Data security

Today I'm at an IDBG (Institutional Business Development Group) meeting for Public Sector CIOs. It started last night with a presentation on partnerships, and then the first session this morning was from David Smith, the Deputy Information Commissioner.

There have always been losses of data, it used to be personal data discovered in black bin liners on refuse tips, but now the scale has changed with the use of data sticks, laptops etc. Recent high profile data breaches have led to tightening up on data security in the public sector, but there is still a lot that can be done.

The Information Commissioners Office powers have increased recently, and they can take enforcement actions and audit government organisations. Under their voluntary breach notification they receive about 30 to 40 notifications a month with the public sector predominating and the NHS top of the list. This doesn't necessarily mean more breaches, just might be more willing to report under a voluntary system.

Some key points:

• Theft and loss of portable media is highly significant, but it was interesting to note that the ICO doesn't consider the loss of a properly encrypted form of media a data beach.

• Retention and lack of weeding of data continues to be a problem, and we should work to minimize the amount of data stored where possible on the grounds that if you don't have it you can't lose it.

• Many problems arise from a lack of proper risk assessment and a one size fits all approach with organisations treating all personal data in the same way.

• The DP Act says appropriate security must be in place, not absolute security. More support for a risk based approach.

• All systems/services should utilise Privacy by Design, ie design in privacy from beginning, don't try and fit it afterwards.

• It's all about building public confidence. Take Google Sreet View, it turns out that they hardly collected any personal information, but they took a reputation hit because of perceptions.

• If you have rules that are too strict, people will get round them. For example, some firms banned memory sticks, so users just emailed data to their personal email accounts.

• As mobility and access to networked information increases, try to avoid anything being downloaded to devices.

After the talk I had an interesting chat with him about the implications of outsourcing things like email, and the simple answer to my question about whether safe harbour was adequate for data held outside the EU in the US was "yes".

No longer the gatekeepers....

A couple of months ago I found myself presenting at a number of confereces - the theme seemed to be the same at all of them - what challenges are we facing as a sector, and how they might they shape the future of IT departments. Last Friday I repeated the talk, this time to the department.  All staff were invited, although it was particularly relevant for the IT staff. Always interesting to see who turns up (or rather, who doesn't - I wonder if it's the same people who claim not to know what's going on and we don't communicate enough...).

I'm not going to repeat everything I said - anyone interested can watch it here. But my conclusions were that we have to become more flexible and agile -  the days of the two year project are gone, we need to be thinking of development time in months or weeks. We need to simplify things and help the University become more efficient, and look at different service delivery models. Outsourcing, out-hosting, shared services - all need to be carefully considered so that we can focus our resources on supporting the University's key business objectives of teaching and research. This might need us to make some hard decisions, and in some cases reduce service levels or stop doing things completely. No longer the gatekeepers of information, we need to facilitate, help and educate our users to get the best out of systems and services we provide as well as those provided by others.

And we must continue to innovate - some might ask if we can afford to in these times of financial constraint, but I would argue that we can't afford not to. We will die as IT departments if we don't - we can't afford just to keep the lights on, we have to find new ways of doing things. It's all about getting the balance right, and deciding where resources should go.

Suppliers to the University

Busy week this week - lots of HR stuff with promotion cases due in today, our SRDS (Staff Review and Development Scheme) Moderating Panel meeting this morning, and a meeting earlier about a scheme for 360 review of senior management staff.

Also this week it was our suppliers exhibition. Organised by our Procurement Department, it brings together many organisations who provide services to the University to have a stall, show off their products and meet staff and answer questions. As a major supplier of services to the University we like to make sure we're represented, and this year had 4 stands. The Print Service had examples of the different things they can print (its not just paper!) - mugs, pens, bags, posters, etc, and information about how to print in the most environmentally friendly way.

The Learning and Teaching Technologies section were there to answer questions about AV equipment, and the Computing Services stand had a "Green IT" theme, giving away green pencils made from recycled CD cases, and a quiz to test how much staff knew about environmental issues, with a bottle of champagne as the prize.  Questions such as how much does it cost the University if you leave your PC switched on overnight (c£70 per year)), and how much have we saved so far by virtualising our servers (c£400,000 over 5 years). Continuing our green theme, Transport Services were promoting our hybrid car, the Toyota Prius for those wishing to use it for University travel.

It's a great opportunity to talk to staff, and to find out what their thoughts and concerns are and get some feedback on our services.

Wireless expansion

Our Voice and Data team have very busy these past few weeks, migrating our existing wireless system to a new platform. This has entailed some very early starts to change the access points over without causing users inconvenience.

There's been a massive effort from the team to install new points and increase the coverage of the network as well as change the existing service.  We consulted with  Faculties to find out where they needed the coverage, and at the moment we have 378 wireless access points in active service and this number is going up  every day.

The rollout has seen the introduction of a new model of access point which has introduced cutting edge 802.11n (5ghz) access to the University network. 802.11n more than doubles current wireless throughput and provides a much more resilient signal through obstacles and walls. Most modern computers such as Macbooks and higher spec PC's come fitted with the required adapters.

We have recently seen a huge increase in load on our wireless network, particularly in areas such the Information Commons.  Many more devices are connecting to it - students have smart phones, iPod Touches, laptops -  and will often have more than one wireless enabled device with them. As we make more of our services available to mobile users, a pervasive, powerful, resilient wireless network is essential, and I'm glad to say that we are working hard to achieve that goal.

Buff dogging.....

Yesterday I was in Edinburgh for a UCISA Executive meeting. As part of our mission to extend our working relationships with other similar bodies, we invited the chair of the British Universities Finance Directors Group (BUFDG) to join us. We had lots of things to discuss, and when we compared notes very similar agendas.

We know the government and funding councils are encouraging shared services, and one of the things we wanted to explore was whether the Finance Directors believe that the use of common finance systems by groups of Universities are achievable. As IT directors,  we think the technical issues could be overcome, but the resistance has in the past come from the end users of such systems. Other items we talked about included difficulties of costing services, and how we can use our finance systems to best effect to do this, which might mean changes to the structure of accounts.  We all agreed that this was a prerequisite to looking at changes to models of service delivery, whether that involved shared services or outsourcing, as it would be difficult to demonstrate cost benefits when you don't know what the service is costing in the first place.

Funding of IT and in particular capital vs recurrent funding was an area we touched on, with an agreement that we do need to understand each other's language better. A joint workshop between finance and IT was suggested - a sort of IT for dummies for the finance people, and vice versa for us!

A very useful discussion with the potential for some joint projects, and some joint funding bids to produce best practice case studies.

On a lighter note, it amused me that BUFDG is apparently pronounced Buffdog, and I can't get the image of a small dog out of my head now. And then today I found this which amused me even more.

Getting back to normal

So, things getting almost back to normal now after extended email outage.  All users have a service, and for a small number we're recovering some mail from our backups. But we have sent them a list of what mail should have been delivered to them which they seem to have found useful.  As in all such incidents, communication is vital. In this case we were without one of our major tools - email!  All internal customers were pointed to our service status web page which we updated frequently, and the stats of the hits on it showed that people were using it - from 10 hits on Monday, to 39,000 on Wednesday!

We had a link on our home page to an information page for external users, and also kept in touch with key departmental contacts by phone. In general our customers have been very understanding, and the number of complaints relatively small.

Next step is the incident review where we look at what went wrong technically and how we can minimise the risk of it happening again, and the process of managing the incident and what lessons we can learn.

Interesting times

The Chinese allegedly use the phrase "May you live in interesting times" as a curse.  Well, for many of us today, it has been an interesting time. After yesterday's disc failure, and subsequent filesystem rebuild failure, the infrastructure team had spent most of the night cloning the discs and repairing errors to start the rebuild again - we were all fairly confident that we would be able to have email up and running again mid morning. By just after 10am we were delivering mail again, and waiting until we had delivered the backlog before releasing it to users.  The unix team office was a bit like mission control as we all gathered to make sure it was stable, when we suffered another disc failure. You could have heard a pin drop. And a few expletives. And we ran out of biscuits. Luckily we could get more biscuits.

What followed was several hours of analysis, creative thinking, problem solving, phoning our email administrator who was on holiday in France who dropped everything to help remotely. Unfortunately the pressure is on very few people - most of us can offer support etc but we really rely on those with the technical ability to solve these problems.  I was feeling very out of the loop, as I had to leave at lunchtime to catch a train to Edinburgh for a UCISA meeting. My phone battery was running out, the power sockets in the carriage weren't working, and there was virtually no 3G signal! But, thank goodness for twitter and that 3 of the team doing the fixing were using it, so I just about kept in touch.

Eventually, by moving the much of the mail on to our new central filestore were were able to get a mail service up by mid afternoon for over 80% of users, with the rest being recovered and will be live tomorrow morning.

A huge thanks to everyone  - the infrastructure team who worked almost throughout the night (and are still working as I type this), to the incident management team, the communications team, the web team, the switchboard who handled the external calls, and the helpdesk staff who had to deal with many, many calls - over 800 yesterday afternoon alone.

When I arrived at my hotel, I was told I was staying in a converted asylum. Seemed rather appropriate somehow!

First the bad news....

First day back at work today, and a mixed day - good news and bad news! Lets get the bad news over first. eMail's been down all day.  I know there's about 550 unread emails in my inbox, and I can't get at them. Some might say that was a good thing, but not for the guys trying to fix it. A hardware failure last night - a disc array broke - and the whole file database needs rebuilding. 7 hours or so into the rebuild (at half five tonight), it failed. Lots of hard work from the unix and filestore team, including starting  to mount the most recent backups in case the worst happens and we can't get the database rebuilt. Expecting an update in the early hours of the morning, and an early meeting tomorrow to decide on actions.  Great team working on it though - thanks guys.

And now for the good news - over the past year we reviewed our VLE and agreed to implement Blackboard - Learn 9.1 as a major upgrade to MOLE (My online learning environment). Today we reached a major milestone of implementation project, with the go-live of MOLE2 to the first pilot department - the School of Dentistry.

Over the next few weeks, students and staff in the School will start using the new system, and over the next few months, the VLE Project team will be in touch with all Faculties and Departments  to discuss the best time to move to the upgraded service, and it’s hoped that around half the courses will move to the new service in September 2011, with the remainder moving in September 2012. All courses built within the current MOLE environment will be transferred to the new service as and when required, so no investment of time and energy in building courses now will be wasted.

It's been a team effort, as most successful projects are,  so thanks to the whole team - colleagues from LeTS, CiCS, Dentistry & the Library.

To iPad or not to iPad

For the last few weeks I've been testing an iPad. I'm particularly interested to know how useful it is in meetings, and whether it could mean I don't have to carry a laptop around.

On the plus side, I find the keyboard very easy to use to input text and surprisingly fast once you get used to it.  Pages creates documents very well which seem to export to Word without any problem. I can open word docs and pdfs, and although some complicated formatting might get lost occasionally from Word to Pages,  nothing  has caused me any problems so far.  Connectivity seems good, connecting to Eduroam or any other wireless network, and switching to 3G if no wireless available. There's some neat apps around for accessing your files from the cloud (we just need to get our filestore linked in to it). Email is great, and access through our portal to our web based systems fine, with VPN working well if you need it.

One of the things I'm really impressed with is the battery life.  Often I only need to charge it up every two or three days, and recently I used it non stop for 6 hours in a meeting, and it still had 40% battery left. That's certainly better than any laptop.

In meetings it's less obtrusive than a laptop, both in terms of noise (I sometimes wonder if people realise how noisy their keyboards are), and  it sits almost flat on the table and doesn't give the impression of a barrier between you and the rest of the attendees.

It's also always on - just like a phone, there's no booting up involved.

So - what are the downsides. Well, there's some that I hope will be fixed fairly quickly, such as the inability to open the keyboard and input text into some web forms - our own collaboration service uSpace for example, and I couldn't input my blog though the blogger web interface, had to download the app.
I'd also like to be able to annotate documents and pdfs - just like scribbling in the margin of a printed page.  There's probably an app to do that, but I haven't found it yet.

But the main issue is that it has been primarily marketed as a consumer device, owned by an individual with an individual iTunes account. Apple really haven't got their heads round it as an enterprise device, owned by an institution.  There is no real way of deploying or paying for apps on an institutional basis - when we raised this with Apple it was seriously suggested that we purchase a load of iTunes gift cards. Sharing devices also seems to be difficult, as they are synched to individual iTunes accounts.

As a consumer device it's excellent - especially the way it handles and displays images, movies, books and music  - but we could do with some of the corporate issues sorting out if they're going to take off institutionally.

Another blog

About three years ago when I set this blog up, I was fairly certain I wanted it to be only work related, and that's the way it has mainly stayed. There's been a few posts about stuff I'm interested in, and some brief references to holidays, mainly to explain blogging breaks. But I did get criticised once for including posts about morris dancing in a work blog, which made me smile.

So, in order to have somewhere to post personal stuff I set up another blog, which has remained untouched ever since - until now! Due to some sudden rush of blood to the head, I started posting to it last week while I was in Whitby at Folk Week, (that's why I've not been posting here). Not sure how it will develop, at the moment it's very much a what I did on my holidays sort of blog, so will have to see what happens to it.

So, the audience for this one is probably me, but it's not private and anyone can dip in, if you like looking at other people's holiday pics and videos! So, if you want to know what Molly dancing is, or see a rapper team ambushing a late night extra, or see ceilidh dancing to Tamla Motown, take a look here.

Hopefully will be back to work blogging next week, but until then, here's another picture of morris dancing :-)

Building a warehouse is not easy

Continuing staff development is something I'm a great believer in and try and promote in the department as much as possible. Often it's easy to forget that senior managers need development as well, so each year we try and ensure that the exec team get a couple of days away together to work on plans, to reflect on the past year and look at how things have gone and how we can improve.

We've just had our two days, and it was very worthwhile - hard work as we had a facilitator who was excellent but believed in pushing us, as he should. Before the session he had conducted mini 360deg reviews of the whole team by interviewing all of us, and our direct reports, and had also attended meetings to see us in action and how we interact with each other. The information when fed back to us (all anonymously and aggregated of course), provided some some useful insights, and some areas where can take positive action to improve.

Communication is always an issue, and interestingly the feedback a few years ago was that we didn't communicate enough, now we do it too much, or at least in too many different ways :-). Something we were already aware of, and we do need to make sure we have focused and clearly explained channels of communication. We also looked at forward planning, decision making, management consistency, and of course did one or two exercises to look at our own team and communication skills. I have to say I was not very good at building a warehouse out of KNex - but then neither was my partner - we had nearly as many pieces left over as went into the actual construction!

Luck and chance

One of the reasons I like working at a University is that I get the chance to attend all sorts of interesting events. Tonight I went to a great talk by Dr Brooke Magnanti on Chance and Luck, delivered appropriately enough on Friday 13th. And yes, you would be right in thinking her name is familiar in a different context, but not relevant to this lecture! Brooke currently works as a neuroscientist at Bristol University but was previously at the University of Sheffield where she did her PhD in the Department of Forensic Pathology. The event was organised by Science Brainwaves, a student led organization whose aim is to bring science to the public. It's an excellent organization and deserves lots of support.

The talk focused on why we believe what we do about luck and chance - why for example so many of us do the lottery and believe that we're going to be that lucky person who wins when the chances of winning are 14 million to 1. Despite these long odds, 65% of British adults consider the lottery to be a likely source of retirement income.

We tend to use chance and luck interchangeably despite their different meanings. This is demonstrated quite well by the games we play. As a child, we play games like snakes and ladders which are totally based on chance. As we get older and understand more about chance, especially how it can be calculated, we become less interested in it, and want to believe in some element of luck. We mistake chance for skill, and guesses for instinct. That's why the lottery, or Deal or No Deal, are so popular, but they are no different to our childhood games of snakes and ladders.

Brooke also talked about our desire to seek out patterns in random sequences, and how we use heuristics to make decisions based on partial evidence, experience and rumour. I was particularly interested in the Availability Heuristic, where we assess the probability of an event by the ease with which we can think of examples.

A very good talk, and well done to Science Brainwaves for organising it.

Back to work

Well, I'm back - wonderful couple of weeks in Turkey. Lots of sunshine (and one day of rain which was unexpected!), lazing by the pool, reading and generally chilling out. So for those of you who follow me or @stuartba on twitter, it wasn't all drinking cocktails! I did have one or two I admit.

So, back to work, and the first task was obviously sorting through the hundreds of emails - I did wonder if you could get RSI though hitting the delete key so many times. Who are these suppliers who think I'm going to buy their product on the basis of a cold email telling me how good it is? Or who think I'm going to make time in my diary to see them and talk about their product which I've never heard of and am not interested in.

Had a good meeting this week about possibly outsourcing some more applications into the cloud - we're nearing a decision, so watch this space for details hopefully in a few weeks. As we all look to facing a future where finance is going to be tight (to say the least), our priorities are going to have to be supporting the University's core business of teaching and research.

Rest of the week has been spent looking our finances - the year-end outturn and next year's budget - interviewing and some other personnel work. Spent a couple of hours yesterday filling in a "Strength Deployment Inventory" - a personality type questionnaire - for an awayday with the rest of the Executive Team next week. Apparently I'm red. Hopefully all will be explained next week...