Security

Click here to receive your FREE subscription to Campus Technology

Home > Security

Features

Security

11/29/2005

FERPA, the Family Education Rights and Privacy Act protecting student information, already well-known to higher education. FERPA, however, is also one of more than a dozen statutes amended by the USA PATRIOT Act of 2001 (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism), to give law enforcement greater access to confidential information... Technologists, higher education, and others have spent decades making online access to information ubiquitous. The grand challenge now lies in managing the access to meet societal expectations not just about access, but about privacy as well.' Read more

Role-based access:
A case study at UNC-Charlotte

Enterprise Systems columnist Mathew Schwartz recently took a look at access control technologies: 'Goodbye mainframe, hello access-control questions. When the University of North Carolina at Charlotte began moving from mainframe-based financial and human resources systems to Oracle databases, application servers, and multiple Web interfaces, IT security officer Carter Heath knew he'd have to adapt. 'We always had Resource Access Control Facility (RACF) sitting in front of the mainframe for access control purposes. That provided us assurances of who's getting what off of the mainframe.' In the emerging postmainframe environment, however, the university still needed access controls, but the question was, what would they be? Furthermore, would they fit the existing security paradigm? 'We're here to guard things,' notes Heath. 'We don't own your data, we don't own those systems. We're here to provide security protections to those systems, and enable you to get access into those systems in the most secure manner possible.' ...He came across the Identity appliance from Trusted Network Technologies (TNT), a device 'that was able to provide access control to multiple resources by an identity,' he says. 'That was intriguing.' In January 2005, he received an evaluation unit, and by May the university had purchased an Identity appliance and added it to the production environment. Currently it's using Identity version 2.0. From an identity management standpoint, Heath is lucky: the university, a Novell shop, already had extensive institutional experience with access controls, and was using ZENworks from Novell for application delivery. It also had Microsoft's Active Directory, as well as group-level permissions and processes for adding or removing users. Hence the TNT appliance was able to work with an existing infrastructure.' Read more