Guidance for app owners: got any? (i.e. "things to think about" before you develop/deploy)

[Erdos, Marlena]

Hi all,


I'm finding that app owners here at Harvard tend to need some guidance
around "access" and accounts -- at a high level, not an OWASP level.

I'm wondering if your institutions provide guidance that we could use as
source material for our own guidance.


Usually,  the app owner is not a developer.  The app owner  has a sense of
what they are trying to do but often hasn't actually thought through
matters such as "what should be protected and what should be public."

Further, I find that app owners often are surprised and confused if I say
"what if a user who has an account with you moves to a different
institution?"   (In this case, an account is created local to the app, but
the authentication is with a Harvard  SSO system (say).  There are yet
other  questions that "surprise and confuse" app owners.

The app owner doesn't necessarily have someone on their staff who is more
likely to have thought about this sort of thing than they are.  That's why
I want to provide written guidance on "things to think about."


I could do a write up on my own but I figure that this wheel has been
invented (and written about) repeatedly already :-).

That said, I couldn't find anything via searching :-(.

Got anything for me?  I'd be grateful for whatever you could point me to.

I'd be happy to share the resulting guidance that Harvard produces with
the community (assuming the sources of info are OK with that).

Thanks so much!
Marlena

Harvard University Information Technology
Innovation & Architecture
Senior Technologist
(Mobile) +1 (617) 872-9736
1033 Mass Ave, 4th Floor
Cambridge, MA 02138