A Note From Bill...
“With great power comes great responsibility.” Certainly, I understand that when inspired by this statement, Spiderman wasn’t thinking about computing, but recent events cause me to associate this with workstation and data security. Because of the great computing power with which Stanford entrusts us, we have great responsibility as an organization and as individuals. However, before I set any further context, let me say that if I can deliver only one message in this article, I want it to be: protect Stanford’s information assets—physically secure your computing devices when not in your possession, remove any Restricted Data from those devices, and store Confidential Data (sometimes referred to as Sensitive Data) securely.
It’s difficult to miss the many recent news reports about the theft of data from government agencies, businesses, and academic institutions. As I think most of us are aware, this has, unfortunately, affected Stanford too. While thefts of computing devices represent a monetary loss, the far greater concern is the potential misuse of data stored on those devices. This is a significant risk to the University and individuals when that data includes Restricted or Confidential Data.
Recently, Randy Livingston convened an Information Security Task Force to discuss data security issues and determine policy and best practices for minimizing risk. Topics of discussions include what data should be classified as restricted and confidential, what checks and balances might be implemented to prevent individuals from inappropriately downloading such information to computing devices, and how to better inform the Stanford community of policies and tools for protecting University data. I’ll be sure to update you on the outcomes of these discussions, particularly any changes in related policies.
In the meantime, I’ve asked Shirley Hodges and Computing Resource Consulting (CRC) to immediately begin working with IT Services staff to ensure we have done our due diligence in reducing the possibility of data theft from our computing devices. CRC staff is prepared to help you remove Restricted or Confidential Data from your computing devices and, where appropriate, use existing tools to store Confidential Data in a secure location and/or format (i.e., encrypted). You should also take action to physically secure your computing devices (e.g., laptop cables/locks) whenever they are not with you. (Particularly, do not leave your laptop in an unattended vehicle!) I ask that you work closely with your CRC representative if you have any related questions or concerns, but please remember that it continues to be your responsibility to comply with Stanford data protection policies on the computing devices you use.
As the leader of the University’s central IT unit, I feel a special obligation to ensure that our organization serves as a role model for the rest of the University in protecting Stanford’s computing resources and data. As an organization, we have made great strides through recent computing security projects to help do that, and I ask that you join me in taking this next vital step.
- Bill Clebsch
IT Services
IT Services Sundial Conversion Postponed
We've encountered some unexpected issues with the conversion of data from Sundial to Stanford Calendar. We’re working closely with Zimbra to resolve the problem, but this will cause a delay in our calendar migration of IT Services Sundial data, which was originally scheduled for this coming weekend. We will notify everyone as soon as we've identified a new date for the IT Services calendar migration. The remaining Sundial to Stanford Calendar training sessions will be rescheduled to coincide with the new migration date. We hope this interim delay will result in an easier transition for IT Services staff.
- Ammy Hill
Campus Readiness
Workgroup Integration
MaIS's Workgroup Manager allows Stanford Community members to create and maintain groups of people (and by extension, SUNetIDs). Although these groups convey no privileges in and of themselves, they were expressed in the directory servers and could be used by LDAP-aware systems to authorize users' access to online resources. IT Services configured WebAuth and Shibboleth to take advantage of Workgroups to restrict access to web pages.
The problem was that large chunks of Stanford's computing infrastructure couldn't take advantage of workgroups, and used their own internal authorization infrastructures instead. This meant that to maintain a group used by a variety of services, group owners would have to update membership in multiple places (a workgroup, an AFS group, a mailing list, etc.).
As part of the Workgroup and Organization Provisioning project, IT Services has rolled out a mechanism to use workgroups to populate groups into other services. This allows group owners to maintain membership and group policy in one place (Workgroup Manager), and have the group membership information kept up to date in other systems. As part of the project, we have implemented three integrations: AFS group memberships (also known as PTS groups), mailing list membership, and synchronization with Active Directory Authorization Groups.
At tools.stanford.edu/cgi-bin/workgroup-admin, workgroup owners have the option to create integrations with these services on a per-workgroup basis. The architecture of this system is modular, so additional integrations can be created for other services fairly easily. Please contact Unix Systems if your system could benefit from integration with the Workgroup system. Future plans include improved support for Guest Accounts.
The Workgroup and Organization project spanned both Administrative Systems and IT Services, and thanks go out to Jon Robertson, who was responsible for the implementation, as well as project team members Russ Allbery, Jon Pilat, Ross Wilper, Xinlei Qiu, Kristen Murray, Natalie Wang, and Michael Dave.
- Jon Pilat
Computing Services
IT Services Knits for Kids
For some reason, I start humming carols in July. This year, there’s a good reason for it. For the second year, knitters and crocheters in the Operator Services Center will be knitting and crocheting gifts for the kids at the Lucile Packard Children’s Hospital. We’re inviting any interested IT Services member to join us. The projects are easy, and the results are very satisfying.
We make tiny blankets with coordinating caps for premature infants, using very soft yarns. The caps are sized to fit your fist. The blankets are about 12” to 14” square. Amazing. We also make a variety of knit caps for kids who are being treated for cancer. These can go to children or teens.
When projects are completed, we hand launder them in mild, allergen-free detergent and pack them in ziplock bags with a note signed by the individual who make the item(s). Children and/or parents have the opportunity to select the items of their liking from the stock that we (and other groups and individuals) provide to Packard.
To make the projects more easily doable, we’re assembling kits with yarn and instructions. Yarn and some needles have been donated by Cindi Cabal, Rodney Carter, Christine Moe, and Carolyn Kane. At present, we have plenty of yarn. Our supply of needles is limited, so some volunteer needleworkers may have to supply their own knitting needles or crochet hooks.
If you’d like to participate in this effort, contact Carolyn Kane or stop by to visit and discuss the plans. You can do it, just one stitch at a time. You don't have to be expert, just willing.
- Carolyn Kane
Client Support