How To Write An Applicatin Sftware

Transcription

1 Applicatin Due Diligence Technlgy Prject: Applicatin Sftware: Vendr: Gals: Ensure that the scpe f wrk and departmental respnsibilities are understd during the sftware evaluatin prcess. Cnfirm the sftware is cmpatible with ur existing prcess and technical infrastructure. Enumerate incmpatibilities s all parties invlved can estimate the wrk required t reslve them. Overview: This dcument will be filled ut by the requestr with the assistance f St. Edward s IT staff. These questins are intended t be answered by all parties invlved in evaluating and deplying a new server applicatin. Many f them are answerable nly by the vendr r by the rganizatin requesting the applicatin. Other questins require crdinatin with Cmputer Services, Instructinal Technlgy, r Netwrk Services t fully answer. 1) Will this applicatin interface with existing SEU systems? Will infrmatin such as enrllment, user names, addresses, etc. be needed fr ppulatin f the new system? Describe any interface with existing systems such as CARS. Will this system be integrated with any academic systems such as Blackbard? 2) Applicatin Hsted Offsite r Onsite Is this applicatin hsted by the vendr ffsite? If vendr hsted, what is the supprt agreement? If vendr hsted, what is the backup plan? If vendr hsted, what is the disaster recvery plan? s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 1

2 3) Applicatin Platfrm Which perating system(s) des the applicatin sftware run n? Des this perating system require hardware frm a specific vendr? Will patching/changing the server break the sftware r vilate supprt/maintenance cntracts? Des the sftware package require an bslete r unsupprted versin f perating system r ther cmpnent (hardware, database, etc.)? Des the sftware package require a specific database and if s, what versin? 4) User System Requirements What perating systems are supprted fr users ( Mac OS X, Windws XP, Windws Vista)? If the sftware is web based, what web brwsers are supprted n each perating system? 5) Hardware Des this system require dedicated hardware? Describe hardware requirements. Is a test/develpment server required? fr applicatin? fr data? Des the applicatin wrk acceptably in a virtualized envirnment (e.g. under VMware, Xen, r KVM?) Will this system require ffsite hardware fr disaster recvery? 6) Availability When is this system required t be available? During nrmal business hurs? During class hurs? 24/7? s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 2

3 Will this system be accessible by the public? t LDAP authenticated users nly? t registered site users? restricted t a well-defined grup f users? 7) Authenticatin and Security Nte that an applicatin that expects t peridically imprt bulk data frm ur LDAP servers and authenticate users against this cpy f LDAP data is nt cnsidered t authenticate against ur LDAP servers. Our gal is t maintain a single cannical cpy f user credentials within LDAP. We d nt exprt LDAP data in bulk t applicatins. Is sensitive infrmatin (passwrds, SSNs, credit card numbers) transmitted via unencrypted prtcls (fr example, using FTP, HTTP r TELNET vs. SFTP/SCP, HTTPS r SSH)? Will this system authenticate against ur central LDAP server? If s, des it supprt secure LDAP? Has this sftware been independently audited fr security prblems? 8) Has this sftware been reviewed fr audit prvisins f security and revisin cntrl? 9) Strage What are the system's data strage needs (MB, GB, TB)? Initial applicatin? Data? Annual grwth Data? Can the system stre nn-applicatin data n a shared filesystem such as NFS r a SAN? Examples f nn-applicatin data are persistent user files and data and ephemeral sessin data. s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 3

4 10) Netwrking Often a lad balancer is used t redirect traffic frm a well-knwn prt t an arbitrary prt n ne r mre servers, thus allwing multiple applicatins t share multiple servers. This defends against hardware failures and allws us t add capacity by adding identical redundant servers t the system. By using ne public IP address n the lad balancer and using NAT (netwrk address translatin) t frward requests t servers n a private nn-rutable netwrk, we can increase security and decrease ur use f public IP addresses. The ability t use this system architecture is cmplicated by applicatins with unstated assumptins abut the addresses and prts they will use. What are the system's data transmissin (bandwidth) needs (GB/mnth)? t users t backup t vendr t infrastructure (LDAP, SAN, NFS) What netwrk prtcls are used t cmmunicate with users? Can this system run n a private nn-rutable (RFC 1918) netwrk? Can this system perate using arbitrary r nn-privileged prts fr the services it prvides. This is imprtant fr running multiple applicatins n a single server. 11) Installatin SEU perates many servers where peratr access is restricted t text (terminal) access. Additinally, we use autmated installatin systems such as Kickstart which have limited ability fr user interactin during installatin. Wh is installing the system? SEU IT r vendr? Can the applicatin be installed easily/using site-standard tls? Can the applicatin be installed withut user interventin? 12) Backup What are the backup/restre requirements? dcuments? databases? cnfiguratin files? audi, vide, r ther large files? backup retentin perid? database rllback capability? s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 4

5 13) Supprt What supprt is available frm the vendr? Hurs? Administratr nly r users als? Knwledge Base? User frums? Hw many hurs/wk (estimated) will a sysadmin spend t keep this system running? Des this system require after-hurs supprt? Des this system require multiple-admin supprt? What are the expected supprt respnse times fr reslving system utages (i.e. SLA/service level agreement?) 14) Capacity Hw many users is this system expected t supprt? Can the capacity f the system (number f users supprted) be increased by adding (nt replacing) hardware? Fr example, can the sftware be distributed amng a number f lad-balanced servers t increase capacity, r must the sftware be migrated t a single, mre mre pwerful server? 15) Vendr Access Is the vendr required t have access t the servers? Is the vendr required t have admin access t the servers? Applicatin? Operating system? Physical access? What infrmatin is transmitted t the vendr by this applicatin? 16) Regulatins/Privacy What are the regulatry implicatins f this system? FERPA HIPPA SOX (Sarbanes-Oxley) What is the cmpany's privacy plicy? s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 5

6 17) Accessibility Is this system Sectin 508 cmpatible? 18) Training What training is required fr users? Wh prvides this training? Cst? What training is required fr administratrs? Wh prvides this training? Cst? 19) Applicatin Lifecycle What is the currently expected lifecycle f the prduct? Average/specified time between releases Length f supprt fr ld releases until EOSL (end-f-system life) Expected cancellatin f prduct line Imminent sale f hst divisin r cmpany 20) Licensing f Sftware Is a separate license required fr a test/develpment system? Is a separate license required fr a standby/disaster-recvery system? Is a separate license required fr virtualized instances (i.e. thse run under VMware, Xen, r KVM)? What rights d we have t the sftware surce cde? mdificatin? redistributin? applicatins develped with the sftware? applicatins develped fr use with the sftware (e.g. plugins, mdules?) Is there a cde escrw agreement in place in case the vendr is unable t cntinue supprting the prduct? s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 6

7 Can we custmize the sftware r its cnfiguratin withut paying the vendr fr supprt/cnsulting services? csmetic? functinal? Is the sftware license tied t MAC, IP address, hstname, r ther server-specific identifier that requires cntacting the vendr befre relcating/renaming/repairing the hst? 21) End User License Agreement 22) Financial Stability f Vendr Hw lng has the cmpany been in business? Describe hw the cmpany s visin fits with higher educatin. List f institutins that have used the prduct and are willing t be cntacted. 23) Prjected Csts and Expected Returns: (fr a three t five year perid.) Csts: Cnsulting $ Acquisitin $ Licensing $ Hardware $ Add Staffing $ Implementatin $ Testing $ Training $ Maintenance $ Upgrades $ TOTAL FY f Purchase $ Prject Expenses fr the fllwing years? FY (1 Yr Out) $ FY (2 Yrs Out) $ FY (3 Yrs Out) $ Expected Return On Investment: TOTAL ROI FY f Purchase $ Prject Return On Investment fr the fllwing years? FY (1 Yr Out) $ FY (2 Yrs Out) $ FY (3 Yrs Out) $ s_fc_itec:plicies Guidelines fr I.T:Technlgy Purchasing Dcuments:Applicatin Due Diligence-revised.dc Page 7