Information Technology Planning Board (ITPB)
January 18, 2007
Meeting Summary
www.itpb.ucla.edu
ITPB Attendees: Kathryn Atchison, Elizabeth Bjork, Christine Borgman, Alfonso Cardenas, Mitch Creem, Russel Caflisch, James Davis, Daniel Fabbri, Xue Hua, Bill Jepson, Sam Morabito, Michael Schill, Charles Taylor
Guests: Ross Bollens, Ruth Sabean, Mike Schilling, Marsha Smith, Greg Spotts, Kent Wada, Don Worth [and three students from Mark Hansen’s statistics course.]
Meeting Called to order at 3:05 pm.
Meeting Notes from December 4, 2006 were approved without amendment.
Agenda Item 1: Presentation and Discussion on recent Campus Security Breach
The presentation by Jim Davis, Sam Morabito and Don Worth described the nature of the attack on an AIS system, UCLA’s notification of all potentially affected persons, and the ongoing campus-wide efforts to improve data security.
There is clear evidence that 28,600 individual records were accessed on 11/21/06, which was the first time that UCLA became aware of the attack. All 803,000 persons in the relevant database were notified in December 2006, and the 28,600 persons whose records are known to have been accessed were notified a second time in January, 2007.
Social Security Numbers in the relevant database are now encrypted, substantially blocking access to that information. The online password reset function for Bruin Online has been disabled and was temporarily replaced by a form that must be faxed to the BOL office. The on-line function has now been restored with a mandatory challenge question. The campus-wide inventory of personally identifiable information, originally created in 2003, is being updated. UCLA and UCOP are developing RFP’s and RFQ’s for various consultants, systems integrators, and software vendors to review data security. UCLA is working with other UC and non-UC campuses to develop a rapid-response security group to share information and best practices.
Discussion Points:
- The reflex to “lock down” information for security purposes after a breach must be balanced with the need for openness within a research and academic institution. This is position stated earlier by the Privacy and Data Protection Board. As new security measures are developed, policy must be developed as well.
- Campus policies on collection and retention of personal data must be revised, as the best way to protect personally identifiable data is to avoid collecting them. Internal university processes and systems should be redesigned where possible to avoid using Social Security Numbers for identity matching. However, a number of outside organizations require the university to use SSN’s for identity matching purposes.
- Certain security measures such as “ethical hacking” may require policy guidance.
Action: None requested, none taken.
Agenda Item 2: Presentation and Discussion on Repositioning Initiative, which has been renamed Technology Infrastructure for Education and Research, (TIER).
Marsha Smith made a presentation on the history of the Repositioning IT initiative which began as a campus effort to reduce costs and complexity in campus infrastructure services, consolidating a large number of independent physical networks, email systems, server rooms and data centers into fewer regions. As part of a response to the Chancellor’s 2003 request to reduce costs, the initiative emphasized the consolidation of infrastructure services primarily (but not exclusively) in administrative areas.
A great deal has been accomplished under Repositioning that is foundational to our strategy for moving forward and is summarized in the document Introduction to TIER. The document outlines the achievements to date and goals for the next six months . While an emphasis to create appropriate savings and efficiencies within administrative areas is generally a desired outcome, the Repositioning IT initiative (including its name) does not adequately define or reflect the efforts involved in designing IT infrastructure services for current and future educational and research requirements. The Tier program, also outlined in the summary document, focuses on the future as we now move to design the next generation of infrastructure IT services core to reflect UCLA’s primary mission of education and research. While savings and consolidation opportunities are important under TIER, they are not the driving forces. As we move out to the greater academic campus to support its primary mission the TIER will respond to the requirements for sustaining UCLA as a leader in education and research
New projects under TIER will be coming to ITPB for review in April. Available TIER funding (approximately 2.1M annually) can support only a fraction of campus needs. An on-going discussion should begin with all appropriate governance groups (leading with ITFOC and ITPB) on the gaps between infrastructure requirements and funding. We also must begin to look at a potential funding distribution model that includes an option for regionalization as an organizing and management framework:
From the ITPB February 2005 Meeting – “The Repositioning IT Initiative leaves open the possibility of centralization AND regionalization of ‘common good’ services. If it is determined that some ‘common good’ services should be provisioned through a set of regions, the TIF will be applicable, i.e. the TIF can be applied to centralized or regionalized service delivery models.”
Discussion Points:
- ITPB would like to receive advance information on the April projects so that they can be thoroughly reviewed prior to the meeting.
- The role of ITPB and CITI in endorsing/approving projects could be further refined, although there is already a written set of principles and process proposed by the ITFOC and supported by ITPB to endorse projects funded through the Repositioning IT Initiative.
- Definitions and scope of “infrastructure” need to be addressed continually by ITPB to determine which systems and services constitute infrastructure and which are the responsibility of individual units.
- Concerns by the Deans about TIF funding are related to concerns about what constitutes infrastructure and what projects are appropriate for TIER funding.
Action: None requested, none taken.
Agenda Item 4: Technology Infrastructure Fee (TIF) Update
(Placed by Chair as third item in the meeting.)
Jim Davis provided a brief report on the TIF. Jim Davis and Acting EVC Scott Waugh have discussed using the Dean's Council to keep the Dean's up-to-date and involved as a group in major IT decisions, e.g. policy, resources and directions that are in review and discussion through the IT governance process. Specifically on TIF, it is planned that Vice Chancellor for Finance and Budget Steve Olson and Jim Davis will meet with the Dean's Council to (1) describe the processes and involved groups for reviewing what the TIF is used for and any proposed changes to the TIF, i.e. the concerns that TIF will just be indiscriminately increased; and (2) to work through additional plans to smooth the transition to the TIF and describe avenues of recourse for hardship situations especially those related to contracts and grants. The intent is, after discussion with the deans, to send a communication to PI's and academic administrative officers.
Action: None requested, none taken.
Agenda Item 3: Common Collaborative Learning Environment (CCLE)
(Placed by Chair as fourth item in the meeting.)
Ruth Sabean provided a brief report on the CCLE. UCLA has been receiving significant positive feedback on the selection of Moodle. University of Michigan executive visiting campus said “UCLA’s selection of Moodle may be the best thing that could happen for SAKAI.” Princeton University is a Blackboard campus, but the Computer Science department uses Moodle.
Since appropriate time was not available for a fuller discussion, the CCLE will be on the February agenda.
Action: None requested, none taken.
Announcements: Chair Cardenas reminded the board that since Scott Waugh has become Acting Executive Vice Chancellor his seat on ITPB will need to be filled by a new member, and several other members are nearing the end of their terms, and requested recommendations for the new member.
Meeting Adjourned at 5:05 pm.