Sept 24 NISO Virtual Conference: Library Data in the Cloud

Doing things differently:
Security and Data Ownership
in the Cloud
Andrew K. Pace
Executive Director, Networked Library Services
The world’s libraries. Connected.

Agenda
• Data Ownership in the Cloud
• What to look for in Terms & Conditions
• The Metadata irony
• The shifting role of “data” and “records” in library management
• Data Security in the Cloud
• Cloud concerns
• Security Imperatives
• Identity Management

Some thanks to my colleagues
Matthew Cull
Senior Attorney & Privacy Officer, OCLC
Bill Lisse
Corporate Security Officer, OCLC
Jim Michalko
VP, Research Library Partnership, OCLC
Roy Tennant
Sr. Program Officer, Office of Research, OCLC

Setting some
context

“Libraries have
a tremendous stake
in what happens among organizations that develop
and support their strategic technology products
and services.”
Marshall Breeding
Info Today Library Technology Forecast for 2014 and
Beyond

Welcome to the Cloud
Shared
Data
Consumer
Shared
Infrastructure
Business

The cloud environment
SaaS
PaaS
IaaS

Privacy
Shared data Security
models
Interoperability
LIBRARIANS: WE ARE THE GOLD STANDARD
Are we really?

MOST LIBRARIES ARE NOT AS GOOD AT THIS AS THEY
Security Risk
Assessments and Audits
Systems with free-text
PINs / Passwords
Multiple copies of
patron data
SIP2 unsecured
circulation
LIKE TO THINK

Data Ownership:
the macro and the micro

My happy career choice
SOFTWARE
vs
CONTENT AND ASSETS

Data Ownership in the Cloud
• Data Ownership: an OCLC perspective
• The Metadata irony
• The shifting role of “data” and “records”

Data Ownership at OCLC
http://oclc.org/worldcat/community/record-use/policy.en.html

Terms & Conditions Matter in the Cloud !!!
Excerpts from
WORLDSHARE MANAGEMENT SERVICES TERMS AND CONDITIONS
3.1 Ownership of Institution Data. Institution, and/or its suppliers
and affiliates, retains all right, title and interest (including, without
limitation, all proprietary rights) to Institution Data and Institution
Applications except for rights granted to OCLC and its affiliates
under this Agreement. Except as otherwise provided herein, upon
termination or cancellation of this Agreement for any reason, OCLC
shall return all Institution Data to Institution, or destroy, at
Institution’s option.
“YOUR DATA ARE YOUR DATA”
- A. Pace

Terms & Conditions Matter in the Cloud !!!
3.2 License Rights to OCLC. Institution hereby grants OCLC a worldwide, non-exclusive,
royalty-free, non-sublicensable license to host, reproduce, transmit,
cache, store, display, publish, distribute, perform, edit, adapt, modify, create
derivative works from, and otherwise use Institution Data
(a) as reasonably necessary to provide the Service for Institution
(b) to analyze and use Institution Data to evaluate the Service;
(c) to disclose and distribute Institution Data in aggregated form from which
all Institution specific and personally identifiable information has
been removed for the purposes of analyzing Service performance,
preparing statistics and metrics, creating marketing materials and other
services;
(d) making Institution Data available to Institution and to those members of the
public to whom Institution has granted access or to the general public
(for content posted on public areas of the service); and
(e) conforming to connecting networks' technical requirements.
Bolding added

Other things to look for in Ts&Cs
Data Disclosure & Security
• Data Security
• Data Transfer
• Nondisclosure of Patron Data.
Term & Termination
• Data Disposal
• Data Return

The Metadata Irony
• Our users have moved to the cloud
• Huge portions of our collections have moved to the cloud
• Our data supply (jobbers, OCLC, etc) has been in the cloud
since before the Internet
• Libraries want to manage metadata locally

Thinking about the future of data ownership in the cloud
"Trying to hold on to unused
publications that libraries no longer
have room to house, having
theological arguments about the
contents of catalogue records, and
indulging in the numerous other
irrelevant, inappropriate or trivial
activities of which librarians are so
fond, with their unerring eye for the
inessential."
"Librarianship as it is practiced: a failure of intellect, imagination and initiative,”
Maurice B. Line
1983!!!

“…about the contents of catalogue records…”
• Linked Data
• What changes when we’re talking about a web of
linked data instead of a repository of records?
• Person, place, concept, organization, work, object
• Moving the management (and ownership?) closer to
the thing itself

Implications:
Entities and library workflows
Cataloging
Improve data quality
• Cascading updates
A new approach to cataloging
• Point and click cataloging
• Managing entities instead
of managing records
Consistent with RDA

Entities and library workflows
Discovery
Knowledge cards
• Fixes problem of
“representative record”
• It’s what users expect in
discovery

Shirky Principle
“Institutions will try to preserve the
problem to which they are the
solution.”
Does this apply to the current model
of record-by-record cataloging?

OCLC, Security
(& privacy)

“Share”

Libraries are all about sharing
Shared:
Infrastructures
Platforms
Software
Data
What about
security?
From Information Week, Dark Reading
www.darkreading.com

Cloud concerns?
The principal concern for cloud adoption is security and
privacy; questions include
• Where does my data reside?
• Who can access my data?
• Will a cloud deployment compromise my ability to meet
regulatory mandates?
• Are the cloud providers using any security standards or best
practices (SAML, ISO or otherwise)?
• What happens if a breach occurs? How are incidents handled?
• What are the factors that tell me I can trust this provider?
• Are application secure?

OCLC has chosen to address all of these areas in it’s ISO/IEC
27001 certified Information Security Management System

The cloud security imperative
Gartner Research Group: Seven cloud-computing security risks
• Long-term viability [Governance]
• Investigative support [Breach Response]
• Regulatory compliance
• Data location
• Data segregation
• Recovery
• Privileged user access [IDM]

Governance
Need to set “tone at the top” through…
• an executive-level Global Security & Privacy Governance
Committee, which provides oversight
• formal objectives that guide our information security management system
• policies and procedures that guide staff activities
• adoption and certification of ISO/IEC 27001, the international standard for
information security management. This includes:
• Dedicated full-time professional security staff
• Comprehensive risk assessment
• Reduced security and compliance risks through internal and external audits
• Reduced probability and impact of security incidents
• Documented plans for computer security incident response, breach notification,
and investigative support by qualified security staff.

Regulatory Compliance
ISO/IEC 27001 has reciprocity with international privacy laws, including:
• European Union Data Directive
• U.S. National Institute of Standards and Technology SP 800-53
• Family Education al Rights and Privacy Act (FERPA)
• Canadian Personal Information Protection and Electronic Documents Act
(PIPEDA)
• Australian Privacy Act
• German Privacy Law and Federal Information Security Act (BSI Standard
100).
The ISO 27001 standard is directly responsive to the library
community’s concerns for security & privacy in cloud computing

Data Location: Legal and Political Realities
CAN 1
US2 EMEA 1
US1
APAC 1

Identity management,
security & privacy

Identity management vision
IDM Goal:
Simplify the user experience by creating a single
username, password and profile that works across all hosted
services.
Requirement:
Offer a complete range of library-related security protocol
support, privacy management, and access control services.

Identity management principles
• A single set of credentials reduces username and passwords
required to access services.
• A single sign-on reduces the number of times a user has to log
in to use services.
• A single technology infrastructure moves from legacy systems
into an integrated environment.
• Consistent user migration processes provision all institutions
for all services in the same way.
• Careful consumption of user information so it is protected and
used only when necessary (legal and ethical compliance).

OCLC’s approach to Identity Management Services
Standards and interoperability
• SAML V2 Based Messaging
• Shibboleth Compliant Identity Providers (IdP) and Service Providers
• CAS interoperability
• LDAP interoperability
• Consume Shibboleth IdP
Security
• Encryption of databases and messages
• Separation of Duties (technology and personnel)
Scale
• 20,000 Identity Providers being provisioned

OCLC Identity Management Services - Controls
Role Based Access Control (RBAC)
A popular approach used by many operating systems
and programs
• Access granted to a resource or a process based on roles held
by an authenticated user
• Roles are groups of permissions
• Applications check permissions for access
• Access control is flexible and very granular

Source: http://iangotts.wordpress.com/2012/09/26/
standing-in-the-fire-hose-of-data-drowning-or-refreshing-tucon2012-bigdata-tomsiebel-scottmcnealy/

pacea@oclc.org
Explore. Share. Magnify.
Thank You!
Andrew K. Pace
@andrewkpace

Sept 24 NISO Virtual Conference: Library Data in the Cloud

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Sept 24 NISO Virtual Conference: Library Data in the Cloud

Similar to Sept 24 NISO Virtual Conference: Library Data in the Cloud (20)

More from National Information Standards Organization (NISO)

More from National Information Standards Organization (NISO) (20)

Recently uploaded

Recently uploaded (20)

Sept 24 NISO Virtual Conference: Library Data in the Cloud

Editor's Notes