A Note From Bill...
It was great to see so many of you at Tuesday's Town Hall meeting. You can find the Be Well and IT Services meeting presentations on our Staff Meetings web page. In addition, we have also posted the archived version of the Web Ex session.
The updated organization charts were also published on Tuesday. We will continue to update them throughout the summer to reflect additional staff changes. Please contact me, the other EDs, or any of the Directors if you have questions about any of the priorities or changes discussed during the Town Hall.
- Bill Clebsch
IT Services
CRC Security Incident Response
Computer Resource Consulting (CRC) has partnered with the Information
Security Office (ISO) to develop a standard Security Incident
Response process in accordance with Admin
Guide 67 [PDF]. The result
is a process that all CRC consultants will follow when they are
notified of a security compromise involving a CRC-supported system
that contains restricted data.
The process focuses on working closely with ISO to provide timely
information required to do necessary investigations and limit
the amount of downtime a client will experience. We have used
this process with success. We hope we do not need
to use it in the future but, if it is needed, it will make the
management of such incidents smoother for our clients.
A special thanks to Noah Abrahamson, Rosy Alvarez, and Anthony
Hom for their contributions to the creation of this process.
- Kim Seidler
Computer Resource Consulting
New Guest Accounts System
In late May, Stanford's new Guest Accounts identity management system
for affiliates and infrequent visitors to the University was quietly rolled out.
Using a non-Stanford email address, the Guest Accounts system lets users authenticate to
web applications, services, or computer clusters.
Unlike SUNet IDs, Guest Accounts are not granted any default privileges
or access to services; access must be set up by the system or service owner.
Any Stanford faculty, student,
or staff member can invite anyone with an email address to create
a Guest Account. When the Guest Account email address is added
to a workgroup, access to specific web pages and resources is
granted.
The technology behind this service is a new Active Directory
realm and a Shibboleth/WebAuth infrastructure that handles web
authentication for Guest Accounts. Guest Accounts can also be
added to groups in Workgroup Manager. Shibboleth
allows both SUNetID owners and Guests to authenticate to the
same web site and use the same group memberships for authorization.
Thanks to the guest accounts team: Russ Allbery, Michael Dave,
Quanah Gibson-Mount, Kevin Hall, Digant Kasundra, Christopher
Kittle, Jay Kohn, Greg Koss, Brad Lauster, Scotty Logan, Bill
MacAllister, Paul Pavelko, Jon Pilat, Dmitri Priimak, Roopa Sastry,
Bruce Vincent, Tom Wiggins, Ross Wilper, and Brian Young from
IT Services. Madhu Gottumukkala, Lynn McRae, Phong Nguyen, and
the entire Middleware team from Administrative Systems were also
part of the Guest Accounts team and were instrumental in bringing
this service online.
To learn more about the Guest Account system, please see the Guest
Accounts service page.
- Jonathan Pilat
Systems Administration
Ivy+ Infrastructure
Ivy+ Infrastructure is a group of peers from the Ivy+
schools that support services like systems administration, email,
and middleware. The Ivy+ schools include Harvard, Yale, Princeton,
University of Chicago, University of Pennsylvania, Dartmouth,
MIT, Duke, Columbia, Cornell, and Stanford. From May 6 through
May 9, we met at Duke University to discuss what's going on in
our areas. We focused on data center changes, IT reorganizations,
major ongoing projects, and where we see disruptive technologies
emerging that will change how we provide services.
There is quite a bit
of commonality among the schools. Everyone talked about the
different tactics they are pursuing to alleviate the common data
center space problems. Every school seems to be going through
a reorganization.
The disruptive technologies concept was one of the most interesting
threads in our meetings. A disruptive technology
is one that fundamentally changes how (or even if) a group does
business. As an example, students and junior faculty no longer
look solely to their home institution to provide services. Instead,
they are taking all of the resources at their disposal—like
Facebook, Twitter, Google Apps, and Amazon EC2—and using
them to take communication and learning to a whole new level.
We have to be prepared to let our services integrate with non-institutional
resources—that's
a huge change with major challenges for us.
Other potentially disruptive, or at least revolutionary, technologies
include e-discovery. E-discovery is the ability to discover and
retain information in response to legal action. As more and more
information is stored in electronic format only, IT departments
have a new set of challenges in storage, identity management,
logging activity, and other requisites. After the Virginia
Tech shooting a few years ago, the University
had the need to retain huge amounts of data. They did not
have the storage available and had to spend a large amount of
money to get additional storage installed to keep
data intact and be able to continue to support the business
of the University. They still have that storage set aside.
The chance to meet with our peer institutions and discuss
these issues is a great way to get help with current challenges
and finding out what issues might be coming at us in the
next few years. We will be meeting again in November. Topics
will include metrics, staffing, and service portfolio management.
If you have any questions for our peer institutions and would
like some feedback, please contact
me.
- Heather Flanagan
Systems Administration
Stanford Email and Calendar Suite
The Stanford Email & Calendar implementation is making brisk progress towards the initial pilot with IT Services on June 23rd. Functional and load testing tasks are going well. Of course, some bugs and quirks are being uncovered, but the team is working with Zimbra to fix or mitigate issues as they arise.
As we approach the June 23rd email conversion, now is the time that we ask a lot of our colleagues in IT Services. Not only will you be the first to use the new tools in a production environment, you will also be our ambassadors to the rest of campus. For this project to be successful, we ask all IT Services staff to promote a positive impression of the product to the campus community and also to report issues and problems via HelpSU.
For the initial mail-only conversion on June 23rd, you may not notice a change except for the new interface to Webmail. On July 21st, data from Sundial will be converted to the new Stanford Calendar, and IT Services staff will be asked to maintain information in both calendar systems until October 27th. IT Services locations and resources will be reserved in the new Stanford Calendar, but for the convenience of our clients, we will need to keep our calendars updated in Sundial as well, and clients may still use Sundial to make appointments with you. The team knows this will be inconvenient for many of our staff, but this real-world test is key to discovering and correcting issues so that we can provide the best service possible when we release these tools to our clients.
The project team will send additional communications via email to help prepare for this transition. Check the web site at iec.stanford.edu for more information or send questions to iec-questions@lists.stanford.edu.
- Ammy Hill
Campus Readiness
Internet 2
Heather Flanagan, Bruce Vincent, Scotty Logan,
and Jon Pilat represented IT Services at the Internet2
member meeting in Arlington, Virginia last month. Internet2
(I2) is a consortium of higher education institutions as well
as corporate and nonprofit partners that research and develop
advanced networking and middleware technology. Stanford is part
of the I2 research network backbone and a leading member of
the middleware community.
Many of the I2 middleware projects were originally based upon
products developed and used at Stanford. Grouper,
the I2 group management solution, shares common roots with our
Workgroup Manager. Signet, the I2 privilege management
solution, is an evolution of Authority Manager. Stanford's commitment
to collaborative middleware solutions continues with COmanage:
a new product that incorporates many of the I2 middleware products
and a variety of "well-behaved" (i.e., willing
to "trust" I2 middleware) external applications that
are configured to create an all-in-one infrastructure.
The COmanage framework
can support the authentication and authorization needs of a
virtual organization within a single identity
management framework such as a cross-institutional research
team or other far-flung collaborative enterprise. Digant Kasundra
and Scotty Logan are working on the initial design and implementation
of the COmanage framework. This includes building a virtual machine-based
COmanage appliance that can be installed and configured quickly.
Heather Flanagan and Bruce Vincent are the project coordinators
for COmanage.
Other highlights included hearing about how other institutions
have rolled out Shibboleth and Grouper, a method for pulling
together attribute sets from disparate identity providers into
a single authorization event, and the use of Second Life as a
research and collaboration tool.
- Jonathan Pilat
Systems Administration