Towards a computing commonwealth

Lou Burnard

Oxford University Computing Services

http://www.ict.ox.ac.uk

... or, What did the Romans ever do for us?

What IS going on in Banbury Rd?

email madness

portalism, vle, vre, osswatch...

SSO : why you want it and what it costs

Mobilising access

Developing an ICT team

But first, how about some strategic thinking?

Where does strategy come from?

from on high

by looking over our shoulders

by listening

All of the above

doing without it is not an option!

Single Sign On: why you want it

Reduction in complexity

For service provider

For service user

The vision

A reliable university-wide authentication system which can be integrated with local authorisation needs

Persistent access to shared resources, from your desk in college, departmental lab, or laptop in the park...

We are not there yet!

SSO is not the same as sharing passwords...

SSO: current state

Kerberos data store exists

All Herald data (30,000 accounts) migrated without incident

Over 1.5 million authentications daily

Webauth

Now used by weblearn and maillist; webmail this summer

Kerberised clients

To be deployed in help centre shortly; under investigation for VPN concentrator

Now open for business

In use at Oriel and Physiology.

SSO implications

Password security is (even) more important than before

multiple services

state of siege

We need your help!

Dear Help Centre

Thank you for the attached. But I DON'T WANT to change my password. I am quite happy with it. I also think that I am old enough not to be big-brothered by you; I will be responsible for my own security .... Please keep the old one in force -- at least if you don't want me in 13 Banbury Road speaking to every supervisor up the big brother line of command to demand retention of what I have chosen. (rt #808882)

Some email early warnings

How do people access their Herald email?

66% users do it via webmail

20% do it with a secured mail client

14% still need educating to stop using insecure clients

Standard email addressing

The 5 year plan to kill off implausibly-long-name@oxford.ac.uk starts at the end of next month!

Just another incident...

Sat	0825	First known infection in Oxford

1330	Suspect mail reported to Oxcert

Webmail front page updated with warning

1400	Controller machine/s identified; redirected;

blocked at firewall; new virus sig identified

1500	Virus specimen reported to Sophos

1530	Start blocking of compromised machines at router

2100	Clam AV sig received and deployed on Oxmails

Sun	Virus continues to spread via other servers

Mon	0930	IDE update received from Sophos and deployed

~150 machines compromised; ~25,0000 emails detected

~220 machines compromised; ~75,0000 emails detected

~250 machines compromised; ~100,0000 emails detected

MyTob Morals

250 compromised machines takes 250 hours effort to clean up

Speed of detection and rapid deployment of virus filtering at the Oxmails is essential

70/80 servers do not route mail through the Oxmails...

Mobilizing access

OWL service now available

6 deployments so far

Integrating with SSO regime is in progress

We recognize need to support visitors

There are problems in supporting insecure or nonstandard devices

Funding issues

I have just signed up to the OWL wireless service and think it is an excellent idea provided you can maintain security and restrict access to staff and visitors... I am glad to see the OUCS adapting so well and so quickly to the technology (rt #807007)

P2P systems

Skype gives us two headaches

Bandwidth concerns

IPR concerns

The latter are very real

We received and served 44 "Cease and Desist" notice over the last 30 weeks

almost all due to individuals serving software, movies or music illegally

A major education effort is needed

Why develop a Common Computing Environment?

Three central units with similar desktop support needs

Admin (900); OULS (1200); OUCS (250)

University choices

Do nothing (i.e. let services degrade)

Outsource the whole shooting match

Invest in (separate) departmental support teams

Invest in a joint team

Committees...

ICT Planning Group

An interface between

ICT team for the collegiate university

Business services team

Directors OUCS and MIS

NOT just OUCS!

ICT Strategy Steering Group

To report late spring 2006

First met last week

Illustration from Carl Christian Schramm's 'Historischer Schauplatz,' the first general history of bridge building (1735)

The (slightly) bigger picture

ICT and Business Organisational Structure (June 2005)

ICT + Business

Services

Policy Board

ICT

Planning

Group

ICT Team

Business

Services

Team

ICT Strategy

Steering Group

Business

Progm Strategy

Board

Proposed senior group:

to ensure the University’s ICT and Business needs are met, policy made and priorities set

Development of ICT strategy for University business systems

Development of ICT strategy for the collegiate University

CCE overview -1

Objective

Define, deploy, and maintain a common computing environment across OUCS, OULS, and Central Admin

Specifically

One or more high quality desktop configurations with defined levels of service and support

Specifically not

Unit-specific services or infrastructure

The Common Desktop

(From John Price-Wilkin "The Google Desktop")

CCE Overview -2

Who?

An initial nucleus of about a dozen existing staff

Enterprise Manager (being recruited)

Further staff to be recruited next year

How?

ITTWG workgroups with representatives from all three units

Co-ordinating committee

ITTWG Project Planning Group

Stability

Maintain existing services

Scope

Identify which services need to be developed and integrated

Consolidation

Document current service provision as first step to rationalization

See http://www.ict.ox.ac.uk/team/cce-brief.xml

CCE scope

User community

All university staff employed in Admin, OUCS, OULS

Additionally, open access desktops in lecture rooms, help centres, reading rooms

“Commodity” Services

industrial strength

meeting user needs and expectations

We don't imagine we're alone in this

CCE Services

An initial list...

email, web, calendaring, office applications

document management, printing, media services

persistent high reliability data storage

automated software deployment, maintenance, development

secure local and remote network access

unified user support and help desk

standardized administrative support (inventory, health and safety, accessibility...)

ongoing monitoring and assessment of user requirements

etc etc

NB dependencies on other service providers

CCE: the next 6 months

Detailed service audit

How are these services currently provided, by whom, using what resources, and how successfully?

Team building

Re-evaluate existing development plans in wider context

Develop new support community

Learn from each other and ITSS more widely

Paul Jeffreys, 14 June 2005

Service Provision Now

Backbone Network

Voice Network

Infrastructure

Applications

Differentiated

Local services

Potentially Common

Services

MIS

OUCS

OSC + Research

DEPARTMENT

Non-IT Intensive

COLLEGE

Library

DEPARTMENT

IT Intensive

Specialist

Application

Shared Business Systems

Business

Systems

Servers

Servers

Servers

Servers

Servers

Servers

Local Network

Local Network

Local Network

Local Network

Local Network

Local Network

Local Network

Storage

Storage

Storage

Storage

Storage

Storage

Email &c

Central email

Central email

Central email

Email &c

Email &c

Specialist

Application

Specialist

Application

Specialist

Application

Paul Jeffreys, 14 June 2005

Service Provision with CCE

Backbone Network

Voice Network

Infrastructure

Applications

Differentiated

Local services

Potentially Common

Services

MIS

OUCS

OSC + Research

DEPARTMENT

Non-IT Intensive

COLLEGE

Library

DEPARTMENT

IT Intensive

Specialist

Application

Specialist

Application

Specialist

Application

Specialist

Application

Shared Business Systems

Business

Systems

Servers

Servers

Servers

Servers

Local Network

Local Network

Local Network

Local Network

Local Network

Storage

Storage

Storage

Storage

CCE

Central email

Central email

Email &c

Watch this space...

2005-06-22T16:52:09