Authentication & Authorisation Improvements Project Brief

ENT031 - Authentication & Authorisation Improvements

Project Brief

Document Sign-off  

Working draft will be version 0.x and 1.x Draft sent for Approval/Review will be version 2.x Approved Project brief will be 3.0 Post-approval changes will be change controlled via Issue Log and Scope Change Page, and version 3.x

Background

A Review of the university’s Authentication and Authorisation Services was undertaken as part of the ENT019 project, with a final report published in November 2017. This report will be review by the ITC in Q1 2018 and decisions will be taken as to the practical recommendations made in the report. These will set out the scope of this project as the report makes a large number of them and not all can be undertaken in a small project.

Scope

Although the complete scope of the project will not be determined until February when the ITC has met, work on a number of Quick Wins can already be undertaken to implement changes across several enhancements that must take place.  

Quick Wins (Q1 2018)

• move the registration database to the galera database cluster and enable encryption at rest and in transit
• EdGEL the EASE login, second challenge, password change and registration pages
• change the login process to prompt separately for the username and password, so that we can implement at some point a small picture validation
• EdGEL EASE Friend

The project scope for now will be to do the work above, and will be estimated and resourced accordingly Once the ITC have made their decisions, then the full scope of the project will be set. These could include none, some or all of the following (2017/18 and 2018/19)  

• Review of replacement for COSIGN
• Tighter integration of AD and EASE
• Change in Password Policy
• Implement a Multi-Functional Authentication
• Development of Grouper and synchronisation of Grouper with AD
• Format of UUN
• Role-based Access Control and Privilige Management
• Policies on encryption and cryptography
• And other recommendations from the Authentication and Authorisation Review  

Changes to Scope will be logged on the Issue Log and also recorded on the Project Scope Change page.  

Out of Scope

Any significant work we need to explicitly state we are not doing (that some stakeholders may assume or expect that we will) shall be set out once ITC have met and decided.

Objectives and Deliverables and Success Criteria

This table can be used through Business and Technical Analysis, Design, Build, and Testing/UAT as a Traceability Matrix to ensure the project brief project objectives and deliverables are followed through.

Requirements

Requirements are aligned with objectives and deliverables, and also the opportunity to realise the benefits.

Benefits

The benefits that the deliverables will enable or act as a catalyst in making happen. These benefits may be immediate or may be realised after the project has closed.

Requirement 1. i/f and s/w upgrade

Requirement 2. GDPR compliance

Requirement 3. Users will have a more consistent experience Requirement 4.                Second factor challenge will bring authentication login in line with contemporary standards

Requirement 5. Users will have a more consistent experience

Governance

Project will have these governance roles by default. Delete/Add/Change as appropriate.

Portfolio Governance

Project Board (TBC if we require a project board)

Tolerances

Tolerances in line with general RAG guidelines, to be confirmed with Sposor.

Resources Skills and Cost

Budget 50 days of ITI effort We will have some support from edWeb team

Priority and Funding  

Normal Priority. No capital funding.

Project Team  

Quality of Project and Deliverables / Key Project Milestones  

The milestones are a key tool in ensuring that the project process itself is followed as set out by ITI, and that the product deliverables are to the required Quality.

Edit this template to list the key Milestones and who signs off on these milestones. Add milestones for Security, Accessibility,  UX, as required.

For medium and large projects, a project plan - MS Project, Gantt, or other - can be added to the Plan Log and revised as project progresses. The approach can be stated here.

You can also mention the approach the project is taking to set, measure and confirm the quality of the deliverables

Other Milestones will be added as Appropriate

Assumptions

We assume that there will be replacement for Cosign in the short term.

Constraints

Lack of Drupal skills in the ITI division mean that any development will need to be sourced from ISG or external, if we want to develop solution in Drupal.

Risks

No significant risks at outset of project.  

Issues

No significant issues at outset of project.  

Previous Lessons Learned

We wil review the ENT021 project for lessons.

Dependencies

Are we depending on certain events to take place? Yes – we need ITC to review and approve the recommendations in the review.

Are we dependent on suppliers, or product releases? TBC

Communication

For projects with an array of external stakeholders, a Communication Plan can be created and made available on the ITI Sharepoint space if preferred. The following stakeholders were identified during annual planning Director ITI, Tony Weir Accountable CISO Alistair Fenemore  Consult Claire Knowles Inform Matt Hodson Inform ADO Iain Fiddes, Stefan Kaempf also expecting to devote 5-10 days of effort USD and Helpline Inform LTW Inform (specifically, video lecture) L&C Inform AHSS Consult MVM Consult SCE C Consult and we also have Ed Web team USD and Helpline

Run / Grow / Transform

Transform

Alignment with Strategic Vision 

This project will deliver benefits, change and innovations in alignment with the IS Strategic Vision and the University's Strategic Vision for 2025. ** Check the Annual Plan on ITI Sharepoint to see how the project's deliverables and benefits have been aligned to Run/Grow/Transform and the Strategic Themes **

University's Strategic Vision for 2025 the main elements of the vision that this projects contributes have a commentary.

IS Change Programme - How will this project's Deliverables and Benefits promote the Themes 

Indicate if the project deliverables and benefits contribute to the themes with the IS Change Programme.

Service Excellence - Information and Security

The project focus is on the improvement of our security mechanisms and data storage.

Service Excellence - Process Improvement, efficiency, quality and best practice (Social Responsibility and Sustainability)

Not Applicable

Digital Transformation  

This will improve security via industry standard approaches to authentication, and we will be looking for support and guidance and QA from the Edweb team.

IS Change Programme - How will the execution of this project promote the Themes

Indicate if the project itself (during plan, execution, implementation) contributes to the themes with the IS Change Programme.

See the Guidance on the ITI001 Project Brief Template

Project Sponsor – Project Responsibilities

The sign-off milestones are associated with specific responsibilities of the Sponsor role.

This sets out the Sponsor responsibilities on this project - please review and amend as appropriate for this project and agree with Sponsor

Start of project – Explicitly Included in the Initiation Milestones Sign-Off

1. Negotiates and confirms funding for the project
2. Ensures the project is in line with organisational strategy and priorities
3. Chairs the project board, appoints its members and ensures they are effective
4. Advises the project manager of protocols, political risks, issues and sensitivities
5. Makes the project visible within the organisation 

End of Planning – Explicitly Included in the Planning Milestone Sign-Off

1. Works with the project manager to develop the Project Brief
2. Ensures a realistic project plan is produced
3. Sets tolerance levels for escalation to themselves and to the project board
4. Ensures that project team have representation and engagement from users and suppliers
5. Helps identify Stakeholders
6. Approves Communication Plan
7. Agrees on frequency of meetings with Project Manager
8. Agrees of frequency of meetings with Project Team
9. Agrees on milestones and who signs-off

Development / Execution – ongoing

1. Provides strategic direction and guidance to the project manager as directed by the Board
2. Approves changes to plans, priorities, deliverables, schedule
3. Encourages stakeholder involvement and maintains their ongoing commitment
4. Chief risk taker
5. Makes go/no-go decisions
6. Communicates change in organisational structure, priorities, business benefits or funding
7. Helps the project manager in conflict resolution
8. Helps resolve inter project boundary issues
9. Gains agreement among stakeholders when differences of opinion occur
10. Assists the project by exerting organisational authority and the ability to influence

Delivery – Explicitly Included in the Delivery Sign-Off

1. Ensures that Service is ready for change

Closure - Explicitly Included in the Closure Milestone Sign-Off

1. Helps with publicity for the change delivered
2. Ensure that benefits will be managed, measured and realised post-project
3. Evaluates the project’s success upon completion