Erin Lindsay, User Liaison, Research Admin. - Administrative Technology Center, Caltech has asked me to forward this....... > -----Original Message----- > From: Lindsay, Erin [SMTP:xxxxxx@ape.caltech.edu] > Sent: Thursday, February 10, 2000 10:05 AM > To: 'Ellen Beck' > Subject: FastLane concerns > > There has been much concern raised about the announcement from FastLane. > And > I can understand this. Anything new to me always brings up my own anxiety > level. > > However, for several reasons, I personally think that these changes are > excellent and a step in the right direction: > > 1) NSF is moving toward a Federal Commons' standard. This will ultimately > mean one login and password for each PI or administrator FOR ALL > participating AGENCIES. FastLane's current system of pin codes will not > allow this type of standardization. I personally think this is reason > enough > to be excited about the change. > > 2) This is bringing FastLane into more universally-accepted security > practices. The reality is, FastLane is a federal program. They have a > responsibility for the security of the data. In today's world were patents > can generate income of millions and millions of dollars, ideas must be > protected as best possible. > > 3) FastLane must be designed with those researchers in mind who AREN'T > comfortable with the type of security talked about on this listserv. > FastLane is REQUIRED to develop a security system that will work for those > PIs who feel security is important--and by default, these procedures must > work the same way for all PIs. > > To answer Nancy's excellent questions: > > 1) The user registration will still be done through the SRO Office--the > same > way it is done today. > > 2) I spoke with Carolyn Miller from FastLane this morning, and she > confirmed > that people who don't change their passwords in 180 days will NOT be > kicked > out of the system. In fact, if your PI doesn't use the system for three > years, she just has to enter her old password, and then will be prompted > to > change it to a new one. All computer systems truly should require this. > The > system we recently replaced at Caltech had it set at 90 days--but more > critical responsibilities (such as system administrator) were set to 30 > days. 180 days is much longer than the average or the recommended, but > works > well for a system like FastLane. By the way, if your PI forgets her > password, all she needs to do is what she does today when she forgets the > PIN number--call her SRO and ask them to help her out. The SRO will simply > reset the password, give it to the PI, and then she will be prompted to > change it again the first time she goes back into FastLane. > > 3) If the PI forgets to give SRO access, it will be no different than > today. > Quite honestly, it is poor procedure for a SRO to go into a proposal as > the > PI and do things such as this. Talk to the lawyers and to audit on your > campus if you disagree. For the SRO to do this, it is similar to the SRO > going into the PI's personal office, and grabbing the proposal off the > desk > to mail it in. Would you feel comfortable doing that? > > 4) FastLane could probably program in the ability to notify the SRO > anytime > a password changes. However, I must state that it is not good practice to > maintain this information in your office. I spoke to Caltech's Information > Security Officer this morning about all this, and she was blown away that > some institutions are doing this. > > 5) The details surrounding the electronic signature are not completely > formed as yet. Technology is still trying to catch up. But, I can tell you > that when it is implemented, if you have six individuals on your campus > who > are legally authorized to sign-off on grant applications, then they'll > each > be individually registered. > > Remember, FastLane answers to the Federal Government. They must be as > secure > as possible. We've all heard the news stories the last couple of days > about > hackers hitting E-Bay, Yahoo, ETrade and others. Hackers are especially > interested in the Federal sites. And in the same respect, we all need to > be > as secure as possible at our own institutions. It is our fiduciary duty. > > For more information on security issues, Steve Dowdy and I wrote an > article > for the NCURA newsletter two summers ago. You can get to it at: > http://www.ncura.edu/orginfo/newsletters/ncuranewsja.pdf (for the PDF > version--the article is on page two) or > http://www.ncura.edu/orginfo/newsletters/ja98.html (search for the word > "security.") > > I hope that some of this helps. > > Erin > ************* > Erin B. Lindsay > User Liaison, Research Admin. - Administrative Technology Center > Caltech > xxxxxx@caltech.edu ====================================================================== Instructions on how to use the RESADM-L Mailing List, including subscription information and a web-searchable archive, are available via our web site at http://www.hrinet.org (click on "Listserv Lists") ======================================================================
