Educause Security Discussion mailing list archives

Re: Student/Staff Email


From: Theresa Rowe <rowe () OAKLAND EDU>
Date: Thu, 18 Dec 2014 08:37:47 -0500

We have one account established, and track relationships to that account -
student, faculty, staff.

It seemed like it would be so nice to have different accounts for different
relationships, but on a small test, people didn't remember to always check
what account was already logged in on their browser, so there was no way to
guarantee that the email would come from the sender using the account that
we wanted used for that purpose.

So we are using one account.

A similar comment came up on the CIO list and I posted this:
We assign one account, and that account may have multiple relationships.
The same credentials are used.   We delete relationships, until there is
one relationship left, and the account delete follows after the last
remaining relationship changes.

This has only had one problem in over 15 years of use.  We had an employee
in the President's office who was both a student and staff member, and the
President's office did not want the employee account to continue after
termination, but the individual was actively enrolled in classes.  We
provided a new account to the individual using a process we have in place
for accounts that have been seriously compromised and need to be shut down.

On Wed, Dec 17, 2014 at 4:25 PM, Knights, John <knightsj () wit edu> wrote:

 Good Afternoon All-

 I’ve seen many of you provide feedback on how you handle graduated
student email accounts (May 2014 thread), but we have a potentially unique
twist to this.

 We have hired some of our graduates in the past, as I’m sure others
have. Our staff, faculty, and students will soon all be using the same
email system (Office365). I believe that we may be coming to a consensus
that we will move away from “eternal" emails for students and retirees,
instead we would implement eternal email forwarding to their own, personal
email account instead for development and future engagement opportunities.

 The one unique case is when a student that becomes a staff member,
leaves but is still a student (usually finishing their graduate degree).
Since all roles used the same identity and email account, we are looking
for suggestions and/or comments on what would be best for how to handle the
email account for this former staff, current student. We have considered
setting up a different account to generate a new student email, but there
are concerns with this.

 Thanks,
John


  John Knights
Information Security Officer
Wentworth Institute of Technology
Division of Technology Services



-- 
Theresa Rowe
Chief Information Officer
Oakland University

Current thread: