IdM Governance in Higher Education Dave Muehling Director, Consulting dmuehling@burtongroup.com http://www.burtongroup.com 1 April 2010 www.burtongroup.com

Governance is Overwhelming! Higher Education may not be able to use common business patterns Funding models can become a roadblock Governance models differ, even within the Higher Education space itself The Culture of Higher Education is unique It is often difficult to assign ownership Membership in governing bodies is often fluid and diverse DAVE www.burtongroup.com

Why Talk About Governance Now? The Generation Y and “Z” effect Technologies role in research and education Regulation and Compliance: FERPA, HIPAA, PCI Technology overload: Stacking the deck Social Networking Mobility The “my.Device” dilemma Federation DAVE www.burtongroup.com

What Is IdM Governance? What is Governance? Governance sets policy, establishes authority and responsibility, and implements accountability Comprises structures, rules, power and influence, funding mechanisms, enforcement mechanisms, and appeals processes University executives and steering committees define policies Localized working groups implement policy via processes IT automates some of these processes through technology DAVE www.burtongroup.com

Effective Governance Foster communication Achieve high data quality A strong governance team helps institutions Foster communication Achieve high data quality Promote application inter-operability Avoid undue risk Bring together different constituent groups Enforce regulatory compliance Supports the autonomy amongst the schools Provide better service www.burtongroup.com

Effective Governance Build value Create transparency Goals of governance Build value Create transparency Allows management to understand whether the risks the institution is taking are prudent and to know how effectively its value-creation and loss-limitation activities are functioning so that these activities can be adjusted if they are not doing the job To achieve executives’ governance goals of building value and creating transparency, institutions must continuously perform two governance tasks Turn policies into processes Measure success - create evidence of its actions www.burtongroup.com

Effective Governance Sponsorship Ownership Core Team A strong governance team requires Sponsorship Maintain focus Manage relationships Overcome roadblocks Provide stewardship throughout the life of the IdM initiative Ownership An individual or group should be accountable for the decisions made and the actions taken Has enforcement capabilities to go along with the accountability Core Team Responsible for day-to-day direction Right mix is critical to making effective decisions www.burtongroup.com

Effective Governance What happens if an institution does not have effective IdM governance? Redundant identity data propagated across application silos Diminished oversight as to how identity data is being used as propagation “propagates” Duplicitous application development to handle authentication or authorization Potential misuse of sensitive identity data due to insufficient controls Little end-to-end auditability Of identities and access privileges across all resources Of the applications and systems using an institution’s identity data and how that data is used www.burtongroup.com

Governance IdM Framework model includes governance DAVE www.burtongroup.com

Types of IdM Governance Models Formal Hybrid Model Shared Central ownership with steering committees and working groups throughout the institution Centralized Model All governance stems from strong central ownership with centralized committees and groups Explicitly De-Centralized Model All governance stems from individual committees and working groups that act in an independent fashion No Clear Governance Model DAVE www.burtongroup.com

Levels of Governance Maturity Level 5 – Optimizing Continuous process improvement is enabled by quantitative feedback from the process and from testing innovative ideas and technologies Level 4 – Managed Both the process and end-products are quantitatively understood and controlled using detailed measures Level 3 – Defined The process for both management and engineering activities is documented, standardized, and integrated into an organization-wide process and used by all projects DAVE Level 2 – Repeatable The necessary process discipline is in place to repeat earlier successes on projects with similar applications Level 1 – Initial Few processes are defined, and success depends on individual effort talent and heroic effort www.burtongroup.com

IdM Governance Framework Business Initiatives & Processes Technology Strategy & Usage Growth Management Federation Legislation Guiding Principles Policy Management Model System Architecture and technical Standards Enforcement Processes Recovery Monitoring Administrative and End User Guidelines and Procedures Business Drivers Governance Documents policy, principles, control environment Management Model – content management, security management, operational impact Operations Documenting administrative and end-user guidelines and procedures Administering access controls, monitoring, and recovery processes Business Requirements Architecture Design the infrastructure Develop technical standards and processes Factors determining the Business drivers User Profile extensions www.burtongroup.com

Governance Governance Process – it is iterative! www.burtongroup.com

Governance The IdM strategy should be published and reviewed on an annual basis (“evidence of its actions”) The review process should evaluate the strategy with respect to four key areas: Enhancement to existing services New services Operational efficiency Cost reduction www.burtongroup.com

Governance High level governance process example for an institution to consider (“operationalization”) Any department, application owner or business project team requiring new services or extensions to existing services provided by the IdM infrastructure must provide the following: Business purpose Description of the processes Written assurance that the data being used will be protected to the full extent of the institution’s data usage policy www.burtongroup.com

Where To Begin? Understand that individual initiatives will have priorities and objectives that don’t align directly to others A governance body should, therefore, Rationalize common requirements and capabilities Arbitrate the needs of different initiatives Acknowledge and accommodate the current state Establish the point of convergence Foster and manage the migration DAVE www.burtongroup.com

Governance Business processes that impact the IdM infrastructure The governance team and working groups develop: Business processes that impact the IdM infrastructure Service-level-agreements Operations and maintenance issues Enterprise (University) standards Application integration guidelines Privacy guidelines Data-usage guidelines Schema extensions University role definitions and usage Authentication and authorization rules Address operational issues Budget and funding DAVE www.burtongroup.com

Governance Executive stakeholder(s) IT Security and/or Privacy A “typical” IdM Governance Team would be comprised of decision-making representatives from the following departments: Executive stakeholder(s) Delegate but maintain responsibility IT Security and/or Privacy IT Architecture Operations and Support (e.g., Infrastructure) Administrative Systems HR Information Systems Registrar Application Development Internal Audit DAVE www.burtongroup.com

Where / How To Start Evaluate existing policies and processes during initial analysis and release Start making governance decisions now to be ready for future requirements Iterative process –Create, Validate, Finalize Executives, legal, IT, privacy, & security validate any decisions If needed, form sub-teams to work offline and present recommendations DAVE www.burtongroup.com

How To Measure Success Leverage management frameworks (CobiT, ITIL, etc.) Key Goal Indicators Business-driven measurements of what needs to be accomplished Lag indicators that can only be measured after the fact Examples: CISO / CPO agreement and signoff, having operations on budget and on schedule, availability of systems and services Key Performance Indicators Short, focused measurements of how well a given process is performing Examples: reduce # of support incidents, satisfaction of stakeholders By clearly defining key goal and performance indicators, institutions can establish benchmarks to determine effectiveness of governance model www.burtongroup.com

Summary Governance should start at the top Governance tasks should be delegated, but authority is still held at the executive level In order for governance to work you need to: Have a minimum level of control at the top level Have to determine scope of compliance Have to determine execution of compliance Have to create the processes, audit points and architectures that will support the decisions being made One size does not fit all – define and adopt a governance model that best fits with the institution’s principles and culture www.burtongroup.com

Q&A www.burtongroup.com