Educause Security Discussion mailing list archives

Re: DNS "A Name" Records for Third Party Providers


From: Barbara Torney <bt42 () COLUMBIA EDU>
Date: Mon, 12 Jan 2009 19:53:36 -0500

What url is used doesn't affect whether or not people are redirected or
whether they have to go the other site to perform a given function.  We
wouldn't set up the function to be outsourced at all without a contract
that we (and our lawyers) believe covers all compliance issues.  We don't
deal with people who don't certify that they comply with
FERPA/GLB/PCI/HIIPA or whatever is required.

And we want to be the first to know if the service is down.  We deal with
the other company, and that has worked well.

That said, we don't it for just any department that tells us they have set
up something off-site.  We have to have been involved or review it
thoroughly, mostly for these compliance issues, before we will set it up.

And the trend is to more integration in portals, etc., with single sign on
being used where possible.  The control on the outside vendor should be at
the time of making the decision ot outsource and signing the contract
rather than at the time of assigning the url.

My $.02, bat

On Mon, 12 Jan 2009, Willis Marti wrote:

We recently had a request for an "A name" record by a third party
provider that is looking for a "seamless" user experience.  We're a
little hesitant to give an ohio.edu name to an external party, and
wanted to find out about other user's experience.  Any caveats, lessons
learned, or experiences that we should watch out for?  Thanks!

We will not do it unless there's a solid contract with the University
essentially making them play by all the rules we follow. I do not do it if
there's personal data collected. We've done it when the site is "read only".

--
Cheers,
Willis Marti
Director & CISO
Networking and Information Security
Texas A&M University



 -------------------------------------------------------------------------
 Barbara Torney                                 phone: 212-678-3487
 Director, Administrative Information Services  fax:   212-678-3243
 Teachers College, Columbia University                 212-678-4048
 525 West 120 Street, Box 43                    email: bt42 () columbia edu
 New York, NY 10027                             room:  241 Horace Mann

Current thread: