A while back an internal audit focusing on IT administrative systems, in particular two areas, Human Resource Management and Student administration, was conducted. The audit tried to establish whether the university’s policy with regard to administrative system users complied with prescribed best practices and whether adequate processes are in place to manage access rights.
It was found that there was a need for a formal Identity and Access Management (IAM) policy, more regulated processes and one central source from which identities (see definition below) should be managed.
The current practice of issuing multiple electronic identities per business application or per individual associated with the university for access to administrative systems, lends itself to the fraudulent use of both electronic identities and information – a high risk at an academic institution.
The audit findings were considered and as a result thereof an all-encompassing Identity and Access Management Project (IAM Project) was initiated to mitigate both known and potential risk around system and resource (i.e. Library ) access.
In an effort for better control on creating identity the following three systems will be the only recognised systems from which both identity and electronic identity can originate.
- Student Administration – Registration of students including Short Course registrations
- Human Resource (HR) – All SU staff that needs to be reported on for statutory purposes or for whom a payroll needs to be run.
- SUNid- used for any person that forms an affiliation with SU, but cannot be classified as either student or staff. The current classification for this group of person is either that of external worker or visitor.
IAM aims to addresses 95% of the audit findings by establishing a central system from which one electronic identity can be issued via an automated process with full audit on who has access to which system and who approved the request. A future deliverable from this project would be a formal definition of roles (e.g. Payroll clerk) from system function (program) access patterns to facilitate role-based access request management.
An Electronic Identity Validation Regulation has already been approved and can viewed here.
The IAM project is one of continuous improvement and development. It’s more than just putting systems in place, but also about understanding the university’s organisational behaviour and processes to ensure these systems will increase productivity and function optimally.
To keep you up to date on upcoming IAM projects, we will be running a series of articles from this week. In our next article we’ll be looking at AIS.
If you’re still in the dark as to how SunID works, refer to your wiki for detailed instructions or read our previous blog articles.
If you prefer a more hands-on approach, we’ll also be hosting a few informal sessions where you’ll be guided through the process step-by-step and also have the opportunity to air all your complaints and questions. If you’re like to attend one of these sessions, please contact Petro Uys at puys@sun.ac.za.
Definitions
Identity – the capturing of all personal information and creating a unique 8 digit Stellenbosch university number also commonly referred to as student number, staff number, ut_number, su_number.
Electronic Identity – refers to username and password associated to an identity record
`n Tydjie gelede is `n interne oudit met die fokus op IT administratiewe stelsels, spesifiek Menslike Hulpbronnebestuur en Studente-administrasie, uitgevoer. Die doel van die oudit was om vas te stel of die universiteit se beleid oor administratiewe stelselgebruikers voldoen aan voorgeskrewe beste praktyke en of voldoende prosesse in plek is om regte te bestuur.
Daar is bevind dat `n behoefte bestaan vir `n formele Identiteit- en toegangsbestuurbeleid (IAM), beter gereguleerde prosesse en een sentrale bron waaruit identiteite (sien definisies onder) bestuur moet word.
Die huidige praktyk reik veelvuldige eletroniese identiteite uit vir toegang tot administratiewe stelsels en doen dit per besigheidstoepassing of per individu geassosieer met die universiteit. Hierdie proses kan maklik blootgestel word aan die misbruik van elektroniese identiteite en informasie – `n hoë risiko vir `n akademiese instansie.
Die ouditbevindinge is in ag geneem en op grond daarvan is `n oorkoepelende Identiteit- en toegangsbestuurprojek (IAM Projek) geloods om bestaande en potensiële risikos rondom stelsel- en brontoegang (byvoorbeeld die Biblioteek) aan te spreek.
In `n poging om beter kontrole te handhaaf wanneer identiteite geskep word, sal die volgende drie stelsels die enigste erkende stelsels wees waarop identiteit en elektroniese identiteit geskep kan word.
- Studente-administrasie – Registrasie van studente, insluitende Kortkursusregistrasies
- Menslike Hulpbronne – Alle US-personeel wat wetlik oor rapporteer moet word of op die Universiteit se salarisrol is.
- SUNid – Gebruik vir enige persoon wat geaffilieerd is met die US, maar nie geklassifiseer kan word as student of personeel nie. Die huidige klassifikasie is die van eksterne werker of besoeker.*
IAM poog om 95% van die ouditbevindinge aan te spreek deur `n sentrale stelsel te vestig waarvandaan een elektroniese identiteit uitgereik kan. Dit sal uitgereik word deur middel van `n outomatiese proses met `n volledige oudit van wie toegang to watter stelsel het en die aansoek goedgekeur het.
Een van die doelwitte van hierdie projek sal `n formele definisie wees van rolle (byvoorbeeld Salarisrolklerk), onttrek uit stelselfunksie bestuurspatrone om rolgebaseerde toegangsversoekbestuur toe te pas.
`n Elektroniese Validasie Reglement is reeds goedgekeur en kan hier besigtig word.
Die IAM-projek word deurlopend ontwikkel en verbeter. Dis meer as net ‘n proses om stelsels in plek te sit, maar vereis ook begrip vir die Universiteit se organisatoriese werkverrigting en prosesse om te verseker dat stelsels produktiwiteit sal verhoog en optimaal kan funksioneer.
Om jou op hoogte te hou van toekomstige IAM-projekte sal ons ook voortaan `n reeks artikels bied. Ons volgende een fokus op AIS.
* Indien SUNid steeds vir jou Grieks is, kyk gerus op ons wiki vir `n uiteensetting of lees ons vorige blog-artikel. Indien jy `n meer praktiese aanslag verkies, sal ons binnekort `n paar informele sessies aanbied waar jy stap-vir-stap daardeur geneem sal word en ook die geleentheid sal kry om al jou vrae te vra. Stuur asseblief e-pos aan Petro Uys by puys@sun.ac.za indien jy belangstel om `n sessie by te woon.
Definitions
Identity – the capturing of all personal information and creating a unique 8 digit Stellenbosch university number also commonly referred to as student number, staff number, ut_number, su_number.
Electronic Identity – refers to username and password associated to an identity record
