Office of Learning and Information Technology

UW System CIO Council

Thursday, December 9, 2010

Teleconference

Attendees
Mobile UW-Madison Application Collaboration
LMS Student Surveys
CIO Security Policy Update
CAF and LAB Audit Response
UW Technology and Information Security Council
Wisconsin Cyberinfrastructure Day
Institutional IT Plans
Eduroam at UW-Parkside
Informatica Audit at FASTAR
Next Meeting

Attendees

CIOs and their Representatives Guests

Nancy Crabb
David Dumke
Nick Dvoracek
Chip Eckardt
John Krogman
David Lois
Ed Meachen
Jose Noriega
Kathy Pletcher
Elena Pokot
Stephen Reed
David Stack
Doug Wahl
Janice Ward
Melissa Woo

Brad Leege
Chris Liechty
Jim Lowe
Hideko Mills
Paul Moriarty
Jim Treu
Lorna Wong

Mobile UW-Madison Application Collaboration

Ed Meachen recalled the enthusiasm generated by the presentation on the UW-Madison mobile app at the UW System (UWS) IT Management Council (ITMC) meeting in October. Hideko Mills reported that UW-Madison is interested in collaborating with the other UWS institutions, although deploying the application it is not simply a matter of plug and play because data feeds move differently through the various UWS institutions.

The launch of the application was successful with 5,000 downloads as of yesterday by people from 36 states as well as China, Japan and Iran. The first seven functions in the application pull data from publicly available repositories that do not require authentication. The athletics and business functions have been especially used. The Madison Metro GPS system is not always active on each bus which impairs the utility of that function. Groups on UW-Madison campus have begun asking for the inclusion of features that do require authentication, such as the myuwportal and course materials.

Jose Noriega reported that the university relations team and the IT center from UW-Parkside are interested in a similar application. He inquired about about the penetration of iPhone brands vis-a-vis other devices, particularly those available through the US Cellular contract. Mills explained that an Android version of the application is targeted for February-March of 2011.

Melissa Woo reported that the ECAR Symposium earlier this week focused on mobility and recommended that institutions assess the requirements of their populations because Android is the most rapidly growing platform. That could change if the iPhone is also carried by Verizon. The Symposium presenters agreed that there is no value to having a dedicated application as opposed to a web site optimized for a mobile device unless the application takes advantage of GPS and other active function of the devices. UW-Milwaukee will use the Appcelerator to help its developers write code for multiple platforms. If that is successful, the next step will be to obtain a Mobile Enterprise Application Platform (MEAP) that supports multiple types of devices. The MEAP product space is not sufficiently mature at this time.

Chip Eckardt reported that UW-Eau Claire is also working with Appcelerator. He has found that the UW-Madison app does not work as well on the iPad as it does on the iPhone. Brad Leege confirmed that the application is an iPhone native app and is therefore optimized for the smaller screen real estate. A native tablet app will be rethought for how people actually use tablet format devices from Apple and Android. The Android space is not as homogeneous as Apple, which results in challenges to accommodate different screen resolutions and hardware capabilities.

David Dumke noted the lack of excess development staff across the UWS institutions and recommended a strategy of developing a few key applications for a few key devices with the remainder of mobile services provided by web sites that are optimized for the mobile platforms. Leege confirmed the wisdom of this approach.

Lorna Wong reported that D2L has released the first phase of a mobile application in V9.1 which will be deployed during the January 2011 timeframe. The D2L company is also interested in developing a public campus mobile app that they would like to demonstrate to interested UWS institutions. Mills noted that the D2L app has the look and feel of a web-enabled platform.

Those who are interested in learning more about the UW-Madison application can contact Leege or Mills directly.

LMS Student Surveys

Lorna Wong reported that the Learning Management System (LMS) Exploratory Task Force is collecting data that will help them determine student perception on how D2L meets their expectations and also identify their unmet needs and the growing trends of student technology use. The task force is looking for UWS institutions that may have already conducted student IT needs assessment or satisfaction surveys in the last couple of years and would be willing to share their data or findings. Data, or the names of contact persons, should be forwarded to Wong.

CIO Security Policy Update

Ed Meachen reported that work on UWS security policies has continued since the fall ITMC meeting. The issues are challenging because each UWS institution has its own policies, culture and funding challenges. There are always tradeoffs between risks and costs when identifying the sweet spots for policies for different classifications of data from both on campus and system-wide perspectives.

David Dumke reminded the council that the policy approach was chosen after initial discussions of the tradeoffs between standards and products. He would prefer to see a draft document that takes a high level approach to sensitive data without getting into details. Jim Lowe explained that different UWS institutions have different priorities, e.g., some are taking a very active approach to scanning people's computers for sensitive data. Elena Pokot noted that there could be multiple approaches that achieve the same outcome. Lowe expressed concerned about a multiplicity of instructional approaches creating vulnerabilities when data is accessed between institutions. Pokot recommended limiting access to raw data as much as possible because the weakest links in all security schemes are people.

UW-Parkside is working with merchant providers to off load PeopleSoft credit card transactions so that transaction data are not stored or processed at the institution. The next step will be to apply this methodology to other transactions. UW-Green Bay, UW-Whitewater and UW-Stevens Point are pursuing similar strategies.

Chip Ekhardt expressed concerns regarding mobile devices that are not officially procured or secured by the campus. It is necessary to go from department to department to uncover the vulnerabilities of work processes. Pokot reminded the group that the concern is not people accessing their own data, but rather data pertaining to others. Meachen confirmed that these cases are being closely monitored by the Human Resource System (HRS) project.

Meachen noted that effective policies need to be built from the UWS institutions upwards, not from the UW System Administration downwards. On the other hand, the UWS needs to ensure that all of the institutions have policies for highly critical data. The new approach will be to talk with the institutions to see what they are doing with highly critical data elements such as social security numbers and credit card numbers. Subsequent steps will include talking with campus administrations about the risks that their institutions may be posing for themselves and for and the other UWS institutions. This will be a task for the new UW Technology and Information Security Council.

UW Technology and Information Security Council

Ed Meachen explained that a new UW Technology and Information Security Council is a formalization of the group that identified endpoint security recommendations a couple years ago. It will be a working group that will help gather information regarding what institutions are doing with respect to security policy. Chris Liechty envisions the group working in collaboration with the UW Data Privacy and Security Group, but focusing on technical implementation. The new group will also draft policies that aid in the work of the Data Privacy and Security Group, e.g., the possible encryption of laptops. Each CIO is asked to appoint a main security representative to the UW Technology and Information Security Council, although others from the institutions can participate as well.

Council members expressed the hope that the group will clarify how institutions should respond to certain items on the Credential Assessment Framework (CAF) survey instrument. The first meeting will be in the January timeframe; either in person or by phone.

CAF and LAB Audit Response

Ed Meachen will send the Legislative Audit Bureau a brief note regarding today's council activities, the appointment of the Technology and Information Security Council and the efforts to develop a timeline for a plan to achieve CAF level 2.

Wisconsin Cyberinfrastructure Day

David Stack reported that the attendees, both in-person and virtual, at the November 5th Wisconsin Cyberinfrastructure Day were largely not novices and were primarily interested in seeing applications of cyberinfrastructure in fields other than their own. The organizing committee expects to have a some funds available from their Internet2 grant that they can use to help support events at the UWS institutions that are natural follow-on activities. The attendees reported particular interest in learning more about issues regarding data storage, data management, data archiving, etc.

Institutional IT Plans

Ed Meachen reminded the council members that their annual institutional IT plans, either the actual copy or a ULR to where the plan is posted, are due to his office by January 14, 2011. The plans or URLs will be posted on the UWSA OLIT website for use by the Board of Regents.

Eduroam at UW-Parkside

Jose Noriega reported that after representatives from UW-Parkside attended the presentation at the ITMC meeting they conducted additional research and found that Eduroam is growing in popularity in the United States. There are 10 active institutions and 15 more are in process and another 16 have expressed interest. UW-Parkside has since been collaborating with the University of Tennessee-Knoxville, UW-Madison and a couple other UWS institutions.

A necessary first step is to have 802.11x active on the institution's wireless network. The institution can then apply for membership to the Eduroam consortium and direct its Radius server to talk to the Eduroam infrastructure. The institution's firewall must pass the Eduroam traffic as confirmed by a series of configuration tests. It is important to double-check all of the intervening passwords because incorrect passwords generate cryptic error messages.

Once the Eduroam infrastructure is running, the institution must decide whether to broadcast a network with the Eduroam name or to brand it as something else. UW-Parkside has created a separate SSID that will be advertised as the Parkside secure wireless network. Instructions are being written for common mobile device operating systems. Institutional users of the network are authenticated locally. Only guests from participating institutions are authenticated via Eduroam.

Eduroam provides an opportunity to increase collaboration across the UW System once people can travel between institutions and sign in using their home credentials. It also offers an institution the ability to offer an encrypted wireless network in addition to a traditional unencrypted network.

Currently the Eduroam project at UW-Parkside is in a pilot phase and not being widely publicized. The implementation was not costly in terms of hardware, software, fees or people. The major investment was in the time it took for the network administrator to learn the necessary configuration. Downstream costs, if any, will be closely monitored.

The University of Tennessee-Knoxville will be posting configuration instructions on the Eduroam website that reflect some of UW-Parkside's experiences and recommendations.

Noriega provided useful links regarding Eduroam:

Informatica Audit at FASTAR

John Krogman reported that FASTAR is responding to a request from Informatica to audit the number of licenses in use. There should be no need for the UWS institutions to get involved and therefore any questions from Informatica should be forwarded to FASTAR.

Next Meeting

The next CIO Council meeting will be on January 20, 2011 at the Pyle Center in Madison.

Meeting dates, the directory of the UWS CIOs and meeting summaries are available at www.uwsa.edu/olit/cio.