegation needed
• Report available to delegator of delegate rights
  in effect
• Establishment of consistent way to find out about
  service delegation standard wording (e.g.,
  delegation, proxy), button, Help Screen
• Broad education regarding responsibilities,
  consequences

11
Delegation User Info

• Information for users
• Delegation web site under development
• http//hawkid.uiowa.edu/delegation/
• Campus e-mail about keeping Hawk ID secure
  planned

12
(No Transcript)
13
Delegation Developer Support

• Meet with developers
• Identify best practices
• Develop an EA architecture or model for delegation

14
Policy Landscape

• Password Change Policy Sharing of individual
  account passwords is not appropriate.
• University policy for signature delegation but no
  explicit policy addresses Hawk ID delegation.
• IT Context desire for delegation of action, not
  just signature

15
What we ask from you

• What delegation issues have come to you regarding
  campus services?
• What delegation issues have arisen within your
  services?
• Do you have strategies or methods to share for
  delegation?

16
Other Leading EA issues

• Delegation, sharing, collaboration
• Hawk ID, SSN and University ID as data base keys
• Guest and service accounts
• ID maintenance and forest management

17
Related issues

• Culture
• Autonomy, ownership Its my PC
• Privacy, confidentiality, security of information
• sharing, collaboration, fluid authorization
  control
• shared responsibility group accounts
• Trust
• service continuity ad hoc acces
• Technology
• Workstation management
• Security
• Authentication of actions
• Local versus network storage
• Backup
• Business recovery