1
00:00:27,892 --> 00:00:29,916
Welcome back to Bytes of Experience.
2
00:00:29,916 --> 00:00:32,781
I'm Bo Wanschneider, joined as always by Dana Sanderson.
3
00:00:32,781 --> 00:00:41,326
Today we're talking with Jill Kowalchuk from the University of Calgary about leading
research IT, where national infrastructure campus operations and security intersect.
4
00:00:42,228 --> 00:00:49,210
Jill's career spans Westgrid, Compute Canada, CanSOC, and leadership roles within national
organizations.
5
00:00:49,210 --> 00:00:52,511
She's also served as the chair of SIRA's board of directors.
6
00:00:52,511 --> 00:01:04,294
Now, two years into a role that sits between IT and research at UCalgary, she's uniquely
placed to talk to us about why this role and what works and what doesn't and how to build
7
00:01:04,294 --> 00:01:05,975
trust across the campus.
8
00:01:06,135 --> 00:01:08,816
Jill, so great to have you join us today.
9
00:01:08,856 --> 00:01:10,068
Tell us how that
10
00:01:10,068 --> 00:01:12,986
path shaped your view of the research ecosystem.
11
00:01:14,208 --> 00:01:15,038
yeah, absolutely.
12
00:01:15,038 --> 00:01:19,041
So I've always been drawn to the same types of of roles and challenges.
13
00:01:19,041 --> 00:01:22,933
That is the intersection of technology and people.
14
00:01:23,273 --> 00:01:28,396
I I'm a big believer in technology in terms of what it can enable and what it can support.
15
00:01:28,396 --> 00:01:39,542
~ I love helping people, solving challenging problems, and finding different ways to
deliver value to Canadians in general, whether that be ~ in research or in the
16
00:01:39,542 --> 00:01:42,674
infrastructure that supports research or research.
17
00:01:42,770 --> 00:01:45,949
Or in the case of CIRA how it can help all Canadians.
18
00:01:47,678 --> 00:01:56,856
I think the biggest thing I've learned across all of these different roles is that there
is significant value in working ~ together, working together across different things to
19
00:01:56,856 --> 00:01:58,578
solve challenging problems.
20
00:01:58,578 --> 00:02:08,467
That being said, one thing that I will say I knew before, but really gets driven ~ home
and my new role at the University of Calgary is there's no one silver bullet to solve all
21
00:02:08,467 --> 00:02:09,057
problems.
22
00:02:09,057 --> 00:02:14,492
And most things need to get looked at with a unique lens to the current challenger
problem.
23
00:02:17,748 --> 00:02:21,491
That's you know, I think it's great that you started right away with technology and
people.
24
00:02:21,491 --> 00:02:24,564
And this is something Dana and I have run across in a lot of our sessions.
25
00:02:24,564 --> 00:02:27,196
It you know, it a lot of times it boils down to people.
26
00:02:27,196 --> 00:02:30,619
And I think we've got a couple coming up this season that might try to counter that.
27
00:02:30,619 --> 00:02:32,800
And I think it's gonna be an interesting discussion.
28
00:02:32,801 --> 00:02:40,206
So let's focus a little bit more about the role you have at the University of Calgary
that's sort of embedded between IT and research.
29
00:02:41,168 --> 00:02:46,676
so why embed that role in IT rather than in the VPR's office?
30
00:02:46,676 --> 00:02:50,149
Or maybe research services, or maybe that's the same thing at your institution.
31
00:02:51,842 --> 00:03:01,561
yeah, so ultimately when I answer this question about my role at the University of
Calgary, and I would say I've answered ~ different questions about organizations or
32
00:03:01,561 --> 00:03:11,651
organizational structure and why one organizational structure will work or won't work, I
will give the same answer to every question, which is anything can ultimately work and it
33
00:03:11,651 --> 00:03:17,256
really comes down ~ to the people ~ and the people that are that are in place there.
34
00:03:17,508 --> 00:03:29,243
~ what I've learned at the University of Calgary in this space in and in looking both here
and as well as what I see across other institutions is that silos are broken down as much
35
00:03:29,243 --> 00:03:30,313
as possible.
36
00:03:30,313 --> 00:03:35,756
There has to be strong integration and alignment between ~ groups.
37
00:03:35,756 --> 00:03:45,659
So in this case, from IT and research services and the VPR's office, we work really hard
to build relationships between those three different groups to most effectively support
38
00:03:45,659 --> 00:03:47,240
our research community.
39
00:03:47,954 --> 00:03:49,755
My role is embedded inside IT.
40
00:03:49,755 --> 00:04:02,150
If you were to ask me to pick one, I would say I would lean more so on being embedded
inside the IT space at the institution, because you can leverage ~ expertise in ~
41
00:04:02,150 --> 00:04:05,392
enterprise IT services and support where it makes sense.
42
00:04:05,392 --> 00:04:15,346
~ If you're looking to scale out your operations, both in terms of how what you can
support as well as you can how you can operate on a bigger scale.
43
00:04:15,454 --> 00:04:19,005
Being embedded inside IT can provide this opportunity.
44
00:04:19,686 --> 00:04:23,788
It also allows you to influence technology decisions to support the research enterprise.
45
00:04:23,788 --> 00:04:35,323
~ I do this quite a bit and have a great team that I work with inside the IT environment
that will listen to my input and feedback about how we can change or an adjust different
46
00:04:35,323 --> 00:04:36,994
initiative to support that.
47
00:04:36,994 --> 00:04:42,016
I think a big good example that currently exists is we're undergoing a major network
refresh.
48
00:04:42,228 --> 00:04:50,893
~ and we're sitting in there influencing how we are deploying that ~ refresh across campus
to see what we are seeing coming down the pipe related to research.
49
00:04:50,893 --> 00:05:01,008
Big data projects, ~ different instruments that are coming on campus, how can we most
effectively move that data across our campus as well as out to the research and education
50
00:05:01,008 --> 00:05:04,900
network and where appropriate, the commercial ~ internet as well.
51
00:05:05,201 --> 00:05:11,998
The last thing I'll say, as both of you know, I spent ~ quite a bit of time working within
Cucio and working directly.
52
00:05:11,998 --> 00:05:22,533
with CIOs and I will say there is a heavy driver on leadership and leadership development,
building teams, building culture, and using that to deliver services in an efficient and
53
00:05:22,533 --> 00:05:23,673
effective way.
54
00:05:23,673 --> 00:05:30,106
And I think there's significant benefit to this on the research side of the house,
particularly as we look to scale up.
55
00:05:31,136 --> 00:05:35,756
Yeah, I really like that notion that you get to sit at this table to help inform that
discussion.
56
00:05:35,756 --> 00:05:46,143
Cause it's always been interesting over the years talking to the researchers and what
their expectations are of the campus network in terms of what it can't do and and then you
57
00:05:46,143 --> 00:05:47,392
know what it really can do.
58
00:05:47,392 --> 00:05:56,947
And and and you know, in most schools it's it's quite a robust network, but there's some
new things that are happening where even though we've got very, very low latencies, we
59
00:05:56,947 --> 00:05:59,048
still gotta move massive amounts of data.
60
00:05:59,048 --> 00:06:02,491
very, very quickly from one side of campus to the other side of campus.
61
00:06:02,491 --> 00:06:06,235
And they're depending on how you've configured that network, it can it can have
bottlenecks.
62
00:06:06,235 --> 00:06:09,638
~ so I I I think it's great that you guys are having that discussion.
63
00:06:09,638 --> 00:06:12,430
And I would I would expect no less from a university like Calgary.
64
00:06:13,508 --> 00:06:22,331
Yeah, that's an interesting perspective having that being one of my last projects leaving
UPEI was you know we had all this wonderful new technology, all this Cisco networking, and
65
00:06:22,331 --> 00:06:29,272
I said, Yeah, but we you do know we have to fix the wires that are in these buildings that
are decades and decades old.
66
00:06:29,272 --> 00:06:31,863
I'm sorry, ~ data still moves on wires.
67
00:06:31,863 --> 00:06:35,874
~ even when it's wireless, it still still ultimately moves on wires.
68
00:06:36,675 --> 00:06:39,815
so you're two years plus in the role.
69
00:06:40,035 --> 00:06:42,546
Has your sense of what the job
70
00:06:43,296 --> 00:06:43,867
should deliver.
71
00:06:43,867 --> 00:06:44,799
Has it really changed?
72
00:06:44,799 --> 00:06:49,217
And what what's surprised you about faculty or the VPR's expectations?
73
00:06:49,217 --> 00:06:52,532
And do other schools have roles like this?
74
00:06:53,956 --> 00:06:57,638
yeah, so I wouldn't say anything has changed per se.
75
00:06:57,638 --> 00:07:07,133
~ I I will say that the biggest surprise for me was that working at the university is the
hardest job that I have ever had.
76
00:07:07,133 --> 00:07:13,447
~ and I have had some challenging jobs, as you all know, but certainly ~ this is the
hardest one.
77
00:07:13,447 --> 00:07:15,728
I was actually at a data summit last week.
78
00:07:15,816 --> 00:07:24,138
where I was sitting at a table and I made this comment and there were people at the table
who used to be at universities and now we're at organizations that supported institutions.
79
00:07:24,138 --> 00:07:26,799
And I would say they 100% agreed with me.
80
00:07:26,799 --> 00:07:33,921
~ I think the biggest thing is the amount of work and things we need to support is
insurmountable.
81
00:07:33,921 --> 00:07:39,022
~ with the resourcing ~ that that we ultimately have.
82
00:07:39,983 --> 00:07:41,963
it is challenging to say no.
83
00:07:41,963 --> 00:07:44,264
~ and we could talk about whether or not
84
00:07:44,264 --> 00:07:48,627
the you know IT or the CIO has the ability to say no.
85
00:07:48,627 --> 00:07:51,659
But even inside that context, we don't want to or or we can't.
86
00:07:51,659 --> 00:07:54,932
These are all things we need to do and we need to enable.
87
00:07:54,932 --> 00:08:01,644
So finding ways to do that inside an institution is is really, really challenging.
88
00:08:01,644 --> 00:08:05,179
I I wasn't surprised about faculty or VPR expectations.
89
00:08:05,179 --> 00:08:11,814
~ I would actually say in thinking about the answer to this question, ~ most, most, not
all,
90
00:08:12,276 --> 00:08:22,362
Some expectations are completely unrealistic, but in many cases, what researchers ~ needed
or required and their expectations for it was not unreasonable.
91
00:08:22,362 --> 00:08:28,236
It's just we didn't have the resources to complete them in what would be a reasonable
amount of time.
92
00:08:28,236 --> 00:08:37,872
Some of the wait times for some of the requests at our institutions are really long just
because we don't yet have we don't have the the people to ultimately support it.
93
00:08:38,410 --> 00:08:48,107
What I think will become interesting in this is how AI changes that and how much we can
automate and leverage some of these things to make that those things easier to free up
94
00:08:48,107 --> 00:08:49,888
time for the harder things.
95
00:08:50,009 --> 00:08:52,330
that's a big driver at our institution right now.
96
00:08:52,330 --> 00:08:55,332
~ and so it'll be interesting to see how it comes.
97
00:08:55,393 --> 00:09:00,556
The challenge there is that oftentimes to save time and money, you need money.
98
00:09:00,556 --> 00:09:05,980
~ and so that's a constant balance that that we're working towards, at least at our
institution.
99
00:09:08,266 --> 00:09:17,162
So, you know, if you've if you've been listening to this podcast, you would have heard me
talk about how important the relationship is between the CIO, the VPR, and the chief
100
00:09:17,162 --> 00:09:26,668
librarian and and so does being inside IT give you more credibility with faculty,
researchers, and the VPR, or does it create friction?
101
00:09:26,708 --> 00:09:31,351
And and how do you balance operational authority with research authority?
102
00:09:31,571 --> 00:09:33,062
Autonomy, sorry.
103
00:09:34,410 --> 00:09:37,002
So the answer's both.
104
00:09:37,002 --> 00:09:46,700
~ IT, like many central services inside an institution, are are hampered with that
challenging job and a reputation.
105
00:09:46,700 --> 00:09:52,051
~ we need to deliver so much, we have so few r resources, there's a lot of bureaucracy.
106
00:09:52,852 --> 00:09:59,366
and so working with IT can be slow, as I mentioned before, and it can be expensive
expensive.
107
00:09:59,904 --> 00:10:10,447
~ so to offset this, you need a CIO and an IT team that really understands the value of
research, what it what it can do, what it takes, and what it can enable.
108
00:10:10,447 --> 00:10:15,449
And you have to have the ability to prioritize some key research initiatives to help build
that credibility.
109
00:10:15,449 --> 00:10:22,171
~ and so you can't do absolutely everything for absolutely everyone all of the time.
110
00:10:22,171 --> 00:10:26,748
So you need to pick some key things that will help you build that credibility and support.
111
00:10:26,748 --> 00:10:30,150
And then move forward in leveraging and and building off of that.
112
00:10:30,150 --> 00:10:35,468
~ so the balance side of the question you asked takes time.
113
00:10:35,468 --> 00:10:40,017
~ ultimately we're all about finding different pathways to make things happen.
114
00:10:40,017 --> 00:10:48,864
We work with ~ research teams to help them understand the risks and challenges, and we
also let them do the things that they need to do, which aren't too risky.
115
00:10:48,864 --> 00:10:55,462
If if you're looking to do something that isn't using sensitive data, we try to find the
quickest and painless path.
116
00:10:55,462 --> 00:10:56,873
Your solution and what you need.
117
00:10:56,873 --> 00:11:03,427
~ On the flip side, if you have very sensitive health or personal information, there are
hoops to jump through.
118
00:11:03,427 --> 00:11:09,861
And we look to describe what those hoops are, explain why you need to do this ~ and build
that forward.
119
00:11:09,861 --> 00:11:15,204
And in the general cases, I will say our research community has been quite receptive.
120
00:11:15,404 --> 00:11:22,386
Strong relationships with other key institutional partners, such as supply chain, legal
privacy, and the research services office are key.
121
00:11:22,386 --> 00:11:31,213
If we're all moving in that same direction and supporting each other and passing groups in
between that, it makes things a lot easier for all of us.
122
00:11:33,608 --> 00:11:39,323
You know, that's an interesting perspective you talked here about the sensitivity of the
data that the researchers are working on.
123
00:11:39,323 --> 00:11:45,713
And and you know, one of the ~ you know, I I and Bo knows me and you know me and a lot of
people know me.
124
00:11:45,713 --> 00:11:48,130
I like I like things that are simple and e easy to understand.
125
00:11:48,130 --> 00:11:52,384
And, you know, I I I was always a big fan of analogy, so just just stay between the
ditches.
126
00:11:52,384 --> 00:12:00,105
The only thing with sensitive data is you just need to understand the road gets much, much
narrower and the ditches become that much deeper
127
00:12:00,105 --> 00:12:02,807
So ~ I and I and I think that's
128
00:12:03,528 --> 00:12:04,749
I'm full of them,
129
00:12:04,970 --> 00:12:17,021
that said though, ~ often the dealing with the ditches, we'll call it, is how do you make
the case though for recurring funding for the research platform for the stakeholders?
130
00:12:17,021 --> 00:12:20,103
Because I mean you you mentioned it, right?
131
00:12:20,103 --> 00:12:21,144
You talked about
132
00:12:21,144 --> 00:12:23,259
You need money for people, you need money for tools.
133
00:12:23,259 --> 00:12:25,174
And so, you know, what's the case?
134
00:12:25,174 --> 00:12:26,577
How do you how do you actually make that case
135
00:12:26,577 --> 00:12:28,210
for for the funding?
136
00:12:29,430 --> 00:12:37,886
Yeah, so I will ~ quote something that our VPR said in a in a meeting recently, which is
research is expensive.
137
00:12:37,947 --> 00:12:39,528
there is no way about that.
138
00:12:39,528 --> 00:12:49,185
If you track the course of the University of Calgary on our research portfolio, we have
been on a steady increase in research dollars ~ and our ability to attract that.
139
00:12:49,185 --> 00:12:54,719
And I will say that has been done with a significant investment and dedication into that.
140
00:12:55,510 --> 00:13:04,184
That being said, ~ if you can provide services and things centrally, you can make things
more effective and efficient.
141
00:13:04,184 --> 00:13:08,826
So we've made a case locally that allows us to better leverage national resources.
142
00:13:08,826 --> 00:13:17,009
~ we have a centrally funded team out of base operations, and then we can use that to fund
~ other things.
143
00:13:17,009 --> 00:13:24,396
~ we support researchers in getting other funding by providing match and getting some
dollars back to support augmenting and building out.
144
00:13:24,396 --> 00:13:27,778
~ the initiatives ~ in that context.
145
00:13:27,778 --> 00:13:31,999
And so that's a way in terms of this leverage that we have been able to demonstrate that.
146
00:13:31,999 --> 00:13:38,842
We also show it in that ultimately by making this investment, it's all it's it's less
expensive for the institution overall.
147
00:13:38,842 --> 00:13:42,864
Having a data center that researchers can plug things into it's more secure.
148
00:13:42,864 --> 00:13:48,227
It's cheaper than people going out and and building their own data centers.
149
00:13:48,227 --> 00:13:52,118
If you can find models for efficient chargeback to researchers,
150
00:13:52,140 --> 00:14:02,530
where ~ base infrastructure is funded by the institution, but we're augmenting that on top
of it with different components from the research side, you can really get ~ better value
151
00:14:02,530 --> 00:14:04,892
and leverage ~ across that.
152
00:14:05,453 --> 00:14:15,363
I haven't actually done the math, but I think ~ at a minimum we probably bring in 50% more
to the institution and research dollars than we are ~ funded on top of what we're funded
153
00:14:15,363 --> 00:14:16,554
directly for.
154
00:14:21,010 --> 00:14:24,164
you knew we'd get to security at some point when we're talking to you.
155
00:14:24,164 --> 00:14:27,878
So so you've worked with CanSoc and you've chaired Syrah.
156
00:14:27,878 --> 00:14:33,684
how how should campuses think about research security differently from enterprise
security?
157
00:14:34,936 --> 00:14:39,408
So it's all about risk, which is really how you should look at your enterprise security as
well.
158
00:14:39,408 --> 00:14:45,301
So the answer really isn't all that much different, different in that context.
159
00:14:45,422 --> 00:15:00,830
But taking a look at what is the research being done, what is the sensitivity of the data,
~ and then ultimately making a decision about how can we support that ~ in a way that
160
00:15:00,830 --> 00:15:04,148
maximizes the value on the research side and
161
00:15:04,148 --> 00:15:08,981
minimizes or accepts, makes an acceptable ~ risk decision.
162
00:15:08,981 --> 00:15:11,552
So research is risky.
163
00:15:11,552 --> 00:15:12,873
There's no question about it.
164
00:15:12,873 --> 00:15:28,702
~ You know, and so finding a model that allows the institution to ~ understand all of
those things and then make decisions inside that context is absolutely key.
165
00:15:28,702 --> 00:15:33,334
The director of cybersecurity that we have here at our institution is exceptional at this.
166
00:15:33,386 --> 00:15:42,521
They will support working with the researcher in the research community, understanding the
risk associated with something, ~ and then finding a pathway to yes.
167
00:15:42,521 --> 00:15:44,742
Sometimes the pathway to yes is expensive.
168
00:15:44,742 --> 00:15:56,509
It involves penetration testing and standing up a secured environment inside AWS or
standing up our own local infrastructure that has security controls around it.
169
00:15:56,509 --> 00:16:00,401
We're working towards NIST 800-171 certification.
170
00:16:00,401 --> 00:16:03,040
We've done our self-assessment and have a plan of action.
171
00:16:03,040 --> 00:16:12,350
And so all of those things big and bring in that environment and services to allow us to
say more yeses with the right hoops understood that you have to jump through.
172
00:16:14,348 --> 00:16:17,049
You know, I just wanna follow on that.
173
00:16:17,049 --> 00:16:30,770
Do you think with research or a role like yours tucked inside the enterprise or in tucked
in inside IT, that those risk decisions about what's the right if that's such a word, the
174
00:16:30,770 --> 00:16:40,547
right infrastructure or the right ~ conditions that need to be in place in terms of
enterprise IT to allow those decisions to be made faster with
175
00:16:42,015 --> 00:16:54,973
How do get that across to researchers to make them understand it's somewhat appealing to
actually have your research being managed at an enterprise level in terms of your ability
176
00:16:54,973 --> 00:16:56,655
to for speed to execution?
177
00:16:57,905 --> 00:17:00,277
Yeah, so I would say two things.
178
00:17:00,277 --> 00:17:06,512
~ you know, you mentioned speed to execution and and that one I'm not so sure on.
179
00:17:06,512 --> 00:17:14,067
The reality is is if there is no requirement for security, then it's faster if you just do
it yourself.
180
00:17:14,188 --> 00:17:24,275
But what we are seeing in all of what's coming down is there is a requirement from tri
councils, ~ you know.
181
00:17:24,445 --> 00:17:27,576
We do we receive data from the National Institutes from Health.
182
00:17:27,576 --> 00:17:40,059
If you want to do anything with GDPR data, any type of all of what's coming through this
is an understanding that you need to have the right security controls in place based upon
183
00:17:40,059 --> 00:17:41,740
your risk and what you're doing.
184
00:17:41,740 --> 00:17:43,220
And so this is coming.
185
00:17:43,220 --> 00:17:54,423
~ most of the the grants and things that are required sign off, it says somebody who
doesn't say this, but it's translation in non legal words.
186
00:17:54,779 --> 00:17:59,202
Somebody who understands IT and cybersecurity needs to sign off on this.
187
00:17:59,463 --> 00:18:03,355
And so that person is in your IT team.
188
00:18:03,355 --> 00:18:06,688
It is your CISO or your CISO equivalent or your CIO.
189
00:18:06,688 --> 00:18:10,730
And they have to be the one that signs off on that.
190
00:18:10,730 --> 00:18:14,953
And what that team needs is build towards standards.
191
00:18:14,953 --> 00:18:23,847
That's my advice is build towards standards, provide the sub the resourcing required to
build infrastructure.
192
00:18:23,847 --> 00:18:29,051
that supports those standards so that your CISO can attest to what they need to attest to.
193
00:18:29,051 --> 00:18:30,512
There will be gaps.
194
00:18:30,512 --> 00:18:31,752
You will not have everything.
195
00:18:31,752 --> 00:18:33,103
It is a research environment.
196
00:18:33,103 --> 00:18:38,317
You will get to a question on NIST 800-171 be like, yeah, we can't answer that.
197
00:18:38,317 --> 00:18:39,558
No, we can't do that.
198
00:18:39,558 --> 00:18:42,060
~ or inside that context.
199
00:18:42,060 --> 00:18:48,144
And it's okay for your research enterprise to accept that risk and understand that risk in
that context.
200
00:18:48,144 --> 00:18:53,167
They're the right people to make those decisions ~ inside that context.
201
00:18:55,005 --> 00:18:57,397
That's a bit of a segue, maybe to this next question then.
202
00:18:57,397 --> 00:19:08,243
So is there a practical low friction path for campuses to actually participate in national
security coordination without overburdening the researchers?
203
00:19:09,607 --> 00:19:22,426
Yeah, I would say you build infrastructure that ~ you build digital research
infrastructure that meets a standard, whether it be NIST 800 171 or Canadian equivalent or
204
00:19:22,426 --> 00:19:23,127
otherwise.
205
00:19:23,127 --> 00:19:26,019
And so you have a pathway in that.
206
00:19:26,019 --> 00:19:31,903
Right now, because of the attestation required, our institution is doing it for our
researchers.
207
00:19:31,903 --> 00:19:37,267
We can accept a level of risk for our researchers that a another institution
208
00:19:37,373 --> 00:19:41,825
wouldn't be comfortable ex accepting ~ inside that context.
209
00:19:41,825 --> 00:19:51,369
I will say ultimately the end goal is you have independent organizations that have
infrastructure that accept this risk on behalf of multiple institutions and are built for
210
00:19:51,369 --> 00:19:52,490
that exact purpose.
211
00:19:52,490 --> 00:19:54,831
And moving towards that makes a ton of sense.
212
00:19:54,831 --> 00:19:57,172
And those have to be independent organizations.
213
00:19:57,172 --> 00:20:05,135
They can't be commercial entities because why would they put all of their billions of
dollars of assets on the line related to accepting some of these risks?
214
00:20:05,193 --> 00:20:15,531
For that same reason, it can't be an institution on behalf of other institutions to put
their assets on the line to accept risk for a a d a researcher at a different university.
215
00:20:15,531 --> 00:20:17,413
It it just doesn't make sense.
216
00:20:18,675 --> 00:20:21,937
I I want to follow up on this risk discussion just for a second.
217
00:20:22,458 --> 00:20:34,886
If you think about that, all the roles or people or parts of the organization within the
university that have that have risk in their context, right?
218
00:20:34,886 --> 00:20:39,680
So how how do you balance what is the right amount of risk for the enterprise, right?
219
00:20:39,680 --> 00:20:43,813
So you get the whole financial thing, you got your whole reputational thing, you get your
research, you got IT.
220
00:20:43,813 --> 00:20:47,845
There's so many elements, and we talked about, you know, this is really a risk decision.
221
00:20:48,935 --> 00:21:04,320
what what what's you Calgary been doing to help balance all those stakeholders and all
those voices in that risk matrix, I'll call it, to find a way that is ~ supports the the
222
00:21:04,320 --> 00:21:10,535
needs of the the researcher but also manages the needs of appropriate level of enterprise
risk.
223
00:21:12,699 --> 00:21:19,812
So ~ this it you've asked a very institutional question and so I can answer it in the
institutional way.
224
00:21:19,812 --> 00:21:27,965
I will say we're quite fortunate at the University of Calgary and that we're very ~
centrally run, right?
225
00:21:27,965 --> 00:21:32,507
It's a very we've gone through the the sort of centralization.
226
00:21:32,507 --> 00:21:38,110
I know previous podcast members use different words for that.
227
00:21:38,110 --> 00:21:39,830
I'm gonna use centralization.
228
00:21:39,830 --> 00:21:41,611
~ and so our teams
229
00:21:42,567 --> 00:21:44,029
work quite closely.
230
00:21:44,029 --> 00:21:51,515
And ~ legal owns a piece of it, privacy owns a piece of it, IT owns a piece of it.
231
00:21:52,597 --> 00:22:05,227
and I will say those groups are at the table on a regular and ongoing basis to both
recognize who owns what and how we work carefully together.
232
00:22:05,227 --> 00:22:06,110
And so
233
00:22:07,411 --> 00:22:17,535
legal and privacy and cybersecurity at our institution have a very, very close working
relationship where we work through some of these things and pieces.
234
00:22:17,556 --> 00:22:25,129
We also then have very clearly defined leadership that owns risk in our ~ organization.
235
00:22:25,129 --> 00:22:34,403
So let's say a researcher in coming school of medicine wants to do something where we've
managed and checked off every single box in an agreement that we need to, except there's
236
00:22:34,403 --> 00:22:35,251
one gap.
237
00:22:35,251 --> 00:22:38,732
that still provide some level of risk associated with it.
238
00:22:38,732 --> 00:22:44,714
First, our director of cybersecurity would make a, okay, this is a level of risk.
239
00:22:44,714 --> 00:22:48,915
I think this is, I'll explain this risk in a way.
240
00:22:48,915 --> 00:22:55,357
~ and that gets explained to the CIO as well as the senior leader at that table.
241
00:22:55,357 --> 00:23:01,079
So like Dean or ~ A VPR, depending upon what it is.
242
00:23:01,363 --> 00:23:10,619
We walk through what that risk is in that context and they ultimately sign off on that
risk with communicating with the researcher at what that is in that context.
243
00:23:12,573 --> 00:23:19,650
I will just say what the way the you laughed at my answer on I'm gonna answer this from
the institutional context.
244
00:23:19,650 --> 00:23:21,562
That's the institutional context.
245
00:23:21,562 --> 00:23:28,889
If you can have third parties that you are downloading the risk to, there is significant
value in that.
246
00:23:28,889 --> 00:23:36,787
And so our director of cybersecurity often is like, is there an organization that has SOC2
type two or some other
247
00:23:36,817 --> 00:23:43,535
information security attestation and we can say you're gonna do it and be comfortable with
what they've got in place, that's great.
248
00:23:43,535 --> 00:23:44,256
Let's do that.
249
00:23:44,256 --> 00:23:53,978
~ and so there's sort of two ways in which we can do that, but having those third parties
that are willing to accept risk on behalf of our institution will provide significant
250
00:23:53,978 --> 00:23:56,411
value to the community and the ecosystem.
251
00:23:58,183 --> 00:24:00,735
That is that that's a great answer.
252
00:24:00,735 --> 00:24:08,530
And I think our some of our listeners ~ are really gonna appreciate hearing that, because
I think it gives some great perspective and something for them to to to consider.
253
00:24:08,530 --> 00:24:09,971
let's switch gears a little bit here.
254
00:24:09,971 --> 00:24:13,103
and I want to talk about sovereign compute and and cloud trust.
255
00:24:13,103 --> 00:24:17,036
So this is where Dana and I might become a little unplugged and unfiltered.
256
00:24:17,036 --> 00:24:24,742
~ is sovereign compute a real operational requirement for research or mostly a
policy-political type of conversation?
257
00:24:24,742 --> 00:24:25,462
And
258
00:24:25,742 --> 00:24:28,775
Where does it matter and where is it just noise?
259
00:24:29,160 --> 00:24:30,786
So maybe that's a loaded question.
260
00:24:31,546 --> 00:24:33,486
Yeah, I think it's a loaded question.
261
00:24:33,486 --> 00:24:38,070
~ and it also depends on when you are asking me this question.
262
00:24:38,070 --> 00:24:52,237
If you asked me this question four years ago or a year ago, or six months ago, or a month
ago, I would probably answer it in multiple different ways, ~ depending upon the time ~
263
00:24:52,237 --> 00:24:53,478
and the case.
264
00:24:53,618 --> 00:24:59,481
I will say sovereignty is absolutely a requirement for Canadians in that context.
265
00:24:59,481 --> 00:25:00,816
~
266
00:25:00,816 --> 00:25:08,590
Building up ~ AI, sovereign AI capacity to the greatest extent we can, right?
267
00:25:08,590 --> 00:25:17,865
Like if you dive into the entire supply chain of AI and all of the different components,
no, we're not going to start manufacturing our own chips tomorrow and some of those other
268
00:25:17,865 --> 00:25:18,836
aspects.
269
00:25:18,836 --> 00:25:29,381
But the more we can build and support a Canadian solution, the better off we will be able
to collaborate on a global scale.
270
00:25:29,702 --> 00:25:30,862
And so
271
00:25:31,002 --> 00:25:36,504
I think this is absolutely a fundamental requirement for us in our environment.
272
00:25:36,504 --> 00:25:44,546
And I've given the a the answer on AI, but I think the same thing exists on cybersecurity
and different solutions inside that context.
273
00:25:44,646 --> 00:25:46,996
And I will say it's not cheap, right?
274
00:25:46,996 --> 00:25:52,548
So like you you can't get that by by picking the cheapest solution.
275
00:25:52,788 --> 00:25:56,329
but there's a lot of value in what we can get if we work together.
276
00:25:56,329 --> 00:25:59,060
That being said, I don't think there is a one size.
277
00:25:59,060 --> 00:26:01,372
fits all, just like I answered in previous.
278
00:26:01,372 --> 00:26:07,936
It's, you know, if you were to say, is the answer national infrastructure, local
infrastructure, or commercial cloud?
279
00:26:07,936 --> 00:26:10,037
I would say the answer is all three.
280
00:26:10,037 --> 00:26:14,881
Each use case has a different ~ requirement in that space.
281
00:26:14,881 --> 00:26:22,826
And so do I think we throw out commercial cloud providers and do everything inside our
own?
282
00:26:22,826 --> 00:26:23,817
Absolutely not.
283
00:26:23,817 --> 00:26:28,850
We leverage all of the tools at our disposal, but we need to
284
00:26:30,036 --> 00:26:38,854
take a hard look at making some really good investments in ~ things inside the Canadian
context that will benefit us long term.
285
00:26:39,654 --> 00:26:41,703
Yeah, I think that's a great answer.
286
00:26:42,794 --> 00:26:47,441
I'm gonna spin a little bit here to one of our favorite words, governance.
287
00:26:47,441 --> 00:26:56,144
So how do you structure governance so the research needs are heard, yet the decisions are
actually timely?
288
00:26:59,646 --> 00:27:01,246
This is a tough one.
289
00:27:01,547 --> 00:27:04,809
I would say the biggest way.
290
00:27:06,811 --> 00:27:07,481
Well, I mean,
291
00:27:07,481 --> 00:27:09,763
I will note the word governance like
292
00:27:09,763 --> 00:27:12,345
means so many things to so many people.
293
00:27:12,345 --> 00:27:18,419
Like I sit or sat, I no longer sit on the SIRA board, and the word governance there is big
G governance.
294
00:27:18,419 --> 00:27:26,645
and then inside an institution, governance is like what decisions need to get made, who
needs to make those decisions and how are they made.
295
00:27:26,645 --> 00:27:28,390
~ and so
296
00:27:28,390 --> 00:27:41,809
Thinking out the context inside our organization from the research standpoint, the more
services and solutions you can build so that the governance is about bigger picture
297
00:27:41,809 --> 00:27:42,510
things, right?
298
00:27:42,510 --> 00:27:44,581
Like where do we invest our dollars?
299
00:27:44,581 --> 00:27:48,590
Where what infrastructure do we invest in?
300
00:27:48,945 --> 00:27:50,736
And services do we invest in?
301
00:27:50,736 --> 00:27:54,638
So that when each researcher comes along, they're picking the thing they need from a
catalog.
302
00:27:54,638 --> 00:27:57,380
They're saying, Hey, I need some storage to support.
303
00:27:57,380 --> 00:28:00,112
my active data, you know, sensitive data that I currently have.
304
00:28:00,112 --> 00:28:03,235
And they click a button and they have access to it in minutes.
305
00:28:03,235 --> 00:28:05,317
Or I need some computing and here's my challenge.
306
00:28:05,317 --> 00:28:10,761
How do we get them access to something really quickly and easily with the least amount of
friction as possible?
307
00:28:10,881 --> 00:28:14,845
And then transition them onto national infrastructure when it makes sense.
308
00:28:14,845 --> 00:28:24,002
And so I will say you invest in services and solutions that support as many needs as you
possibly can.
309
00:28:24,002 --> 00:28:26,424
So your governance sits at a higher level.
310
00:28:26,734 --> 00:28:29,797
And the decisions are hidden from the research community.
311
00:28:30,718 --> 00:28:32,440
yeah, and striving for that eighty twenty.
312
00:28:32,440 --> 00:28:38,456
So eighty percent of the things are easy and twenty percent of the things are the things
that you invest eighty percent of your time.
313
00:28:40,472 --> 00:28:48,482
Move a little bit to ~ what much of this podcast has has been about in season one and will
probably be in season two, and that's all about the people.
314
00:28:48,482 --> 00:28:55,714
And we talked a little bit about it at the start about you know, technology is
interesting, but that's where the fun really is, is always with the people.
315
00:28:55,714 --> 00:29:07,042
So how do you create a culture that supports both operational excellence and researcher
responsiveness from a people's people perspective?
316
00:29:09,986 --> 00:29:13,778
Yeah, so I think you have to have a balance of both
317
00:29:16,166 --> 00:29:24,780
kind of understanding what the institutional institution needs, but also understanding
that research and that research side of of the community.
318
00:29:24,780 --> 00:29:31,592
And so here in in our team, our research computing team is separate.
319
00:29:31,592 --> 00:29:37,634
We talk a lot about researchers, what they're trying to do, how they're trying to do it.
320
00:29:37,634 --> 00:29:39,915
We celebrate all the great things they do.
321
00:29:39,915 --> 00:29:45,077
I encourage everybody to attend all of the different seminars and things we have across
our community.
322
00:29:45,181 --> 00:29:51,196
We get to support our Eddie Goldberg research chairs, which were the Impact Plus chairs.
323
00:29:51,196 --> 00:29:57,919
We get to be a part of some of these really great and incredible research things that we
enable.
324
00:29:57,919 --> 00:30:05,604
And and we ~ encourage our team to really understand how cool and exciting this is.
325
00:30:05,604 --> 00:30:13,638
~ on the flip side, we sit inside IT and so we spend a lot of time with our IT team and
understanding like what are the pain points on the
326
00:30:13,638 --> 00:30:15,770
the you know, the non-research side of the house.
327
00:30:15,770 --> 00:30:25,618
Where are the challenges with deploying a major wireless infrastructure refresh across
campus or a data center networking ~ refresh across campus?
328
00:30:25,618 --> 00:30:32,734
And we share those challenges that we see operationally to try and find that right balance
between the two.
329
00:30:35,016 --> 00:30:36,704
I I'll just note it's hard.
330
00:30:36,704 --> 00:30:38,118
But it's all about people.
331
00:30:39,256 --> 00:30:40,727
It's always hard when it's about people.
332
00:30:40,727 --> 00:30:43,537
I think I think that's definitely something we see as a as a theme.
333
00:30:43,537 --> 00:30:47,908
but let's let's stay there a little bit and and let's talk about sort of the human side of
leadership.
334
00:30:47,908 --> 00:30:53,659
And you've played ~ Ultimate at the master's level, ~ very high level.
335
00:30:53,659 --> 00:31:01,581
last year we had a really great chat with Ray Darling, the registrar at the University of
Waterloo, and and Ray talked about the leadership traits he learned playing varsity
336
00:31:01,581 --> 00:31:04,441
basketball ~ at Guelph back in the day.
337
00:31:04,501 --> 00:31:06,554
So does competitive team sport
338
00:31:06,554 --> 00:31:11,533
Te teach leadership lessons that translate into running research IT?
339
00:31:13,507 --> 00:31:17,680
I mean, the the answer is obviously yes, because it's all about people.
340
00:31:17,680 --> 00:31:19,481
~
341
00:31:19,481 --> 00:31:33,471
and so you are, you know, so so I will say in my ~ when I play on a s when I've played on
the different teams, so I've I've played competitive ultimate frisbee for a number of
342
00:31:33,471 --> 00:31:34,113
years.
343
00:31:34,113 --> 00:31:36,784
most recently at the grandmaster level.
344
00:31:36,784 --> 00:31:42,026
So I've the the extra old lady frisbee as I like to call it.
345
00:31:42,026 --> 00:31:48,552
and across all of that, what I would say is a big part of it is try to be as transparent
as you possibly can.
346
00:31:48,573 --> 00:31:57,531
So when you're talking about where we're going and what our goals and objectives are, we
as a team come together and the more we can share about this is what we're planning to do
347
00:31:57,531 --> 00:31:59,903
and this is how we're planning to do it, the better.
348
00:31:59,903 --> 00:32:03,786
I've been on teams where we've said, we're just gonna go and have fun this year.
349
00:32:03,786 --> 00:32:06,526
and everybody is gonna get to play the same amount of time.
350
00:32:06,526 --> 00:32:06,846
Right.
351
00:32:06,846 --> 00:32:17,155
So you can look at that inside your institution where you're sharing what your goal are
and and how we're making decisions and being more equitable across across our decisions
352
00:32:17,155 --> 00:32:18,506
and resources.
353
00:32:18,667 --> 00:32:21,609
And then we've had other years where we're like, we're gonna try and win it all.
354
00:32:21,609 --> 00:32:28,775
And by the way, lots of some people will play and other people will not, and coaches will
make those decisions and it will be more like a dictatorship.
355
00:32:28,775 --> 00:32:31,377
And so we aim for both of those.
356
00:32:31,377 --> 00:32:34,311
there are certain decisions where, you know.
357
00:32:34,311 --> 00:32:35,381
This is what we're doing.
358
00:32:35,381 --> 00:32:36,972
Everybody get behind it.
359
00:32:36,972 --> 00:32:37,973
Here is why.
360
00:32:37,973 --> 00:32:39,403
And let's move in the same direction.
361
00:32:39,403 --> 00:32:45,056
And there are other decisions where we say, Hey, we all want to be a part of of the
direction and where we're going.
362
00:32:45,056 --> 00:32:50,111
And so I think that has a a significant value and benefit on it.
363
00:32:50,111 --> 00:32:53,931
I will say ultimately the other big part of it is just ~
364
00:32:56,325 --> 00:32:57,816
Ensuring you have fun.
365
00:32:57,816 --> 00:32:58,246
Right.
366
00:32:58,246 --> 00:33:04,815
So I play competitive sports and I do it for one reason and one reason only, which is to
have fun.
367
00:33:04,815 --> 00:33:12,527
and inside that environment and that translates into work as well, where you should try to
find work that you think is fun.
368
00:33:15,207 --> 00:33:16,678
All right, so ~ this is great.
369
00:33:16,678 --> 00:33:19,580
So let's let's wrap up with a few rapid fire questions for you here.
370
00:33:19,580 --> 00:33:22,563
You know, short, punchy answers, you know, the first thing that comes to your mind.
371
00:33:22,563 --> 00:33:25,545
So ~ I think Dana and I all just bounce back and forth.
372
00:33:25,545 --> 00:33:26,155
So I'll start.
373
00:33:26,155 --> 00:33:31,379
~ one piece of advice for a CIO trying to advocate for research on their campus.
374
00:33:32,039 --> 00:33:39,747
Find champions, key researchers or administrators, and then invest in those champions to
get them to support you as you go forward.
375
00:33:41,039 --> 00:33:48,171
If you could change one coordination problem in Canada's research infrastructure tomorrow,
what would it be?
376
00:33:49,157 --> 00:33:50,710
Remove competition.
377
00:33:50,852 --> 00:33:55,683
We shouldn't be competing on research infrastructure, ~ and yet we still do.
378
00:33:56,945 --> 00:33:57,922
That answer.
379
00:33:59,623 --> 00:34:04,731
~ what's the one capability you'd like to see every campus build in the next three years?
380
00:34:05,467 --> 00:34:06,928
So I actually have two.
381
00:34:06,949 --> 00:34:13,165
First is people who can speak to research but understand enterprise IT, so we can build
that that gap.
382
00:34:13,165 --> 00:34:16,097
Note some institutions have this, but not all.
383
00:34:16,688 --> 00:34:25,127
and then the second one, which again some institutions have, but a deeper understanding on
the importance of data management, both research data management and administrative data
384
00:34:25,127 --> 00:34:25,788
management.
385
00:34:25,788 --> 00:34:29,471
Both are equally important, but the context for the two is different.
386
00:34:31,761 --> 00:34:36,056
What's the most misunderstood part of the national research infrastructure?
387
00:34:37,009 --> 00:34:39,623
So I got two sides to this coin.
388
00:34:39,664 --> 00:34:40,992
The first side is
389
00:34:40,992 --> 00:34:41,484
politician.
390
00:34:41,484 --> 00:34:42,798
You must be in Alberta.
391
00:34:43,557 --> 00:34:43,877
Good.
392
00:34:43,877 --> 00:34:44,948
This is good.
393
00:34:44,948 --> 00:34:53,034
So on one side, I see that ~ national research infrastructure will solve all research,
computing, and storage needs.
394
00:34:53,034 --> 00:34:57,838
And then on the other side, it's that it will solve nothing and no research computing and
storage needs.
395
00:34:57,838 --> 00:34:59,773
And the reality is it's it's both.
396
00:35:01,831 --> 00:35:02,613
Okay, fair.
397
00:35:02,613 --> 00:35:03,816
I think that's good.
398
00:35:04,260 --> 00:35:08,090
One thing you wish that every VPR understood about the CIO.
399
00:35:09,083 --> 00:35:10,867
They can be part of the the solution.
400
00:35:10,867 --> 00:35:12,609
So build a relationship.
401
00:35:14,597 --> 00:35:18,618
Biggest misconception about commercial cloud for research.
402
00:35:19,857 --> 00:35:22,568
That it doesn't fill a role or a place.
403
00:35:22,568 --> 00:35:26,170
So commercial cloud will not replace all p HPC.
404
00:35:26,170 --> 00:35:28,871
We can't afford it and it's not a good use of our funds.
405
00:35:28,871 --> 00:35:31,693
~ But it's expensive for a reason.
406
00:35:31,693 --> 00:35:33,674
~ It fills a role.
407
00:35:33,674 --> 00:35:37,776
There are a set of applications that don't fit on national or local infrastructure.
408
00:35:37,776 --> 00:35:44,729
Build a solution at your institution, if you can, that leverages all three: national
infrastructure from the alliance.
409
00:35:44,729 --> 00:35:50,787
Local infrastructure for local and sensitive workloads and commercial cloud for twenty
four by seven citizen apps and more.
410
00:35:52,737 --> 00:35:54,095
And just a couple more here.
411
00:35:54,095 --> 00:35:57,220
The most underrated skill for supporting researchers.
412
00:35:58,083 --> 00:35:59,964
Listening and asking questions.
413
00:35:59,964 --> 00:36:05,707
Researchers often ask us ~ the wrong questions when they ask for help.
414
00:36:05,707 --> 00:36:12,631
So finding the way we can get them to the right question they were supposed to ask and to
provide the right solution.
415
00:36:12,923 --> 00:36:14,260
Yeah, I really like the way you stated that.
416
00:36:14,260 --> 00:36:15,684
That makes a lot of sense.
417
00:36:16,059 --> 00:36:20,591
Last one, a book or a podcast you'd recommend to new research IT leaders?
418
00:36:21,895 --> 00:36:28,459
So this one was really hard and I ultimately ~ couldn't come up with something specific to
the research side.
419
00:36:28,619 --> 00:36:32,481
So I'm gonna say my favorite two books and apply them in it.
420
00:36:32,481 --> 00:36:36,424
The first is Radical Candor, but ultimately any leadership book.
421
00:36:36,424 --> 00:36:39,395
Radical Candor is my favorite and Dana's, I know.
422
00:36:39,395 --> 00:36:45,709
~ but ultimately don't underestimate the value in building the team and supporting your
team.
423
00:36:46,290 --> 00:36:49,171
There are many other books if you can pick your favorite one.
424
00:36:49,487 --> 00:36:55,332
~ and then the second book is This Is How They Tell Me The World Ends, which is all about
cybersecurity.
425
00:36:55,332 --> 00:37:05,279
Ultimately at the end you might want to crawl into a hole and and never do anything ~
again, but is ultimately helps tell the story about why cybersecurity is important.
426
00:37:07,715 --> 00:37:10,156
Well, I love when you picked radical candor.
427
00:37:10,156 --> 00:37:13,136
You you you probably knew I would you knew I would.
428
00:37:13,555 --> 00:37:14,457
Yeah.
429
00:37:14,457 --> 00:37:14,777
Yeah.
430
00:37:14,777 --> 00:37:17,778
For those of you who can't see it, I'm shaking my hands going, yay.
431
00:37:17,778 --> 00:37:18,958
~
432
00:37:18,998 --> 00:37:21,209
Jill, thanks for joining us.
433
00:37:21,209 --> 00:37:25,900
~ we were so glad to have you as our first guest here on season two.
434
00:37:26,901 --> 00:37:36,163
Your perspective from national infrastructure to campus operations is really exactly the
kind of practical insight our listeners need.
435
00:37:37,125 --> 00:37:41,847
Yeah, I think, Jill, you you gave us so many really interesting things there.
436
00:37:41,847 --> 00:37:47,069
~ I really loved it when you said, you know, working at the university is one of the
hardest jobs that you've ever had.
437
00:37:47,069 --> 00:37:50,710
And and I think both Dana and I can attest to that now that we're retired.
438
00:37:50,710 --> 00:37:53,341
And and it's like, my God, thank you.
439
00:37:54,402 --> 00:38:00,835
and and you know, as Jayna said, this is this is the first recording ~ of the season,
aside from our sort of intro recording.
440
00:38:00,835 --> 00:38:02,435
And so thank you for being the guest.
441
00:38:02,435 --> 00:38:04,266
We meant to have you on since last year.
442
00:38:04,266 --> 00:38:05,166
and
443
00:38:05,638 --> 00:38:06,118
It's great.
444
00:38:06,118 --> 00:38:10,900
We're using new technology, so we weren't quite sure how it was gonna go, but I think it
went really well.
445
00:38:10,900 --> 00:38:18,713
and you know, the end the the end product here, they're not gonna see it, but we found a
question that could stump Jill and I think that was great.
446
00:38:18,713 --> 00:38:20,773
So that was a funny time, but we're gonna edit that out.
447
00:38:20,773 --> 00:38:25,235
Maybe we'll we'll have a a season end blooper session for that.
448
00:38:25,445 --> 00:38:31,300
~ but if you're a CIO, a VPR or or you know, a research leader, take Jill's points about
people and governance to heart.
449
00:38:31,300 --> 00:38:35,461
You know, technology without the rel right relationships just won't scale.
450
00:38:36,553 --> 00:38:43,685
And as always, if you've got feedback, questions, or stories of your own, drop us a line
at feedback at bytes of experience.ca.
451
00:38:43,685 --> 00:38:49,172
That's b-ts-ofexperience.ca, or visit us at bytes of experience.ca.
452
00:38:50,549 --> 00:38:55,555
And special thanks to Pixabee and the Grand Project for the music and to the Cuccio LDP
for their support.
453
00:38:55,555 --> 00:39:00,160
We'll see you next time on Bites of Experience where the insights are unfiltered and the
coffee is strong.
454
00:39:00,160 --> 00:39:01,201
Thanks, Jill.
00:00:27,892 --> 00:00:29,916
Welcome back to Bytes of Experience.
2
00:00:29,916 --> 00:00:32,781
I'm Bo Wanschneider, joined as always by Dana Sanderson.
3
00:00:32,781 --> 00:00:41,326
Today we're talking with Jill Kowalchuk from the University of Calgary about leading
research IT, where national infrastructure campus operations and security intersect.
4
00:00:42,228 --> 00:00:49,210
Jill's career spans Westgrid, Compute Canada, CanSOC, and leadership roles within national
organizations.
5
00:00:49,210 --> 00:00:52,511
She's also served as the chair of SIRA's board of directors.
6
00:00:52,511 --> 00:01:04,294
Now, two years into a role that sits between IT and research at UCalgary, she's uniquely
placed to talk to us about why this role and what works and what doesn't and how to build
7
00:01:04,294 --> 00:01:05,975
trust across the campus.
8
00:01:06,135 --> 00:01:08,816
Jill, so great to have you join us today.
9
00:01:08,856 --> 00:01:10,068
Tell us how that
10
00:01:10,068 --> 00:01:12,986
path shaped your view of the research ecosystem.
11
00:01:14,208 --> 00:01:15,038
yeah, absolutely.
12
00:01:15,038 --> 00:01:19,041
So I've always been drawn to the same types of of roles and challenges.
13
00:01:19,041 --> 00:01:22,933
That is the intersection of technology and people.
14
00:01:23,273 --> 00:01:28,396
I I'm a big believer in technology in terms of what it can enable and what it can support.
15
00:01:28,396 --> 00:01:39,542
~ I love helping people, solving challenging problems, and finding different ways to
deliver value to Canadians in general, whether that be ~ in research or in the
16
00:01:39,542 --> 00:01:42,674
infrastructure that supports research or research.
17
00:01:42,770 --> 00:01:45,949
Or in the case of CIRA how it can help all Canadians.
18
00:01:47,678 --> 00:01:56,856
I think the biggest thing I've learned across all of these different roles is that there
is significant value in working ~ together, working together across different things to
19
00:01:56,856 --> 00:01:58,578
solve challenging problems.
20
00:01:58,578 --> 00:02:08,467
That being said, one thing that I will say I knew before, but really gets driven ~ home
and my new role at the University of Calgary is there's no one silver bullet to solve all
21
00:02:08,467 --> 00:02:09,057
problems.
22
00:02:09,057 --> 00:02:14,492
And most things need to get looked at with a unique lens to the current challenger
problem.
23
00:02:17,748 --> 00:02:21,491
That's you know, I think it's great that you started right away with technology and
people.
24
00:02:21,491 --> 00:02:24,564
And this is something Dana and I have run across in a lot of our sessions.
25
00:02:24,564 --> 00:02:27,196
It you know, it a lot of times it boils down to people.
26
00:02:27,196 --> 00:02:30,619
And I think we've got a couple coming up this season that might try to counter that.
27
00:02:30,619 --> 00:02:32,800
And I think it's gonna be an interesting discussion.
28
00:02:32,801 --> 00:02:40,206
So let's focus a little bit more about the role you have at the University of Calgary
that's sort of embedded between IT and research.
29
00:02:41,168 --> 00:02:46,676
so why embed that role in IT rather than in the VPR's office?
30
00:02:46,676 --> 00:02:50,149
Or maybe research services, or maybe that's the same thing at your institution.
31
00:02:51,842 --> 00:03:01,561
yeah, so ultimately when I answer this question about my role at the University of
Calgary, and I would say I've answered ~ different questions about organizations or
32
00:03:01,561 --> 00:03:11,651
organizational structure and why one organizational structure will work or won't work, I
will give the same answer to every question, which is anything can ultimately work and it
33
00:03:11,651 --> 00:03:17,256
really comes down ~ to the people ~ and the people that are that are in place there.
34
00:03:17,508 --> 00:03:29,243
~ what I've learned at the University of Calgary in this space in and in looking both here
and as well as what I see across other institutions is that silos are broken down as much
35
00:03:29,243 --> 00:03:30,313
as possible.
36
00:03:30,313 --> 00:03:35,756
There has to be strong integration and alignment between ~ groups.
37
00:03:35,756 --> 00:03:45,659
So in this case, from IT and research services and the VPR's office, we work really hard
to build relationships between those three different groups to most effectively support
38
00:03:45,659 --> 00:03:47,240
our research community.
39
00:03:47,954 --> 00:03:49,755
My role is embedded inside IT.
40
00:03:49,755 --> 00:04:02,150
If you were to ask me to pick one, I would say I would lean more so on being embedded
inside the IT space at the institution, because you can leverage ~ expertise in ~
41
00:04:02,150 --> 00:04:05,392
enterprise IT services and support where it makes sense.
42
00:04:05,392 --> 00:04:15,346
~ If you're looking to scale out your operations, both in terms of how what you can
support as well as you can how you can operate on a bigger scale.
43
00:04:15,454 --> 00:04:19,005
Being embedded inside IT can provide this opportunity.
44
00:04:19,686 --> 00:04:23,788
It also allows you to influence technology decisions to support the research enterprise.
45
00:04:23,788 --> 00:04:35,323
~ I do this quite a bit and have a great team that I work with inside the IT environment
that will listen to my input and feedback about how we can change or an adjust different
46
00:04:35,323 --> 00:04:36,994
initiative to support that.
47
00:04:36,994 --> 00:04:42,016
I think a big good example that currently exists is we're undergoing a major network
refresh.
48
00:04:42,228 --> 00:04:50,893
~ and we're sitting in there influencing how we are deploying that ~ refresh across campus
to see what we are seeing coming down the pipe related to research.
49
00:04:50,893 --> 00:05:01,008
Big data projects, ~ different instruments that are coming on campus, how can we most
effectively move that data across our campus as well as out to the research and education
50
00:05:01,008 --> 00:05:04,900
network and where appropriate, the commercial ~ internet as well.
51
00:05:05,201 --> 00:05:11,998
The last thing I'll say, as both of you know, I spent ~ quite a bit of time working within
Cucio and working directly.
52
00:05:11,998 --> 00:05:22,533
with CIOs and I will say there is a heavy driver on leadership and leadership development,
building teams, building culture, and using that to deliver services in an efficient and
53
00:05:22,533 --> 00:05:23,673
effective way.
54
00:05:23,673 --> 00:05:30,106
And I think there's significant benefit to this on the research side of the house,
particularly as we look to scale up.
55
00:05:31,136 --> 00:05:35,756
Yeah, I really like that notion that you get to sit at this table to help inform that
discussion.
56
00:05:35,756 --> 00:05:46,143
Cause it's always been interesting over the years talking to the researchers and what
their expectations are of the campus network in terms of what it can't do and and then you
57
00:05:46,143 --> 00:05:47,392
know what it really can do.
58
00:05:47,392 --> 00:05:56,947
And and and you know, in most schools it's it's quite a robust network, but there's some
new things that are happening where even though we've got very, very low latencies, we
59
00:05:56,947 --> 00:05:59,048
still gotta move massive amounts of data.
60
00:05:59,048 --> 00:06:02,491
very, very quickly from one side of campus to the other side of campus.
61
00:06:02,491 --> 00:06:06,235
And they're depending on how you've configured that network, it can it can have
bottlenecks.
62
00:06:06,235 --> 00:06:09,638
~ so I I I think it's great that you guys are having that discussion.
63
00:06:09,638 --> 00:06:12,430
And I would I would expect no less from a university like Calgary.
64
00:06:13,508 --> 00:06:22,331
Yeah, that's an interesting perspective having that being one of my last projects leaving
UPEI was you know we had all this wonderful new technology, all this Cisco networking, and
65
00:06:22,331 --> 00:06:29,272
I said, Yeah, but we you do know we have to fix the wires that are in these buildings that
are decades and decades old.
66
00:06:29,272 --> 00:06:31,863
I'm sorry, ~ data still moves on wires.
67
00:06:31,863 --> 00:06:35,874
~ even when it's wireless, it still still ultimately moves on wires.
68
00:06:36,675 --> 00:06:39,815
so you're two years plus in the role.
69
00:06:40,035 --> 00:06:42,546
Has your sense of what the job
70
00:06:43,296 --> 00:06:43,867
should deliver.
71
00:06:43,867 --> 00:06:44,799
Has it really changed?
72
00:06:44,799 --> 00:06:49,217
And what what's surprised you about faculty or the VPR's expectations?
73
00:06:49,217 --> 00:06:52,532
And do other schools have roles like this?
74
00:06:53,956 --> 00:06:57,638
yeah, so I wouldn't say anything has changed per se.
75
00:06:57,638 --> 00:07:07,133
~ I I will say that the biggest surprise for me was that working at the university is the
hardest job that I have ever had.
76
00:07:07,133 --> 00:07:13,447
~ and I have had some challenging jobs, as you all know, but certainly ~ this is the
hardest one.
77
00:07:13,447 --> 00:07:15,728
I was actually at a data summit last week.
78
00:07:15,816 --> 00:07:24,138
where I was sitting at a table and I made this comment and there were people at the table
who used to be at universities and now we're at organizations that supported institutions.
79
00:07:24,138 --> 00:07:26,799
And I would say they 100% agreed with me.
80
00:07:26,799 --> 00:07:33,921
~ I think the biggest thing is the amount of work and things we need to support is
insurmountable.
81
00:07:33,921 --> 00:07:39,022
~ with the resourcing ~ that that we ultimately have.
82
00:07:39,983 --> 00:07:41,963
it is challenging to say no.
83
00:07:41,963 --> 00:07:44,264
~ and we could talk about whether or not
84
00:07:44,264 --> 00:07:48,627
the you know IT or the CIO has the ability to say no.
85
00:07:48,627 --> 00:07:51,659
But even inside that context, we don't want to or or we can't.
86
00:07:51,659 --> 00:07:54,932
These are all things we need to do and we need to enable.
87
00:07:54,932 --> 00:08:01,644
So finding ways to do that inside an institution is is really, really challenging.
88
00:08:01,644 --> 00:08:05,179
I I wasn't surprised about faculty or VPR expectations.
89
00:08:05,179 --> 00:08:11,814
~ I would actually say in thinking about the answer to this question, ~ most, most, not
all,
90
00:08:12,276 --> 00:08:22,362
Some expectations are completely unrealistic, but in many cases, what researchers ~ needed
or required and their expectations for it was not unreasonable.
91
00:08:22,362 --> 00:08:28,236
It's just we didn't have the resources to complete them in what would be a reasonable
amount of time.
92
00:08:28,236 --> 00:08:37,872
Some of the wait times for some of the requests at our institutions are really long just
because we don't yet have we don't have the the people to ultimately support it.
93
00:08:38,410 --> 00:08:48,107
What I think will become interesting in this is how AI changes that and how much we can
automate and leverage some of these things to make that those things easier to free up
94
00:08:48,107 --> 00:08:49,888
time for the harder things.
95
00:08:50,009 --> 00:08:52,330
that's a big driver at our institution right now.
96
00:08:52,330 --> 00:08:55,332
~ and so it'll be interesting to see how it comes.
97
00:08:55,393 --> 00:09:00,556
The challenge there is that oftentimes to save time and money, you need money.
98
00:09:00,556 --> 00:09:05,980
~ and so that's a constant balance that that we're working towards, at least at our
institution.
99
00:09:08,266 --> 00:09:17,162
So, you know, if you've if you've been listening to this podcast, you would have heard me
talk about how important the relationship is between the CIO, the VPR, and the chief
100
00:09:17,162 --> 00:09:26,668
librarian and and so does being inside IT give you more credibility with faculty,
researchers, and the VPR, or does it create friction?
101
00:09:26,708 --> 00:09:31,351
And and how do you balance operational authority with research authority?
102
00:09:31,571 --> 00:09:33,062
Autonomy, sorry.
103
00:09:34,410 --> 00:09:37,002
So the answer's both.
104
00:09:37,002 --> 00:09:46,700
~ IT, like many central services inside an institution, are are hampered with that
challenging job and a reputation.
105
00:09:46,700 --> 00:09:52,051
~ we need to deliver so much, we have so few r resources, there's a lot of bureaucracy.
106
00:09:52,852 --> 00:09:59,366
and so working with IT can be slow, as I mentioned before, and it can be expensive
expensive.
107
00:09:59,904 --> 00:10:10,447
~ so to offset this, you need a CIO and an IT team that really understands the value of
research, what it what it can do, what it takes, and what it can enable.
108
00:10:10,447 --> 00:10:15,449
And you have to have the ability to prioritize some key research initiatives to help build
that credibility.
109
00:10:15,449 --> 00:10:22,171
~ and so you can't do absolutely everything for absolutely everyone all of the time.
110
00:10:22,171 --> 00:10:26,748
So you need to pick some key things that will help you build that credibility and support.
111
00:10:26,748 --> 00:10:30,150
And then move forward in leveraging and and building off of that.
112
00:10:30,150 --> 00:10:35,468
~ so the balance side of the question you asked takes time.
113
00:10:35,468 --> 00:10:40,017
~ ultimately we're all about finding different pathways to make things happen.
114
00:10:40,017 --> 00:10:48,864
We work with ~ research teams to help them understand the risks and challenges, and we
also let them do the things that they need to do, which aren't too risky.
115
00:10:48,864 --> 00:10:55,462
If if you're looking to do something that isn't using sensitive data, we try to find the
quickest and painless path.
116
00:10:55,462 --> 00:10:56,873
Your solution and what you need.
117
00:10:56,873 --> 00:11:03,427
~ On the flip side, if you have very sensitive health or personal information, there are
hoops to jump through.
118
00:11:03,427 --> 00:11:09,861
And we look to describe what those hoops are, explain why you need to do this ~ and build
that forward.
119
00:11:09,861 --> 00:11:15,204
And in the general cases, I will say our research community has been quite receptive.
120
00:11:15,404 --> 00:11:22,386
Strong relationships with other key institutional partners, such as supply chain, legal
privacy, and the research services office are key.
121
00:11:22,386 --> 00:11:31,213
If we're all moving in that same direction and supporting each other and passing groups in
between that, it makes things a lot easier for all of us.
122
00:11:33,608 --> 00:11:39,323
You know, that's an interesting perspective you talked here about the sensitivity of the
data that the researchers are working on.
123
00:11:39,323 --> 00:11:45,713
And and you know, one of the ~ you know, I I and Bo knows me and you know me and a lot of
people know me.
124
00:11:45,713 --> 00:11:48,130
I like I like things that are simple and e easy to understand.
125
00:11:48,130 --> 00:11:52,384
And, you know, I I I was always a big fan of analogy, so just just stay between the
ditches.
126
00:11:52,384 --> 00:12:00,105
The only thing with sensitive data is you just need to understand the road gets much, much
narrower and the ditches become that much deeper
127
00:12:00,105 --> 00:12:02,807
So ~ I and I and I think that's
128
00:12:03,528 --> 00:12:04,749
I'm full of them,
129
00:12:04,970 --> 00:12:17,021
that said though, ~ often the dealing with the ditches, we'll call it, is how do you make
the case though for recurring funding for the research platform for the stakeholders?
130
00:12:17,021 --> 00:12:20,103
Because I mean you you mentioned it, right?
131
00:12:20,103 --> 00:12:21,144
You talked about
132
00:12:21,144 --> 00:12:23,259
You need money for people, you need money for tools.
133
00:12:23,259 --> 00:12:25,174
And so, you know, what's the case?
134
00:12:25,174 --> 00:12:26,577
How do you how do you actually make that case
135
00:12:26,577 --> 00:12:28,210
for for the funding?
136
00:12:29,430 --> 00:12:37,886
Yeah, so I will ~ quote something that our VPR said in a in a meeting recently, which is
research is expensive.
137
00:12:37,947 --> 00:12:39,528
there is no way about that.
138
00:12:39,528 --> 00:12:49,185
If you track the course of the University of Calgary on our research portfolio, we have
been on a steady increase in research dollars ~ and our ability to attract that.
139
00:12:49,185 --> 00:12:54,719
And I will say that has been done with a significant investment and dedication into that.
140
00:12:55,510 --> 00:13:04,184
That being said, ~ if you can provide services and things centrally, you can make things
more effective and efficient.
141
00:13:04,184 --> 00:13:08,826
So we've made a case locally that allows us to better leverage national resources.
142
00:13:08,826 --> 00:13:17,009
~ we have a centrally funded team out of base operations, and then we can use that to fund
~ other things.
143
00:13:17,009 --> 00:13:24,396
~ we support researchers in getting other funding by providing match and getting some
dollars back to support augmenting and building out.
144
00:13:24,396 --> 00:13:27,778
~ the initiatives ~ in that context.
145
00:13:27,778 --> 00:13:31,999
And so that's a way in terms of this leverage that we have been able to demonstrate that.
146
00:13:31,999 --> 00:13:38,842
We also show it in that ultimately by making this investment, it's all it's it's less
expensive for the institution overall.
147
00:13:38,842 --> 00:13:42,864
Having a data center that researchers can plug things into it's more secure.
148
00:13:42,864 --> 00:13:48,227
It's cheaper than people going out and and building their own data centers.
149
00:13:48,227 --> 00:13:52,118
If you can find models for efficient chargeback to researchers,
150
00:13:52,140 --> 00:14:02,530
where ~ base infrastructure is funded by the institution, but we're augmenting that on top
of it with different components from the research side, you can really get ~ better value
151
00:14:02,530 --> 00:14:04,892
and leverage ~ across that.
152
00:14:05,453 --> 00:14:15,363
I haven't actually done the math, but I think ~ at a minimum we probably bring in 50% more
to the institution and research dollars than we are ~ funded on top of what we're funded
153
00:14:15,363 --> 00:14:16,554
directly for.
154
00:14:21,010 --> 00:14:24,164
you knew we'd get to security at some point when we're talking to you.
155
00:14:24,164 --> 00:14:27,878
So so you've worked with CanSoc and you've chaired Syrah.
156
00:14:27,878 --> 00:14:33,684
how how should campuses think about research security differently from enterprise
security?
157
00:14:34,936 --> 00:14:39,408
So it's all about risk, which is really how you should look at your enterprise security as
well.
158
00:14:39,408 --> 00:14:45,301
So the answer really isn't all that much different, different in that context.
159
00:14:45,422 --> 00:15:00,830
But taking a look at what is the research being done, what is the sensitivity of the data,
~ and then ultimately making a decision about how can we support that ~ in a way that
160
00:15:00,830 --> 00:15:04,148
maximizes the value on the research side and
161
00:15:04,148 --> 00:15:08,981
minimizes or accepts, makes an acceptable ~ risk decision.
162
00:15:08,981 --> 00:15:11,552
So research is risky.
163
00:15:11,552 --> 00:15:12,873
There's no question about it.
164
00:15:12,873 --> 00:15:28,702
~ You know, and so finding a model that allows the institution to ~ understand all of
those things and then make decisions inside that context is absolutely key.
165
00:15:28,702 --> 00:15:33,334
The director of cybersecurity that we have here at our institution is exceptional at this.
166
00:15:33,386 --> 00:15:42,521
They will support working with the researcher in the research community, understanding the
risk associated with something, ~ and then finding a pathway to yes.
167
00:15:42,521 --> 00:15:44,742
Sometimes the pathway to yes is expensive.
168
00:15:44,742 --> 00:15:56,509
It involves penetration testing and standing up a secured environment inside AWS or
standing up our own local infrastructure that has security controls around it.
169
00:15:56,509 --> 00:16:00,401
We're working towards NIST 800-171 certification.
170
00:16:00,401 --> 00:16:03,040
We've done our self-assessment and have a plan of action.
171
00:16:03,040 --> 00:16:12,350
And so all of those things big and bring in that environment and services to allow us to
say more yeses with the right hoops understood that you have to jump through.
172
00:16:14,348 --> 00:16:17,049
You know, I just wanna follow on that.
173
00:16:17,049 --> 00:16:30,770
Do you think with research or a role like yours tucked inside the enterprise or in tucked
in inside IT, that those risk decisions about what's the right if that's such a word, the
174
00:16:30,770 --> 00:16:40,547
right infrastructure or the right ~ conditions that need to be in place in terms of
enterprise IT to allow those decisions to be made faster with
175
00:16:42,015 --> 00:16:54,973
How do get that across to researchers to make them understand it's somewhat appealing to
actually have your research being managed at an enterprise level in terms of your ability
176
00:16:54,973 --> 00:16:56,655
to for speed to execution?
177
00:16:57,905 --> 00:17:00,277
Yeah, so I would say two things.
178
00:17:00,277 --> 00:17:06,512
~ you know, you mentioned speed to execution and and that one I'm not so sure on.
179
00:17:06,512 --> 00:17:14,067
The reality is is if there is no requirement for security, then it's faster if you just do
it yourself.
180
00:17:14,188 --> 00:17:24,275
But what we are seeing in all of what's coming down is there is a requirement from tri
councils, ~ you know.
181
00:17:24,445 --> 00:17:27,576
We do we receive data from the National Institutes from Health.
182
00:17:27,576 --> 00:17:40,059
If you want to do anything with GDPR data, any type of all of what's coming through this
is an understanding that you need to have the right security controls in place based upon
183
00:17:40,059 --> 00:17:41,740
your risk and what you're doing.
184
00:17:41,740 --> 00:17:43,220
And so this is coming.
185
00:17:43,220 --> 00:17:54,423
~ most of the the grants and things that are required sign off, it says somebody who
doesn't say this, but it's translation in non legal words.
186
00:17:54,779 --> 00:17:59,202
Somebody who understands IT and cybersecurity needs to sign off on this.
187
00:17:59,463 --> 00:18:03,355
And so that person is in your IT team.
188
00:18:03,355 --> 00:18:06,688
It is your CISO or your CISO equivalent or your CIO.
189
00:18:06,688 --> 00:18:10,730
And they have to be the one that signs off on that.
190
00:18:10,730 --> 00:18:14,953
And what that team needs is build towards standards.
191
00:18:14,953 --> 00:18:23,847
That's my advice is build towards standards, provide the sub the resourcing required to
build infrastructure.
192
00:18:23,847 --> 00:18:29,051
that supports those standards so that your CISO can attest to what they need to attest to.
193
00:18:29,051 --> 00:18:30,512
There will be gaps.
194
00:18:30,512 --> 00:18:31,752
You will not have everything.
195
00:18:31,752 --> 00:18:33,103
It is a research environment.
196
00:18:33,103 --> 00:18:38,317
You will get to a question on NIST 800-171 be like, yeah, we can't answer that.
197
00:18:38,317 --> 00:18:39,558
No, we can't do that.
198
00:18:39,558 --> 00:18:42,060
~ or inside that context.
199
00:18:42,060 --> 00:18:48,144
And it's okay for your research enterprise to accept that risk and understand that risk in
that context.
200
00:18:48,144 --> 00:18:53,167
They're the right people to make those decisions ~ inside that context.
201
00:18:55,005 --> 00:18:57,397
That's a bit of a segue, maybe to this next question then.
202
00:18:57,397 --> 00:19:08,243
So is there a practical low friction path for campuses to actually participate in national
security coordination without overburdening the researchers?
203
00:19:09,607 --> 00:19:22,426
Yeah, I would say you build infrastructure that ~ you build digital research
infrastructure that meets a standard, whether it be NIST 800 171 or Canadian equivalent or
204
00:19:22,426 --> 00:19:23,127
otherwise.
205
00:19:23,127 --> 00:19:26,019
And so you have a pathway in that.
206
00:19:26,019 --> 00:19:31,903
Right now, because of the attestation required, our institution is doing it for our
researchers.
207
00:19:31,903 --> 00:19:37,267
We can accept a level of risk for our researchers that a another institution
208
00:19:37,373 --> 00:19:41,825
wouldn't be comfortable ex accepting ~ inside that context.
209
00:19:41,825 --> 00:19:51,369
I will say ultimately the end goal is you have independent organizations that have
infrastructure that accept this risk on behalf of multiple institutions and are built for
210
00:19:51,369 --> 00:19:52,490
that exact purpose.
211
00:19:52,490 --> 00:19:54,831
And moving towards that makes a ton of sense.
212
00:19:54,831 --> 00:19:57,172
And those have to be independent organizations.
213
00:19:57,172 --> 00:20:05,135
They can't be commercial entities because why would they put all of their billions of
dollars of assets on the line related to accepting some of these risks?
214
00:20:05,193 --> 00:20:15,531
For that same reason, it can't be an institution on behalf of other institutions to put
their assets on the line to accept risk for a a d a researcher at a different university.
215
00:20:15,531 --> 00:20:17,413
It it just doesn't make sense.
216
00:20:18,675 --> 00:20:21,937
I I want to follow up on this risk discussion just for a second.
217
00:20:22,458 --> 00:20:34,886
If you think about that, all the roles or people or parts of the organization within the
university that have that have risk in their context, right?
218
00:20:34,886 --> 00:20:39,680
So how how do you balance what is the right amount of risk for the enterprise, right?
219
00:20:39,680 --> 00:20:43,813
So you get the whole financial thing, you got your whole reputational thing, you get your
research, you got IT.
220
00:20:43,813 --> 00:20:47,845
There's so many elements, and we talked about, you know, this is really a risk decision.
221
00:20:48,935 --> 00:21:04,320
what what what's you Calgary been doing to help balance all those stakeholders and all
those voices in that risk matrix, I'll call it, to find a way that is ~ supports the the
222
00:21:04,320 --> 00:21:10,535
needs of the the researcher but also manages the needs of appropriate level of enterprise
risk.
223
00:21:12,699 --> 00:21:19,812
So ~ this it you've asked a very institutional question and so I can answer it in the
institutional way.
224
00:21:19,812 --> 00:21:27,965
I will say we're quite fortunate at the University of Calgary and that we're very ~
centrally run, right?
225
00:21:27,965 --> 00:21:32,507
It's a very we've gone through the the sort of centralization.
226
00:21:32,507 --> 00:21:38,110
I know previous podcast members use different words for that.
227
00:21:38,110 --> 00:21:39,830
I'm gonna use centralization.
228
00:21:39,830 --> 00:21:41,611
~ and so our teams
229
00:21:42,567 --> 00:21:44,029
work quite closely.
230
00:21:44,029 --> 00:21:51,515
And ~ legal owns a piece of it, privacy owns a piece of it, IT owns a piece of it.
231
00:21:52,597 --> 00:22:05,227
and I will say those groups are at the table on a regular and ongoing basis to both
recognize who owns what and how we work carefully together.
232
00:22:05,227 --> 00:22:06,110
And so
233
00:22:07,411 --> 00:22:17,535
legal and privacy and cybersecurity at our institution have a very, very close working
relationship where we work through some of these things and pieces.
234
00:22:17,556 --> 00:22:25,129
We also then have very clearly defined leadership that owns risk in our ~ organization.
235
00:22:25,129 --> 00:22:34,403
So let's say a researcher in coming school of medicine wants to do something where we've
managed and checked off every single box in an agreement that we need to, except there's
236
00:22:34,403 --> 00:22:35,251
one gap.
237
00:22:35,251 --> 00:22:38,732
that still provide some level of risk associated with it.
238
00:22:38,732 --> 00:22:44,714
First, our director of cybersecurity would make a, okay, this is a level of risk.
239
00:22:44,714 --> 00:22:48,915
I think this is, I'll explain this risk in a way.
240
00:22:48,915 --> 00:22:55,357
~ and that gets explained to the CIO as well as the senior leader at that table.
241
00:22:55,357 --> 00:23:01,079
So like Dean or ~ A VPR, depending upon what it is.
242
00:23:01,363 --> 00:23:10,619
We walk through what that risk is in that context and they ultimately sign off on that
risk with communicating with the researcher at what that is in that context.
243
00:23:12,573 --> 00:23:19,650
I will just say what the way the you laughed at my answer on I'm gonna answer this from
the institutional context.
244
00:23:19,650 --> 00:23:21,562
That's the institutional context.
245
00:23:21,562 --> 00:23:28,889
If you can have third parties that you are downloading the risk to, there is significant
value in that.
246
00:23:28,889 --> 00:23:36,787
And so our director of cybersecurity often is like, is there an organization that has SOC2
type two or some other
247
00:23:36,817 --> 00:23:43,535
information security attestation and we can say you're gonna do it and be comfortable with
what they've got in place, that's great.
248
00:23:43,535 --> 00:23:44,256
Let's do that.
249
00:23:44,256 --> 00:23:53,978
~ and so there's sort of two ways in which we can do that, but having those third parties
that are willing to accept risk on behalf of our institution will provide significant
250
00:23:53,978 --> 00:23:56,411
value to the community and the ecosystem.
251
00:23:58,183 --> 00:24:00,735
That is that that's a great answer.
252
00:24:00,735 --> 00:24:08,530
And I think our some of our listeners ~ are really gonna appreciate hearing that, because
I think it gives some great perspective and something for them to to to consider.
253
00:24:08,530 --> 00:24:09,971
let's switch gears a little bit here.
254
00:24:09,971 --> 00:24:13,103
and I want to talk about sovereign compute and and cloud trust.
255
00:24:13,103 --> 00:24:17,036
So this is where Dana and I might become a little unplugged and unfiltered.
256
00:24:17,036 --> 00:24:24,742
~ is sovereign compute a real operational requirement for research or mostly a
policy-political type of conversation?
257
00:24:24,742 --> 00:24:25,462
And
258
00:24:25,742 --> 00:24:28,775
Where does it matter and where is it just noise?
259
00:24:29,160 --> 00:24:30,786
So maybe that's a loaded question.
260
00:24:31,546 --> 00:24:33,486
Yeah, I think it's a loaded question.
261
00:24:33,486 --> 00:24:38,070
~ and it also depends on when you are asking me this question.
262
00:24:38,070 --> 00:24:52,237
If you asked me this question four years ago or a year ago, or six months ago, or a month
ago, I would probably answer it in multiple different ways, ~ depending upon the time ~
263
00:24:52,237 --> 00:24:53,478
and the case.
264
00:24:53,618 --> 00:24:59,481
I will say sovereignty is absolutely a requirement for Canadians in that context.
265
00:24:59,481 --> 00:25:00,816
~
266
00:25:00,816 --> 00:25:08,590
Building up ~ AI, sovereign AI capacity to the greatest extent we can, right?
267
00:25:08,590 --> 00:25:17,865
Like if you dive into the entire supply chain of AI and all of the different components,
no, we're not going to start manufacturing our own chips tomorrow and some of those other
268
00:25:17,865 --> 00:25:18,836
aspects.
269
00:25:18,836 --> 00:25:29,381
But the more we can build and support a Canadian solution, the better off we will be able
to collaborate on a global scale.
270
00:25:29,702 --> 00:25:30,862
And so
271
00:25:31,002 --> 00:25:36,504
I think this is absolutely a fundamental requirement for us in our environment.
272
00:25:36,504 --> 00:25:44,546
And I've given the a the answer on AI, but I think the same thing exists on cybersecurity
and different solutions inside that context.
273
00:25:44,646 --> 00:25:46,996
And I will say it's not cheap, right?
274
00:25:46,996 --> 00:25:52,548
So like you you can't get that by by picking the cheapest solution.
275
00:25:52,788 --> 00:25:56,329
but there's a lot of value in what we can get if we work together.
276
00:25:56,329 --> 00:25:59,060
That being said, I don't think there is a one size.
277
00:25:59,060 --> 00:26:01,372
fits all, just like I answered in previous.
278
00:26:01,372 --> 00:26:07,936
It's, you know, if you were to say, is the answer national infrastructure, local
infrastructure, or commercial cloud?
279
00:26:07,936 --> 00:26:10,037
I would say the answer is all three.
280
00:26:10,037 --> 00:26:14,881
Each use case has a different ~ requirement in that space.
281
00:26:14,881 --> 00:26:22,826
And so do I think we throw out commercial cloud providers and do everything inside our
own?
282
00:26:22,826 --> 00:26:23,817
Absolutely not.
283
00:26:23,817 --> 00:26:28,850
We leverage all of the tools at our disposal, but we need to
284
00:26:30,036 --> 00:26:38,854
take a hard look at making some really good investments in ~ things inside the Canadian
context that will benefit us long term.
285
00:26:39,654 --> 00:26:41,703
Yeah, I think that's a great answer.
286
00:26:42,794 --> 00:26:47,441
I'm gonna spin a little bit here to one of our favorite words, governance.
287
00:26:47,441 --> 00:26:56,144
So how do you structure governance so the research needs are heard, yet the decisions are
actually timely?
288
00:26:59,646 --> 00:27:01,246
This is a tough one.
289
00:27:01,547 --> 00:27:04,809
I would say the biggest way.
290
00:27:06,811 --> 00:27:07,481
Well, I mean,
291
00:27:07,481 --> 00:27:09,763
I will note the word governance like
292
00:27:09,763 --> 00:27:12,345
means so many things to so many people.
293
00:27:12,345 --> 00:27:18,419
Like I sit or sat, I no longer sit on the SIRA board, and the word governance there is big
G governance.
294
00:27:18,419 --> 00:27:26,645
and then inside an institution, governance is like what decisions need to get made, who
needs to make those decisions and how are they made.
295
00:27:26,645 --> 00:27:28,390
~ and so
296
00:27:28,390 --> 00:27:41,809
Thinking out the context inside our organization from the research standpoint, the more
services and solutions you can build so that the governance is about bigger picture
297
00:27:41,809 --> 00:27:42,510
things, right?
298
00:27:42,510 --> 00:27:44,581
Like where do we invest our dollars?
299
00:27:44,581 --> 00:27:48,590
Where what infrastructure do we invest in?
300
00:27:48,945 --> 00:27:50,736
And services do we invest in?
301
00:27:50,736 --> 00:27:54,638
So that when each researcher comes along, they're picking the thing they need from a
catalog.
302
00:27:54,638 --> 00:27:57,380
They're saying, Hey, I need some storage to support.
303
00:27:57,380 --> 00:28:00,112
my active data, you know, sensitive data that I currently have.
304
00:28:00,112 --> 00:28:03,235
And they click a button and they have access to it in minutes.
305
00:28:03,235 --> 00:28:05,317
Or I need some computing and here's my challenge.
306
00:28:05,317 --> 00:28:10,761
How do we get them access to something really quickly and easily with the least amount of
friction as possible?
307
00:28:10,881 --> 00:28:14,845
And then transition them onto national infrastructure when it makes sense.
308
00:28:14,845 --> 00:28:24,002
And so I will say you invest in services and solutions that support as many needs as you
possibly can.
309
00:28:24,002 --> 00:28:26,424
So your governance sits at a higher level.
310
00:28:26,734 --> 00:28:29,797
And the decisions are hidden from the research community.
311
00:28:30,718 --> 00:28:32,440
yeah, and striving for that eighty twenty.
312
00:28:32,440 --> 00:28:38,456
So eighty percent of the things are easy and twenty percent of the things are the things
that you invest eighty percent of your time.
313
00:28:40,472 --> 00:28:48,482
Move a little bit to ~ what much of this podcast has has been about in season one and will
probably be in season two, and that's all about the people.
314
00:28:48,482 --> 00:28:55,714
And we talked a little bit about it at the start about you know, technology is
interesting, but that's where the fun really is, is always with the people.
315
00:28:55,714 --> 00:29:07,042
So how do you create a culture that supports both operational excellence and researcher
responsiveness from a people's people perspective?
316
00:29:09,986 --> 00:29:13,778
Yeah, so I think you have to have a balance of both
317
00:29:16,166 --> 00:29:24,780
kind of understanding what the institutional institution needs, but also understanding
that research and that research side of of the community.
318
00:29:24,780 --> 00:29:31,592
And so here in in our team, our research computing team is separate.
319
00:29:31,592 --> 00:29:37,634
We talk a lot about researchers, what they're trying to do, how they're trying to do it.
320
00:29:37,634 --> 00:29:39,915
We celebrate all the great things they do.
321
00:29:39,915 --> 00:29:45,077
I encourage everybody to attend all of the different seminars and things we have across
our community.
322
00:29:45,181 --> 00:29:51,196
We get to support our Eddie Goldberg research chairs, which were the Impact Plus chairs.
323
00:29:51,196 --> 00:29:57,919
We get to be a part of some of these really great and incredible research things that we
enable.
324
00:29:57,919 --> 00:30:05,604
And and we ~ encourage our team to really understand how cool and exciting this is.
325
00:30:05,604 --> 00:30:13,638
~ on the flip side, we sit inside IT and so we spend a lot of time with our IT team and
understanding like what are the pain points on the
326
00:30:13,638 --> 00:30:15,770
the you know, the non-research side of the house.
327
00:30:15,770 --> 00:30:25,618
Where are the challenges with deploying a major wireless infrastructure refresh across
campus or a data center networking ~ refresh across campus?
328
00:30:25,618 --> 00:30:32,734
And we share those challenges that we see operationally to try and find that right balance
between the two.
329
00:30:35,016 --> 00:30:36,704
I I'll just note it's hard.
330
00:30:36,704 --> 00:30:38,118
But it's all about people.
331
00:30:39,256 --> 00:30:40,727
It's always hard when it's about people.
332
00:30:40,727 --> 00:30:43,537
I think I think that's definitely something we see as a as a theme.
333
00:30:43,537 --> 00:30:47,908
but let's let's stay there a little bit and and let's talk about sort of the human side of
leadership.
334
00:30:47,908 --> 00:30:53,659
And you've played ~ Ultimate at the master's level, ~ very high level.
335
00:30:53,659 --> 00:31:01,581
last year we had a really great chat with Ray Darling, the registrar at the University of
Waterloo, and and Ray talked about the leadership traits he learned playing varsity
336
00:31:01,581 --> 00:31:04,441
basketball ~ at Guelph back in the day.
337
00:31:04,501 --> 00:31:06,554
So does competitive team sport
338
00:31:06,554 --> 00:31:11,533
Te teach leadership lessons that translate into running research IT?
339
00:31:13,507 --> 00:31:17,680
I mean, the the answer is obviously yes, because it's all about people.
340
00:31:17,680 --> 00:31:19,481
~
341
00:31:19,481 --> 00:31:33,471
and so you are, you know, so so I will say in my ~ when I play on a s when I've played on
the different teams, so I've I've played competitive ultimate frisbee for a number of
342
00:31:33,471 --> 00:31:34,113
years.
343
00:31:34,113 --> 00:31:36,784
most recently at the grandmaster level.
344
00:31:36,784 --> 00:31:42,026
So I've the the extra old lady frisbee as I like to call it.
345
00:31:42,026 --> 00:31:48,552
and across all of that, what I would say is a big part of it is try to be as transparent
as you possibly can.
346
00:31:48,573 --> 00:31:57,531
So when you're talking about where we're going and what our goals and objectives are, we
as a team come together and the more we can share about this is what we're planning to do
347
00:31:57,531 --> 00:31:59,903
and this is how we're planning to do it, the better.
348
00:31:59,903 --> 00:32:03,786
I've been on teams where we've said, we're just gonna go and have fun this year.
349
00:32:03,786 --> 00:32:06,526
and everybody is gonna get to play the same amount of time.
350
00:32:06,526 --> 00:32:06,846
Right.
351
00:32:06,846 --> 00:32:17,155
So you can look at that inside your institution where you're sharing what your goal are
and and how we're making decisions and being more equitable across across our decisions
352
00:32:17,155 --> 00:32:18,506
and resources.
353
00:32:18,667 --> 00:32:21,609
And then we've had other years where we're like, we're gonna try and win it all.
354
00:32:21,609 --> 00:32:28,775
And by the way, lots of some people will play and other people will not, and coaches will
make those decisions and it will be more like a dictatorship.
355
00:32:28,775 --> 00:32:31,377
And so we aim for both of those.
356
00:32:31,377 --> 00:32:34,311
there are certain decisions where, you know.
357
00:32:34,311 --> 00:32:35,381
This is what we're doing.
358
00:32:35,381 --> 00:32:36,972
Everybody get behind it.
359
00:32:36,972 --> 00:32:37,973
Here is why.
360
00:32:37,973 --> 00:32:39,403
And let's move in the same direction.
361
00:32:39,403 --> 00:32:45,056
And there are other decisions where we say, Hey, we all want to be a part of of the
direction and where we're going.
362
00:32:45,056 --> 00:32:50,111
And so I think that has a a significant value and benefit on it.
363
00:32:50,111 --> 00:32:53,931
I will say ultimately the other big part of it is just ~
364
00:32:56,325 --> 00:32:57,816
Ensuring you have fun.
365
00:32:57,816 --> 00:32:58,246
Right.
366
00:32:58,246 --> 00:33:04,815
So I play competitive sports and I do it for one reason and one reason only, which is to
have fun.
367
00:33:04,815 --> 00:33:12,527
and inside that environment and that translates into work as well, where you should try to
find work that you think is fun.
368
00:33:15,207 --> 00:33:16,678
All right, so ~ this is great.
369
00:33:16,678 --> 00:33:19,580
So let's let's wrap up with a few rapid fire questions for you here.
370
00:33:19,580 --> 00:33:22,563
You know, short, punchy answers, you know, the first thing that comes to your mind.
371
00:33:22,563 --> 00:33:25,545
So ~ I think Dana and I all just bounce back and forth.
372
00:33:25,545 --> 00:33:26,155
So I'll start.
373
00:33:26,155 --> 00:33:31,379
~ one piece of advice for a CIO trying to advocate for research on their campus.
374
00:33:32,039 --> 00:33:39,747
Find champions, key researchers or administrators, and then invest in those champions to
get them to support you as you go forward.
375
00:33:41,039 --> 00:33:48,171
If you could change one coordination problem in Canada's research infrastructure tomorrow,
what would it be?
376
00:33:49,157 --> 00:33:50,710
Remove competition.
377
00:33:50,852 --> 00:33:55,683
We shouldn't be competing on research infrastructure, ~ and yet we still do.
378
00:33:56,945 --> 00:33:57,922
That answer.
379
00:33:59,623 --> 00:34:04,731
~ what's the one capability you'd like to see every campus build in the next three years?
380
00:34:05,467 --> 00:34:06,928
So I actually have two.
381
00:34:06,949 --> 00:34:13,165
First is people who can speak to research but understand enterprise IT, so we can build
that that gap.
382
00:34:13,165 --> 00:34:16,097
Note some institutions have this, but not all.
383
00:34:16,688 --> 00:34:25,127
and then the second one, which again some institutions have, but a deeper understanding on
the importance of data management, both research data management and administrative data
384
00:34:25,127 --> 00:34:25,788
management.
385
00:34:25,788 --> 00:34:29,471
Both are equally important, but the context for the two is different.
386
00:34:31,761 --> 00:34:36,056
What's the most misunderstood part of the national research infrastructure?
387
00:34:37,009 --> 00:34:39,623
So I got two sides to this coin.
388
00:34:39,664 --> 00:34:40,992
The first side is
389
00:34:40,992 --> 00:34:41,484
politician.
390
00:34:41,484 --> 00:34:42,798
You must be in Alberta.
391
00:34:43,557 --> 00:34:43,877
Good.
392
00:34:43,877 --> 00:34:44,948
This is good.
393
00:34:44,948 --> 00:34:53,034
So on one side, I see that ~ national research infrastructure will solve all research,
computing, and storage needs.
394
00:34:53,034 --> 00:34:57,838
And then on the other side, it's that it will solve nothing and no research computing and
storage needs.
395
00:34:57,838 --> 00:34:59,773
And the reality is it's it's both.
396
00:35:01,831 --> 00:35:02,613
Okay, fair.
397
00:35:02,613 --> 00:35:03,816
I think that's good.
398
00:35:04,260 --> 00:35:08,090
One thing you wish that every VPR understood about the CIO.
399
00:35:09,083 --> 00:35:10,867
They can be part of the the solution.
400
00:35:10,867 --> 00:35:12,609
So build a relationship.
401
00:35:14,597 --> 00:35:18,618
Biggest misconception about commercial cloud for research.
402
00:35:19,857 --> 00:35:22,568
That it doesn't fill a role or a place.
403
00:35:22,568 --> 00:35:26,170
So commercial cloud will not replace all p HPC.
404
00:35:26,170 --> 00:35:28,871
We can't afford it and it's not a good use of our funds.
405
00:35:28,871 --> 00:35:31,693
~ But it's expensive for a reason.
406
00:35:31,693 --> 00:35:33,674
~ It fills a role.
407
00:35:33,674 --> 00:35:37,776
There are a set of applications that don't fit on national or local infrastructure.
408
00:35:37,776 --> 00:35:44,729
Build a solution at your institution, if you can, that leverages all three: national
infrastructure from the alliance.
409
00:35:44,729 --> 00:35:50,787
Local infrastructure for local and sensitive workloads and commercial cloud for twenty
four by seven citizen apps and more.
410
00:35:52,737 --> 00:35:54,095
And just a couple more here.
411
00:35:54,095 --> 00:35:57,220
The most underrated skill for supporting researchers.
412
00:35:58,083 --> 00:35:59,964
Listening and asking questions.
413
00:35:59,964 --> 00:36:05,707
Researchers often ask us ~ the wrong questions when they ask for help.
414
00:36:05,707 --> 00:36:12,631
So finding the way we can get them to the right question they were supposed to ask and to
provide the right solution.
415
00:36:12,923 --> 00:36:14,260
Yeah, I really like the way you stated that.
416
00:36:14,260 --> 00:36:15,684
That makes a lot of sense.
417
00:36:16,059 --> 00:36:20,591
Last one, a book or a podcast you'd recommend to new research IT leaders?
418
00:36:21,895 --> 00:36:28,459
So this one was really hard and I ultimately ~ couldn't come up with something specific to
the research side.
419
00:36:28,619 --> 00:36:32,481
So I'm gonna say my favorite two books and apply them in it.
420
00:36:32,481 --> 00:36:36,424
The first is Radical Candor, but ultimately any leadership book.
421
00:36:36,424 --> 00:36:39,395
Radical Candor is my favorite and Dana's, I know.
422
00:36:39,395 --> 00:36:45,709
~ but ultimately don't underestimate the value in building the team and supporting your
team.
423
00:36:46,290 --> 00:36:49,171
There are many other books if you can pick your favorite one.
424
00:36:49,487 --> 00:36:55,332
~ and then the second book is This Is How They Tell Me The World Ends, which is all about
cybersecurity.
425
00:36:55,332 --> 00:37:05,279
Ultimately at the end you might want to crawl into a hole and and never do anything ~
again, but is ultimately helps tell the story about why cybersecurity is important.
426
00:37:07,715 --> 00:37:10,156
Well, I love when you picked radical candor.
427
00:37:10,156 --> 00:37:13,136
You you you probably knew I would you knew I would.
428
00:37:13,555 --> 00:37:14,457
Yeah.
429
00:37:14,457 --> 00:37:14,777
Yeah.
430
00:37:14,777 --> 00:37:17,778
For those of you who can't see it, I'm shaking my hands going, yay.
431
00:37:17,778 --> 00:37:18,958
~
432
00:37:18,998 --> 00:37:21,209
Jill, thanks for joining us.
433
00:37:21,209 --> 00:37:25,900
~ we were so glad to have you as our first guest here on season two.
434
00:37:26,901 --> 00:37:36,163
Your perspective from national infrastructure to campus operations is really exactly the
kind of practical insight our listeners need.
435
00:37:37,125 --> 00:37:41,847
Yeah, I think, Jill, you you gave us so many really interesting things there.
436
00:37:41,847 --> 00:37:47,069
~ I really loved it when you said, you know, working at the university is one of the
hardest jobs that you've ever had.
437
00:37:47,069 --> 00:37:50,710
And and I think both Dana and I can attest to that now that we're retired.
438
00:37:50,710 --> 00:37:53,341
And and it's like, my God, thank you.
439
00:37:54,402 --> 00:38:00,835
and and you know, as Jayna said, this is this is the first recording ~ of the season,
aside from our sort of intro recording.
440
00:38:00,835 --> 00:38:02,435
And so thank you for being the guest.
441
00:38:02,435 --> 00:38:04,266
We meant to have you on since last year.
442
00:38:04,266 --> 00:38:05,166
and
443
00:38:05,638 --> 00:38:06,118
It's great.
444
00:38:06,118 --> 00:38:10,900
We're using new technology, so we weren't quite sure how it was gonna go, but I think it
went really well.
445
00:38:10,900 --> 00:38:18,713
and you know, the end the the end product here, they're not gonna see it, but we found a
question that could stump Jill and I think that was great.
446
00:38:18,713 --> 00:38:20,773
So that was a funny time, but we're gonna edit that out.
447
00:38:20,773 --> 00:38:25,235
Maybe we'll we'll have a a season end blooper session for that.
448
00:38:25,445 --> 00:38:31,300
~ but if you're a CIO, a VPR or or you know, a research leader, take Jill's points about
people and governance to heart.
449
00:38:31,300 --> 00:38:35,461
You know, technology without the rel right relationships just won't scale.
450
00:38:36,553 --> 00:38:43,685
And as always, if you've got feedback, questions, or stories of your own, drop us a line
at feedback at bytes of experience.ca.
451
00:38:43,685 --> 00:38:49,172
That's b-ts-ofexperience.ca, or visit us at bytes of experience.ca.
452
00:38:50,549 --> 00:38:55,555
And special thanks to Pixabee and the Grand Project for the music and to the Cuccio LDP
for their support.
453
00:38:55,555 --> 00:39:00,160
We'll see you next time on Bites of Experience where the insights are unfiltered and the
coffee is strong.
454
00:39:00,160 --> 00:39:01,201
Thanks, Jill.
