A Note From Bill...
Recently, a laptop storing large amounts of restricted data was stolen from a Stanford University employee. The type of data lost was summarized in the official memo that you received from Randy Livingston, and included social security numbers, home phone numbers, and salary information for tens of thousands of current and former Stanford staff. While the vast majority of such thefts are simply for the purpose of reselling the hardware and not for the data the computer contains, there is still a significant risk. The University sent notifications to keep the community informed and will continue to monitor the situation closely.
Last autumn, IT Services launched an intensive project to increase security across all of our systems. While the security effort was focused primarily on servers, storage, and other central facilities, it also extended to desktop and laptop computers. We continue to run biweekly scans, as well as semi-annual penetration tests, to identify potential risks so that we can correct them before they are exploited. To date, we have significantly improved the security of our central servers and storage and the data they house. I want to thank each of you for all of the work that you have put in to achieve this noteworthy progress.
Our work on the desktop and laptop environments is just now beginning to become more widely visible. IT Services, in conjunction with the Information Security Office, has launched a new data encryption service for clients using Windows desktops and laptops. We continue working on a solution for the Macintosh and UNIX environments. (While there are individual solutions for the Mac and for UNIX, we need a service that allows clients to recover their encryption keys if forgotten.)
IT Services has also started planning security services for handheld devices. The use of these devices continues to increase, resulting in a growing and serious security risk, especially in terms of loss or theft. With the amount of email that all of us deal with each day, it is easy to see how we might have restricted data on these devices without even knowing it.
Until the time comes when we are able to effectively have encryption on all of the data across all of our various devices, it is critical that we take whatever steps we can to ensure the security of the data on the devices that we do have. First and foremost, it is important to check and make sure that you do not have restricted data on any of your Stanford-owned (or personally-owned) devices. Please go to the data classification web page to see what is classified as restricted data, and then remove that data from your desktops, laptops, and handheld devices. Be aware that most laptop and handheld device thefts occur from automobiles, so make sure not to leave such equipment in unattended vehicles. Additionally, there has been a growing number of office thefts on campus, so it has become more important to lock your office when you leave.
Security is becoming an increasingly important part of the job of everyone in an IT organization, and we need to remain vigilant about it. Just a moment's forgetfulness can cause untold grief both for the University and others. Let's all do our very best to continue to improve our security awareness, processes, and practices.
- Bill Clebsch
IT Services
Director of Service Management Announced
I am delighted to announce that Nan McKenna has agreed to become our first Director of Service Management, effective Monday, June 23rd.
As you know, this is a critical leadership position as the Business Services organization combines management of two newly created functions: business partnership and services management
(see revised Business Services organization chart). In the area of business partnership, Nan will manage a team of Business Partners and support personnel who will work with clients across the University to understand their business requirements, assist with technical strategy and planning, and prioritize their technology needs. On the service management side, she will work with our technical product owners to develop service line strategies and road maps, manage the service line development lifecycle, and roll out new services and enhancements, as well as—when deemed appropriate—sunset services. Nan's first objectives will be to complete the hiring of the five critical positions that will report to her, beginning with the Business Partner roles.
Nan is particularly well suited to take on this challenge. Having worked at Stanford for more than 20 years, it would be an understatement to say "she knows the territory." Importantly, during the past three years, she developed the Client Relations group into an integral part of IT Services' client focus, working externally and internally, across multiple ITS technical work groups, to be sure we're delivering quality services to clients. She has served as a member of the Services Portfolio Review Team, looking strategically across IT Services’ portfolio of products and services to identify best directions for the organization. Nan has also chaired the IT Services Rates Committee, working to understand and improve the financial models behind our services, review service performance, and recommend final rates to the Executive Directors.
Please join me in congratulating Nan on taking on this new and exciting role!
- Sam Steinhardt
Business Services
2008 Client Satisfaction Survey Results: Online Now
The 2008 Client Satisfaction Survey results are available on the IT Services web site. IT Services has conducted annual satisfaction surveys since 2003. The most recent survey was completed in April 2008. Each year, we ask a sample population of faculty members, undergraduate and graduate students, and administrative staff to complete the survey. The survey's purpose is to:
- Find out how clients rate services and support provided by IT Services;
- Ascertain factors that contribute to client satisfaction or dissatisfaction; and
- Give clients a voice to influence IT Services priorities and potential initiatives.
The survey spans a range of topics, including customer service, help desk, telecommunications, networking, email and Webmail, security, remote access, data storage, and other technical services. We contract with an external firm to conduct the survey in order to ensure objectivity and confidentiality.
Directors and Managers were recently briefed on the outcomes. They have been asked to discuss these results with work groups during June.
- Client Satisfaction Survey Team Members
Jan Cicero, Bill Clebsch, Heather Flanagan, Tom Goodrich, Jim Knox, Nan McKenna, Chris Lundin, Suzanne Schiessler, Christine Soldahl, Nancy Ware
PCG Update
This is an update on the effort I kicked off in mid-May to assess the Production Control Group (PCG) workgroup. We have completed the data-gathering from staff, clients, and IT Services directors and managers—thank you for sharing your insight and thoughts.
Based on all the feedback we received, we put together an analysis and set of recommendations. The analysis included five options that varied from No PCG to an enterprise "NOC-like (Network Operations Center)" model. These were presented to the Executive Directors and the final recommendation was what we called "NOC-lite or the Operations Control Center". This workgroup will report to Chris Lundin, Director of Help Desk Services, as of June 16, 2008.
Service Profile for the Operations Control Center:
- 24x7 incident management. End-to-end trouble ticket resolution for all services, plus proactive communication and root cause analysis.
- Component of 24x7 Help Desk and consistent single point of client contact for non-business hours; responsible for post-mortem analysis and documenting lessons learned.
- 24x7 service monitoring and metrics—first responders to any/all critical alerts, own and initiate appropriate staff/client escalations; manage Change Advisory Board maintenance items.
- 24x7 support for all data centers: Forsythe, Sweet, ECHs, Research Computing—"after-hours hands and eyes," including ability to un-rack and swap out hardware (i.e., "24x7 TFAC").
- SOC (Satellite Operations Center, activated during campus emergencies) Facilitator/Incident Commander and SOC activation.
What Happens Next:
The following is a short list of first steps for implementation:
- Define a Two-Year Charter (phased approach) for the Operations Control Center workgroup.
- Complete the job grade and skills assessment for the workgroup.
- Create a training matrix (e.g., intensive training program + SME support + Competency Model + Mentoring) for the workgroup.
- Create standard playbooks (i.e., documented processes and procedures written collaboratively by/with operational workgroups).
- Other actions based on discussion of this analysis and recommendations.
I will be working with Chris Lundin, Dani Aivazian, and Nilda Bonet on these first steps over the next few weeks.
I would like to sincerely thank Carolyn Kane for stepping in and managing the PCG workgroup over the past four months. She didn't hesitate to jump in and familiarize herself with the workgroup and functions, looking for opportunities to make their processes more efficient.
Your ideas and feedback continue to be critical input to our success in this effort. Don't hesitate to write or call if you have any questions.
- Jan Cicero
Client Support
IT Services Email Migration This Weekend
Hopefully by now it will come as no surprise that on Monday, all IT Services staff will have access to the new Stanford Email and Calendar. In fact, some IT Services staff will move tonight. In order to ensure that the project team can communicate effectively during this critical transition weekend, their mail will be migrated Wednesday night.
IT Services mailboxes will be migrated from the current Cyrus servers to the new Zimbra servers in three waves from midnight to six a.m. on Friday, Saturday, and Sunday nights. Once your mailbox is migrated, you'll log in as you normally do. If you're using a desktop client, the only difference you may see is a welcome message in your inbox. For those logging in via webmail.stanford.edu, you'll automatically be directed to the new Stanford Email and Calendar. For more information, check out the Migration Checklist.
Remember, we're counting on all IT Services staff to be ambassadors for these new tools when you're interacting with clients on campus. Every transition comes with its problems, but by pulling together to constructively identify and address these issues, we can all help to improve the transition experience for our clients.
If you missed the IT Services Pre-Migration meetings, you still have an opportunity to take a look at the Stanford Email and Calendar before migration. There will be a Tech Express in Turing Auditorium on Thursday, June 19th at noon. If you see members of the project team in the hall, be sure to wish them good luck since many of them will be working hard this weekend.
- Ammy Hill
Campus Readiness
Services Portfolio Planning Update
The Services Portfolio Planning team recently completed Round #1 recommendations and launched Round #2 analysis.
Round #1 Outcomes and Recommendations. These outcomes may have already been reviewed during recent workgroup meetings. If they were not, please ask your Director or Manager to review the findings and known next steps. In brief, the Services Portfolio Team recommended the following actions:
- Services to Keep, with Additional Investment
(invest to implement defined plans/visions by subteams)
- Converged Network (includes ACD, Phones and Vmail for Faculty, Staff, and Hospitals, Spectralink Pocket Phones, VoIP)
- Integrated Email, Calendar (including Webmail)
- Web Services
- Storage (including Bulk, NAS, SAN, Super High Availability/Performance)
- Services to Keep, with No Additional Investment
(these areas were asked to define business plans; they will be re-evaluated next year)
- Citrix
- DSL for Faculty, Staff
- Services to Exit
- TechPort, effective 9/09
- IT Course Support, effective 9/09
- Backup and Recovery for Desktops, effective 12/08 complete transition for this service, to be provided by external vendors
Round #2 Analysis. Underway; scope includes:
- Secure Email (held over from Round #1). Team Lead: Bruce Vincent
- Phones, CableTV, & Internet Services for Stanford West and Welch Road Residences (this also includes the new residences under development). Team lead: Mark Miyasaki
- Cable TV Services (all aspects: Academic, Student, Residences, Other. Team Lead: Mark Miyasaki
- Card Services (including operations business model). Team Lead: Sam Steinhardt
- Document Management (including role of Docushare in 2 year future). Team Lead: Jim Knox
- AFS (focus is to define current uses of system, confirm where changes are underway or pending for next 2 years). Team lead: Jim Knox
Each Team Lead met with the Services Portfolio team to confirm the scope of the review, to discuss analysis to date, and to confirm timing of next steps. In most cases, the teams will work through the summer to develop the visions/recommendations. The leads are beginning to identify their teams and analysis is underway.
Please let us know if you have any questions. We will keep you informed as the work continues.
- The Services Portfolio Planning Team
Sam Steinhardt (Chair), Heather Flanagan, Fred Hansson, Shirley Hodges, Nan McKenna, Mark Miyasaki, Molly Reynick, Bruce Vincent, and Nancy Ware