A while back an internal audit focusing on IT administrative systems, in particular two areas, Human Resource Management and Student administration, was conducted. The audit tried to establish whether the university’s policy with regard to administrative system users complied with prescribed best practices and whether adequate processes are in place to manage access rights.

It was found that there was a need for a formal Identity and Access Management (IAM) policy, more regulated processes and one central source from which identities (see definition below) should be managed.

The current practice of issuing multiple electronic identities per business application or per individual associated with the university for access to administrative systems, lends itself to the fraudulent use of both electronic identities and information – a high risk at an academic institution.

The audit findings were considered and as a result thereof an all-encompassing Identity and Access Management  Project (IAM Project) was initiated to mitigate both known and potential risk  around system and resource (i.e. Library ) access.

In an effort for better control on creating identity the following three systems will be the only recognised systems from which both identity and electronic identity can originate.

1. Student Administration – Registration of students including Short Course registrations
2. Human Resource (HR) – All SU staff that needs to be reported on for statutory purposes or for whom a payroll needs to be run.
3.  SUNid-  used for any person that forms an affiliation with SU, but cannot be classified as either student or staff. The current classification for this group of person is either that of external worker or visitor.

IAM aims to addresses 95% of the audit findings by establishing a central system from which one electronic identity can be issued via an automated process with full audit on who has access to which system and who approved the request. A future deliverable from this project would be a formal definition of roles (e.g. Payroll clerk) from system function (program) access patterns to facilitate role-based access request management.

An Electronic Identity Validation Regulation has already been approved and can viewed here.

The IAM project is one of continuous improvement and development. It’s more than just putting systems in place, but also about understanding the university’s organisational behaviour and processes to ensure these systems will increase productivity and function optimally.

To keep you up to date on upcoming IAM projects, we will be running a series of articles from this week. In our next article we’ll be looking at AIS. 

If you’re still in the dark as to how SunID works, refer to your wiki for detailed instructions or read our previous blog articles.

If you prefer a more hands-on approach, we’ll also be hosting a few informal sessions where you’ll be guided through the process step-by-step and also have the opportunity to air all your complaints and questions. If you’re like to attend one of these sessions, please contact Petro Uys at puys@sun.ac.za.

Definitions

Identity – the capturing of all personal information and creating a unique 8 digit Stellenbosch university number also commonly referred to as student number, staff number, ut_number, su_number.
    Electronic Identity – refers to username and password associated to an identity record 

CAPTCHA,  or “Completely Automated Public Turing” is a type of reaction test generally used in the computing environment to establish whether the user is human or not. The term includes all technological tools used to distinguish humans from computers during online interaction.

The main purpose of CAPTCHA text is to prevent automatic computer processes from abusing e-mail systems by repeatedly entering passwords or from overloading or causing security problems on network services.

The most common example of CAPTCHA can be seen below and consists of a series of distorted or cross-hatched letters and numbers users have to retype. These distorted letters hidden in letters are easily recognised by humans, but computers find it difficult.

Unfortunately computers and CAPTCHA code hacking algorithms are becoming more sophisticated and subsequently the CAPTCHA codes also become more distorted and difficult for people to recognise.

The term was first used in 2000 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper of the Carnegie Mellon University and John Langford of IBM. The most popular CAPTCHA was invented by Mark D. Lillibridge, Martin Abadi, Krishna Bharat and Andrei Z. Broder. This type of CAPTCHA prompts the user to retype letters displayed on a distorted image, sometimes also overshadowed by a series of other letters or numbers on the screen.

Seeing that this test, unlike the standard Turing test which is conducted by a person, is performed by a computer, it is often referred to as a reverse Turing test.

The CAPTCHA identification process for users has been heavily criticised, especially by disabled users, but also by other users who feel that their daily work is slowed down by distorted illegible words, even for people without disabilities.

Read more on CAPTCHA on the official website.

[SOURCE: http://www.webopedia.com/DidYouKnow/_index.asp and www.wikipedia.org]