<div dir="ltr"><div><div><div><div>Forwarded with Marshall's permission<br><br></div>Would you be able to help me fill this out? <br><br></div>Galen has already made a good start which I have pasted at <br><a href="https://etherpad.mozilla.org/YiC0J8efmw">https://etherpad.mozilla.org/YiC0J8efmw</a><br><br></div>Also the Evergreen community are working on their response at<br><a href="https://docs.google.com/document/d/1RgTnQOITvm3B_yzBOTfAuPZgDZig7xQ3N7Euib8rONc/edit">https://docs.google.com/document/d/1RgTnQOITvm3B_yzBOTfAuPZgDZig7xQ3N7Euib8rONc/edit</a><br><br></div>Thanks<br><br>Chris<br><div><div><br><div><div><div><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Marshall Breeding</b> <span dir="ltr"><<a href="mailto:marshall.breeding@librarytechnology.org">marshall.breeding@librarytechnology.org</a>></span><br>Date: 11 November 2014 02:55<br>Subject: Questionaire regarding Patron Privacy and Security<br>To: Chris Cormack <<a href="mailto:chris@bigballofwax.co.nz">chris@bigballofwax.co.nz</a>><br><br><br>
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">As you know, libraries are increasingly concerned with protecting the privacy of their patrons and in strong security.<span style="color:rgb(31,73,125)"> For an upcoming panel for CNI I have been charged with gathering data regarding how library
management systems handle patron privacy and security. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">It would be great if I could have responses by November 21, 2014.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Could you provide responses for the Koha? You are the one that comes to mind among those in the Koha community, but if there is someone else that you think should respond, please let me know. I really appreciate
your help.<u></u><u></u></span></p>
<p class="MsoNormal">
<u></u><u></u></p>
<p class="MsoNormal">I am interested in gathering some information regarding the current capabilities or options that systems offer today, looking forward to further progress in this arena toward more secure treatment of patron-related transactions. Given
increasing concerns, I would expect that each company is working on providing a more secure environment.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This data initially will be used for a briefing at the upcoming CNI Fall 2014 Membership Meeting, December 8-9, 2014:<u></u><u></u></p>
<p class="MsoNormal"><a href="http://www.cni.org/events/membership-meetings/upcoming-meeting/fall-2014/project-briefings-breakout-sessions/" target="_blank">http://www.cni.org/events/membership-meetings/upcoming-meeting/fall-2014/project-briefings-breakout-sessions/</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I also anticipate that this information would be helpful for other discussions, presentations, or reports.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In addition to information provided by the developers of systems, I may also work with systems administrators of the various products for their perspectives on these security-related capabilities and options.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I would greatly appreciate it if you could have your technical or product managers provide responses to these specific questions. It would also be helpful to have any additional comments or perspective whether these seem to be the best
areas of concern regarding patron privacy, if there are alternative strategies that you are pursuing. I would also be interested to hear whether this topic has been raised also by your customers or users through enhancement requests or other product roadmap
priorities.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does your online catalog or discovery interface:<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce encryption through SSL for all transactions involving patron activity<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL for all transactions involving patron activity<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce encryption for specific pages or transactions involving patron details or login credentials<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL for specific pages or transactions involving patron details or login details<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does your client or interface for delivering functionality to library personnel:<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce encryption through SSL or other encryption mechanisms for all transactions<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL or other encryption mechanisms for all transactions<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce encryption for specific pages or transactions involving patron details<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce Encryption for specific pages involving authentication of library personnel accounts<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL for specific pages involving patron details<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL or other encryption mechanisms for specific pages involving authentication of library personnel<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Enforce encryption for transactions involving institutional financial data (acquisitions, patron fines, etc)<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Offer the library an option to enable SSL or other encryption mechanisms for financial transactions<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">How does your platform or system deal with the security of the storage of specific types of data:<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Does your system store patron passwords or PINs as unencrypted text<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Does your system store patron passwords or PINs as salted hash or similar mechanisms<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Does your system encrypt patron details as they are recorded and stored?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Are logs or other system files that include patron search or reading behaviors encrypted?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Describe any other security measures in place that protect patron privacy as it is transmitted over local networks or the Internet from interception by any third party. One specific scenario that has been a topic of concern involves the
presentation of e-book discovery and lending transactions via library catalogs or discovery interfaces.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Describe any integration with third party organizations that could potential expose patron details, search, or reading patterns and measures that you have provided to strengthen privacy and security.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Do the APIs allow or require encryption in requests or responses that include patron-related data?
<u></u><u></u></p>
<p class="MsoNormal">What limitations to security impact your system imposed by the APIs or protocols managed by external or third-part products?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Would your company be interested in a standardized specification for the treatment of patron or financial data, similar to the way that PCI provides a compliance framework for e-commerce transactions?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I really appreciate your help with this project. Please confirm that you will be able to respond and let me know if you have any questions or concerns.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">-marshall<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Marshall Breeding<u></u><u></u></p>
<p class="MsoNormal"><a href="http://www.librarytechnology.org/" target="_blank">http://www.librarytechnology.org</a><u></u><u></u></p>
<p class="MsoNormal"><a href="mailto:marshall.breeding@librarytechnology.org" target="_blank">marshall.breeding@librarytechnology.org</a><u></u><u></u></p>
<p class="MsoNormal"><a href="http://twitter.com/mbreeding" target="_blank">http://twitter.com/mbreeding</a><u></u><u></u></p>
<p class="MsoNormal"><a href="http://www.linkedin.com/in/breeding" target="_blank">http://www.linkedin.com/in/breeding</a><u></u><u></u></p>
<p class="MsoNormal"><a href="http://scholar.google.com/citations?user=NnvfJ5cAAAAJ" target="_blank">http://scholar.google.com/citations?user=NnvfJ5cAAAAJ</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div><br></div></div></div></div></div></div>