Continued Investigation of Risks and Concerns with

Transcription

1 August 7, 2015 Continued Investigation of Risks and Concerns with Cloud-based Solutions and Storage of Personal Data Team Members Name College/Affiliation Phone Linda Baer Comptroller s Office lbaer@purdue.edu Dave Carmichael College of Engineering IT carmicha@purdue.edu James Daniel Faculty danieljr@purdue.edu Greg Hedrick CISO Hedrick@purdue.edu John Turek Faculty turekj@purdue.edu ) Problem Statement The scope of this effort will be to provide a detailed recommendation for educational materials for faculty and staff on understanding the use and acquisition of cloud and storage services as well as the risks and concerns of using said services. This group will take the recommendations from the original group, outline what all is needed and find the groups who would put together or provide the educational materials, web site, hotline materials, as well as the matrix of currently provided solutions. We will identify how a clearing- house of cloud and storage services might be constructed and identify how it would be maintained. The goal will be to work with the groups that would put together the new materials or provide the services and put together recommendations that will be provided to the appropriate individual for approval thus having the highest likelihood of success. 2) Executive Summary Include description of the current state and recommended future action. Provide key objectives. Educational and informational materials related to Purdue are minimally available for the cloud. The previous OOC Cloud report will be used as background information for those continuing to work on this project. The IT Security and Policy (ITSP) workflow document for purchasing and the newly created Cloud Services Detail spreadsheet will be kept current following ITSP guidance. ITSP and IT Customer Relations (ITCR) will determine where all Cloud Documents will be housed. The expectation is that some of the information will be readily understandable by anyone and other information will be for IT staff to assist faculty, staff, and grad students. 3) Recommendation(s) & Action Items Provide a detailed recommendation for investigation and the action items necessary to carry out. Determine organizational units responsible for Page 1

2 implementation. ITSP and ITCR are responsible for content, maintenance, and hosting. This would likely be some KB articles and one pagers as well as a tab off of the SecurePurdue web site. All of this material can then be referenced by other IT organizations on campus without duplicating effort. The primary materials coming out of this report are: a) Cloud software being used at Purdue University (spreadsheet) (see appendix A). This document should be updated as new cloud services are purchased or when existing cloud services are reviewed. It is important to have an active spreadsheet so that others can refer to it when they are looking for a cloud service. The key information in this spreadsheet includes whether it is a service, storage, or both; Purdue Ownership; what kind of data is allowed; as well as several other important details. This will likely need to be owned by Purchasing and ITSP and maintained by both. IT Commodities has a role in this as new services are purchased b) Purchasing workflow document that will assist in the acquisition of a cloud service This document already exists and was created by ITSP. The use of this workflow needs to be emphasized with Purchasing, Project Managers, and other IT staff involved with system implementations. This document can also be shared from the SecurePurdue/Cloud web site for others to know what they need. c) A general purpose Information for New Faculty document (see appendix B) provided and used by the College of Veterinary Medicine. They have added Cloud/Network storage to reflect the importance of this topic. Somehow we need to generate content for this topic. d) An important item that is outside of the Cloud Education topic of this report is that ITaP is performing a proof of concept of a Cisco product called Cloud Data Consumption which is supposed to identify the cloud services which are in use at Purdue. This may enhance existing documentation or provide a data point from which to base additional decisions. It is recommended that an adhoc committee consisting of individuals from ITSP, Academic IT, ITCR, Procurement, and the Data Stewards be formed for the purpose of generating the content referenced above. 4) Investigation: a) Identify Key Stakeholders (Coverage of all associated groups is important). i) Faculty needing cloud services for research and instruction ii) Staff needing cloud services for research, instruction, and administration iii) ITSP security of where computing and data is taking place iv) IT Staff understanding the bigger picture of where computing and data is taking place in order to assist and inform Page 2

3 v) Data Stewards caring how the data for which they are responsible is being handled and housed vi) Procurement caring about licenses and costs of cloud services and storage 5) Resource Requirements a) Cloud services are already being used and purchased. Quite a bit of the topics above are being handled on the fly with little consistency. There will be some upfront resources needed to put together and house the content. In the long run, there may be some resources saved given access to the knowledge in accessible location(s) and a reduction in duplicate services. Page 3

4 APPENDIX A Cloud Software being used at Purdue Page 4

5 Cloud software reported being used at Purdue University Function Service/Storage Role- based access control Mobile app integration Cross platform Default allotmentmax file size Inline previewpermanent storage Offline sync Backups Encryption and Keys PU ownership/agreement Approved for Cost what kind of data? Aatrix Efile Cloud Filing federal govt forms Both Yes? Yes?? Yes Yes?? Unknown Variable Adobe Creative Cloud Image creation Both Yes Yes Yes Yes Yes Yes Purdue License Variable Amazon Cloud Drive Storage Both Yes Yes Yes Variable Variable Yes Yes? Yes None* Variable Apple icloud ipad and Apple computer backups used by Both individual usersyes Yes Yes 5 GB free? Yes Yes? Yes None* Variable ArcGIS Online Map creation Both Yes Yes Yes?? Yes Yes?? Purdue Contract Purdue contract Basecamp Project management Both Yes Yes Yes Unlimmited Unlimmited Yes Yes?? None* $20/mo Box Storage Storage Yes Yes Yes Unlimited 15 GB Yes Yes Yes Yes None* No charge Broadcloud Web Collaboration Learning management system Service Yes Yes Yes N/A N/A Yes N/A N/A N/A Unknown? Canvas Learning management system Both Yes Yes Yes Variable 2 GB Yes Yes No Yes In Review Free trial Carbonite Backup Storage Yes Yes Yes Unlimitd 4 GB? Yes Yes Yes None* Variable Course Signals Early warning system for grades, intergrated Service with Blackboard Yes Learn Yes Yes N/A N/A Yes N/A N/A Yes Unknown No charge at Purdue Crashlytics track mobile app errors Service Yes Yes Yes N/A N/A N/A N/A N/A N/A None* Free trial Crashplan Backup Both Yes Yes Yes Unlimited No limit? Yes? Yes None* Free to $10/mo Doodle Meeting planning Service Yes Yes Yes Unlimitd? Yes No No No None* No charge Dropbox Storage and file sharing Storage Yes Yes Yes 2 GB free 10 GB Yes Yes Yes Yes None* No charge Echo360 Active Learning Platform Lecture (BoilerCast audio Pilot capture Project) Both Yes Yes Yes? Yes Yes? No Not reviewed, in pilot testing Variable Endnote.com Reference manager Both? Yes Yes?? Yes Yes Yes? None* 30 day free trial Evernote Note taking Both Yes Yes Yes?? Yes Yes?? None* Basic free Facebook.com Social media Both Yes Yes Yes N/A N/A Yes Yes? Yes None* No charge Flickr.com Photo sharing Both Yes Yes Yes 1000 GB? Yes Yes?? None* No charge Git/Github Revision control Both Yes Yes Yes??? Yes?? None* Free trial Gmail and Calendar Web mail and calendering Both Yes Yes Yes 15 GB? Yes Yes Yes Yes None* No charge Google Analytics Analysis Service Yes Yes Yes??? Yes?? None* Variable Google Drive Storage Both Yes Yes Yes 15 GB? Yes Yes Yes Yes None* No charge Google Hangouts Social media Service Yes Yes Yes N/A? Yes Yes? Yes None* No charge Google WebMaster Tools Web tools Service Yes Yes Yes N/A N/A N/A N/A N/A N/A None* No charge GoToMeeting.com Web conferencing Both Yes Yes Yes N/A N/A Yes N/A N/A N/A None* Free up to 3 people Hobsons Apply Yourself Education solutions Both Yes Yes Yes N/A N/A N/A N/A N/A N/A Purdue Contract? Hobsons Connect Education solutions both Yes Yes Yes N/A N/A N/A N/A N/A N/A Purdue Contract? icontact marketing application(content creation, Service contact management, Yes reporting, integration w/ salesforce) Yes Yes N/A N/A Yes Yes N/A Yes None* Varialbe itunes U Private instance for BoilerCast publishing Both Yes Yes Yes?? Yes Yes? Yes Unknown Variable Kaltura - video Video publsihing Both Yes Yes Yes?? Yes Yes? Yes Purdue License Free trial LastPass Encrypted password management Both Yes Yes Yes N/A N/A N/A Yes Yes? None* Free and paid Mediafire.com Media storage both Yes Yes Yes 50 GB? Yes Yes?? None* Free and paid Mega Storage both Yes Yes Yes** 50 GB?? Yes?? None* Free and paid Mendeley.com Pdf manager Both Yes Yes Yes 2 GB? Yes Yes Yes Yes None* Free and paid Microsoft Azure Services Virtual machines, databases, etc Both Yes Yes Yes??? Yes? Yes Reviewed Free trial Microsoft Office 365 Onlin office applications Both Yes Yes Yes 15 GB? Yes Yes Yes Yes None* Free Microsoft OneDrive Onlin storage associated with Office 365 Storage Yes Yes Yes 15 GB? Yes Yes?? None* Free and paid Microsoft OneNote Note taking Both Yes Yes Yes?? YEs Yes Yes? Purdue license Free MyEmma.com Electronic marketing / mass serviceboth Yes Yes Yes?? Yes Yes?? Communication Office subscription? Variable Panda Cloud Antivirus Antivirus Service Yes Yes Yes N/A N/A N/A N/A N/A N/A None* Variable Pivotal Tracker Bug and task tracking Service Yes Yes Yes 2 GB?? Yes?? None* Free and paid Prezi Online presentation application Both Yes Yes Yes 4 GB? Yes Yes?? None* Free and paid Qualtrics Online survey Both Yes Yes Yes N/A N/A Yes N/A N/A? Purdue license No charge QuickBase Web- based open database platform use for Both CRM, Storage of Yes CRM data, not file storage Yes Yes N/A N/A N/A Yes Yes Yes Unknown Free and paid RealPlayer Cloud (Real Times) Photo and vidoe file management Service Yes Yes Yes 5 GB? Yes Yes?? None* Free and paid Reference Manager Reference manager Both Yes No No Unlimited N/A Yes Yes Yes? None* $ Ring Central Automated Call attendant and forwarding. Service Use for specific No grant requirements Yes Yes N/A N/A N/A N/A N/A N/A None* $24.99/mo Salesforce CRM data Both Yes Yes??????? Unknown Variable Skype Video/video conferencing Both Yes Yes Yes N/A N/A N/A N/A N/A N/A None* Variable Slideshare.net Online presentation application Both Yes Yes Yes?? Yes Yes?? None* Free and paid SugarSync File backup Both Yes Yes Yes 100 GB? Yes Yes Yes Yes None* $7.49/mo Survey Monkey Survey application Both Yes Yes Yes N/A N/A Yes Yes?? None* Free and paid TaskStream.com Electronic portfolio and assessment system Both using in the Purdue Yes Teacher Education Program Yes Yes N/A N/A Yes Yes?? *** Variable TeamViewer.com Desktop remote control (used in ITaP) Service Yes Yes Yes N/A N/A Yes N/A N/A N/A Licensed in ITaP??? $2,839 Todoist.com List and task manager both Yes Yes Yes?? Yes Yes Yes? None* Free and paid Tresorit Storage and sharing Both Yes Yes Yes 3 GB free?? Yes? Yes None* Free and paid Twilio Send/receive text messages for Hotseat Service Yes Yes Yes N/A N/A Yes??? None* Variable Twitter.com Social media Both Yes Yes Yes Unlimited N/A Yes Yes?? None* Free WebEx Web conferencing Both Yes Yes Yes N/A N/A Yes N/A N/A N/A Purdue license $19/mo Weebly.com Web hosting service Both Yes Yes Yes Unlimited pages10 MB Yes Yes? Yes None* Free and paid Wix.com - web hosting service Web hosting service Both Yes? Yes 50 MB? Yes Yes? Yes None* $4.83/mo WordPress.com - web hosting service Web hosting service Both Yes Yes Yes Unlimited N/A Yes Yes?? None* Free and paid YouTube.com Videos Both No Yes Yes?? Yes Yes?? None* Free Zotero.org Citation, research sources Both Yes Yes Yes?? Yes YEs No No None* Free *The service has its own "terms of service" **Not compatible with Safari ***Purdue agreement: TaskStream provides free faculty/instructor accounts; students purchase their own accounts

6 APPENDIX B Information for New Faculty Professional/Laboratory Web Page - Where located Current / Future Storage (limits?) Secure documents (Where to store?) Ferpa (Student information- grades etc.) Where to store? HIPAA (requirements) Deidentified. What to do if patient data included Other Cloud/Network storage Temporary for File transfer- File Locker (Purdue) :Purpose transfer of large files up to xxgb in size. File Dropper ( Storage- Purdue Boiler Back Pack (100GB) Career Account (500MB) Other Providers (Strength. Weakness, Recommedation?) Google Drive DropBox Box icloud OneDrive (Microsoft) Other Research related storage Fortress Purpose Long term storage Data Depot Other? Page 5