GROWL Control update - The GROWL student self service tool has grown rapidly from a way for students to view their grades to include 23 different student administrative services such as enrollment, degree audit, transcript request, fee payment, accept and decline financial aid, view all campus and financial holds and more, all in a single location. Students can also authorize third parties parents, spouses, employers, etc, to view all or part of their information available on GROWL as well as make payments on the students’ accounts. 
 
The GROWL control program recently underwent structural changes to increase both control and flexibility.  First, instructional text and messages on individual pages has been moved to tables, with control turned completely over to the users.  Second, new features and applications can be added with table entries, eliminating the need for changes to the control program(s).  Third, individual features can be turned off and on in either production or test without impact to any other features or GROWL as a whole.  Fourth, GROWL has been changed to use CAS single sign-on authentication for inclusion on the UCR4me student portal.

Student Portal - The UCR Student Portal (UCR4me) is entering its official pilot phase, and uses Central Authentication Services (CAS) Single Sign on and is based on uPortal infrastructure.

General features include:

• Find People - A comprehensive search tool that allows students to search for UCR students, faculty and staff.

• Campus News - A tool that provides students with specific news feeds for and about UCR. The feeds include information about campus events, campus news, and library news.
  

• Local weather and traffic.
  

• Categorized Content - student centered information concerning Academics, Finances, Student Life, Health & Safety, and Careers.
  
  Once authenticated, personalized and customizable features include:
  

• My News - An RSS feed aggregation tool which allows students to "subscribe" to news feeds of all types, including news, sports, and technology.

• My Applications - A menu of authorized applications providing immediate Single Sign On access to GROWL, iLearn, and iEval.
  

• My Links A student maintained collection of links that is available in the portal, anytime, anywhere.
  

• My Messages A messaging service that pushes messages to the portal (from various campus groups) based on UCR's attribute server (phase one attributes include class, college, major, etc.).
  

• me @ UCR A tool that provides students a complete overview of their academic progress at UCR (e.g. currently enrollment, cumulative GPA, unofficial transcript, degree audit, etc.).
  

• My Channels A student selected suite of communications channels with announcements, blogs, and links from various campus entities (e.g. academic departments, the Library, Housing, Food Services, etc.).

iEval - The campus online evaluation system (iEval) continues to support evaluations for both faculty and teaching assistants.  The following statistics were captured during the Fall quarter of 2006 for faculty: Participation: 106 faculty members Number of courses: 171.  Response Rate 47.42% (4,624 respondents out of 9,751 expected).  The following statistics were captured for the teaching assistants during the Fall quarter of 2006: Participation: 713 T.A.’s; Number of courses: 1553; Response rate: 43.06%.
 
Webpay - Conference Registration – The Webpay system (AKA Conference Management Application) for University Extension (UNEX), was released in late Fall quarter of 2006.  The system allows departments and campus entities to have conference attendees register and pay online. The program captures basic profiles necessary to register individuals from the US and worldwide.  It has the ability to receive payments in the following methods:  credit cards, FAU, and Purchase Order payments. UNEX or the Conference Contact has detailed information about the conference sent to them in Excel reports or available via HTML.

Efforts related to applications security – C&C offered a class on SQL Injection and all of the developers have new techniques to guard against SQL Injection.  C&C is now taking the following steps to enhance application security:

Vendor-supplied software to improve application security.

A C&C team (in collaboration with UCOP) is are evaluating several commercial products that can be used to "scan" our custom-developed websites to identify vulnerabilities and take corrective action.  C&C expects that sometime in the near future C&C will formally add this "application scan" as one of the steps in our change control process.

Security review of all applications.

All C&C developers are checking existing code to find SQL Injection vulnerabilities and rank these risks.  C&C will then formulate a schedule for retrofitting our applications with these new security techniques.  The following guidelines are being followed to rank the risks...

• Does the program/database contain protected data such as SSN, Credit Card number, or Driver's License number in association with someone's first and last name?  This would be ranked HIGH risk.
  
• Does the system have sensitive / personal data that would cause potential embarrassment if released?  For example, the Travel system has a profile table listing an individual's allergies, etc. SuperDope contains salary information, and the SIS Data Warehouse contains student grades.  These would be ranked MEDIUM risk.
  
• Repositories of publicly-available, non-personal information (e.g. UCRFStotals) would be considered LOW risk.
  

Content Switch - UCR has purchased two F5 (company name) BIG-IP (product name) content switches to put in front of critical campus applications. These devices are currently being configured and tested, and so are not in production yet, but will be set up in a redundant fashion so that if one fails, the other will take over and applications will still be available.

The initial applications that are planned to be placed behind these load balancing systems are iLearn (Blackboard), UCR’s course management system that has two web front-ends; securepay, the campus credit card gateway system; email, including SMTP, POP, and IMAP; and CAS, UCR’s central authentication service. C&C expects to deploy these F5 systems very soon for Blackboard.

Renewal & Replacement Plan - The renewal and replacement process is driven by a database list of installed equipment.  When specific equipment reaches end of projected life, it becomes a candidate for replacement funding.  Analysis is then done to determine the validity of the projected life span.  As an example, certain higher level equipment may indeed be appropriate for continued service in less demanding circumstances as long as maintenance costs don’t dictate otherwise.  The first cut of this process has been completed and vendor quotes for the replacement equipment are being evaluated.  The major innovation this year is that C&C is developing a 10 year visualization of the time lines for all the categories of equipment on a building by building basis.  This will look five years into the past and project life spans five to six years into the future.  This will significantly enhance the ability to understand the campus needs equitably as well as to explain the process to funding grantors.

Beta testing 2SPEAK Voice Attendance Response - The testing of a new voice activated directory service, “UCR SPEAK,” is currently being completed.  It will be released to the C&C staff shortly in order to make a comprehensive assessment of the system before its introduction to the campus and public.   Initially, this voice activated directory system will be available to callers to the main campus number, before 8:00 a.m. and after 5:00 p.m. (M-F) and weekends and holidays. 

Thin Client VPN and retiring Proxy - Our current VPN concentrators have been upgraded with software and memory to support “client-less” web VPN sessions. Rather than needing to download and install VPN client software, individuals will simply be able to use their browsers to work from off-campus.  This will more effectively support off-campus researchers who need to access licensed material from library resource sites. This method is more secure and robust than the current proxy server.  The proxy will be retired after a short joint use period.