October 8 Meeting to discuss plans for rolling out PDCs on eTokens to the entire university

Agenda:

1. Can we expand hours that PDCs are issued on eTokens? In addition to Student Telecommunications staff, other units that might help are 4Help, ITA, VTOC, receptionists in RB14 & ISB. If not appropriate to issue certificates, could staff some of these other groups reset passwords?
2. Should we have "open enrollment" or phase in departments where there is a need, or use a combined approach where we remove the org code restriction in TAS, but invite departments to contact us for assistance with their projects?
3. What commercial, "out of the box" software will IT support?
4. What is our timeline? (See Proposed Timeline for Distributing eTokens to University Employees )
5. What should be announced at DCSS?
   

From the meeting...

1. Can we expand hours...? Discussion ensued regarding the need for lunchtime coverage and M-F 8-5 coverage. 2 people are required, one for RA admin and one for CA admin role to issue a PDC on eToken. ITA may not be able to accommodate, since two people are not always available. 4Help in University Mall and the NI&S reception area should be able to provide 2 people. 4help should be able to handle lunchtime. Mary will check with Anne Moore to see if staff in the Innovation Space can help, especially for supplying a second required issuing administrator for ITA. A person cannot be assigned to both RA and CA admin role at the same time. Role can be changed by a Role Administrator (Karen Herrington, Anne Shepperd, Carol Hurley), but RA and CA admins also need Oracle roles, so it is not feasible to change roles quickly (requires IRM intervention). Another meeting will be held with potential RA admins and CA admins.

2. Should we have "open enrollment?" The attendees decided to remove the TAS restriction that limits the PDC issuance to people in specific 6-digit org codes, but we will not advertise that any employee can come get a PDC on an eToken. We will ask departments to contact Mary if they have a need to use the PDCs on eTokens. Mary will coordinate the eToken issuing and the support that IT can provide based upon discussion with the department's representative. We will require a technical contact in the department. It needs to be made clear to the department that only certain Virginia Tech affiliates are eligible to received PDCs on eTokens. The affiliations eligible to receive a VT PDC according to the User CPS are VT-employee-state, VT-employee-wage, VT-student-enrolled, VT-student-wage. Currently, PDCs are only issued to VT-employee-wage, VT-student-wage.

3. What commercial, "out of the box" software will IT support? 4Help currently verifies that a person is using a supported operating system and web browser and assists with installing, configuring, uninstalling, and reinstalling the eToken middleware. The goal is to support digitally signing e-mail, PDF and Word documents, Excel spreadsheets, and perhaps Power Point. In order for a PDF to be signed it must be created with Adobe Professional 8.0 and have the proper attributes set when the PDF is created and saved. With input from 4Help, SETI Test and Deployment (TAD) will construct a matrix of products that "should work" and test them on the various supported platforms. TAD will create instructions that can be used for KB articles. eProvisioning will document its web services in a manner that can be published so other developers can call the web services from their applications.

4. What is our timeline? While a time line for testing and supporting the "out of the box" products needs to be developed, the fact that we will invite departments to contact us with their needs will allow us to learn what kind of support is most important.

5. What to announce at DCSS? Item #2 is probably the most meaningful for DCSS. Mary will create slides based on the discussion in this meeting, and will distribute them to the attendees for review.

Other discussion:

The Graduate School is interested in using digital signatures for plans of study. This could involve signatures by students and by people not affiliated with Virginia Tech. Because eligibility is restricted to certain affiliations (see #2 above) this may prevent the Graduate School from using digital signatures for a graduate student plan of study, because of retired faculty and non-VT faculty on the students committee. Also, although the Graduate School is saying they would like to use digital signatures what they probably need/want is workflow. IRM has no plans to offer or support its workflow system outside IT. Other administrative areas are interested in improving efficiency of processes, which may or may not involve digital signatures, and may not necessarily mean the process should be moved online. If it is deemed more efficient to move a paper process online, and if the paper process now contains a pen-and-ink signature because the person's signature carries with it accountability, then using the VT PDC on an eToken for a digital signature or 2-factor authentication would provide a higher level of assurance in the identity of the person using online process than would an ID/password combination.

The IT organization should look at potential efficiencies of using digital signatures in place of pen-and-ink on paper. This has the advantage of gradually introducing use of digital signatures in a controlled environment. It also provides an opportunity for gaining expertise (through use and experience) in IT.

The Hampton Roads Agricultural Research and Extension Center (AREC) has expressed interest in using digital signatures to expedite business processes.

Our main goal in opening up the distribution of eTokens university-wide is so that IT is not a "roadblock" to their use, as department's come up with ways to take advantage of digital signatures.

Possible missing components for wide-spread (enterprise?) use of digital signatures are workflow and a document repository.

The IRM workflow system will not be offered to anyone outside IT.