Josh Callahan (California State University) on The Digital Jungle of IT in Higher Education

On today’s episode of the Illumination by Modern Campus podcast, host Amrit Ahluwalia was joined by Josh Callahan to discuss the complex and decentralized nature of IT systems in higher ed and the role of the CIO in reshaping institution strategy to put technology at the forefront. 

Transcript

Amrit Ahluwalia (00:02):Josh Callahan, welcome to the Illumination Podcast.

Josh Callahan (00:05):Thanks for having me.

Amrit Ahluwalia (00:06):Absolutely. Well, I'm so excited to be chatting with you, and obviously you well know. The reason we're chatting today is to talk about this concept of the digital jungle. It's a topic you brought up in a session that you hosted at ed, the National Conference in 2023. You hosted. It was a few weeks ago from where we're recording now. I'm curious, could you just give us a little bit of an insight into what the Digital Jungle is for higher ed IT leaders?

Josh Callahan (00:34):Yeah. It's a concept that my boss, ed Clark, who's CIO of the California State University system talks about a lot and in contrast to where we want to be, which is a digital garden, and really this idea of a jungle is where we are now. After a decade ago, we were really looking at quantifying and managing risks in terms of what's our technical debt, what's these systems that we're running mostly on campus, just starting to get out into cloud hosted situations and how do we quantify those aging and how much skill and expertise we need to be able to allocate across these different architectures. And so we in a lot of cases, really started to move into more of a cloud environment, into more software as a service platform as a service and these different models. And we've done that in a really distributed, decentralized way in a lot of cases.

(01:36):And that's been great in terms of meeting a lot of people's needs and providing a lot of different ways to go about doing things. But the downside of that is you kind of have this explosion particularly accelerated through the pandemic when we all really rapidly moved a lot of services online where now there's just so many different ways to do things, even under one organizational structure and a lot of times distributed across a large system like ours that you really have what is a jungle that gets college just to enumerate much less manage and maintain and secure. And so from a risk management standpoint, where I spend a lot of time with this vendor risk management concept, it's really challenging just because you've got so many different vendors that you're having to build relationships with, maintain contract language, with, do security assessments on it's long.

Amrit Ahluwalia (02:39):Absolutely. And you mentioned that part of, I guess the explosion of the digital jungle came as more and more system started to be cloud hosted as we start to shift more towards SaaS-based environments. From an institutional perspective, what are some of the benefits of working with more cloud hosts or SaaS-based products as opposed to products that are hosted on premise?

Josh Callahan (03:05):Yeah, I feel like the reason that we've all moved, at least partway into the cloud is there's an economy of scale there that you're never going to be able to match as small institution. The arguments on that side are really strong, that you can have one company just really do a thing well, and that makes a lot of sense as you really difficult to argue with. It's just when you add a lot of that up,

Amrit Ahluwalia (03:37):It's interesting because it's almost like great, we found a way to do best of breed really, really well. Oh no, we found a way to do best of. 

Josh Callahan (03:46):It's funny, I was thinking heading over and kind of prepping for this digital jungle analogy and this contrast with the garden. If you look historically at the Amazon, I mean there's evidence there that the number and percentage of edible plants are unnaturally concentrated in Amazon. So it really looks like there was farming that was going on there that then led to this what we now think of as huge jungle. And in a way, I think we're always going to have this cyclical process where as new tools come out to do things, we're going to adopt them and we're going to move fast, and then we're going to have to take a step back and say, whoa, whoa, we really didn't think about our risk appetite when we were doing this, and how do we now get this under control and get this more manageable and then it's going to grow again. And we just constantly have to be exercising diligence and having these organizational maturity conversations that I think really is what all this comes down to.

Amrit Ahluwalia (04:53):Absolutely. Well, I am curious, another point that you made in the session and that you just referenced here was that we really saw this explosion amplify through the pandemic. So how did the pandemic contribute to the expansion of the digital jungle for many higher ed campuses?

Josh Callahan (05:11):Just the speed at which we really had to complete a digital transformation for a lot of the business functions on campus where you were able to maybe get away with not being able to service students online for paying for this service or doing that service, and then all of a sudden it's like, Nope, everything's got to be online, so you've got to solve every problem. And often that came with, well, each of those had its own solution because there was something that popped up that was purpose built and that's going to be quicker to go with than trying to put limited programming times into adapting an existing solution to meet that particular need.

Amrit Ahluwalia (05:54):Absolutely. So speaking to the role of an institutional IT leader, then what role should the CIO, the CISO play in starting to streamline the tech stack of the colleges that they oversee?

Josh Callahan (06:08):I mean, I think everybody's doing this in one way or another, but we all need to really double down on just building good processes where people purchase technology through a curated process and they get presented to start with, here's the things that we already have, really start the conversation there and try to make it more about what problem I trying to solve then can you get me this particular package? The more it can be about requirements or about needs about fulfilling that business case and understanding that business case, the more likely it is that there's going to be something that the institution already has that could do 80, 85, 90 5% of what you need to do. And that may be workable. So it's worth the look at. And then once you get in, then you kind of have this three-legged stool of review where you've got to look at general IT supportability, this fit in with our architecture, can we do single sign on?

(07:09):Can we support this? And then accessibility. Are students going to be able to use this and not be hindered by our choice of this technology? And then third is the security piece where we're going to look at does this vendor have evidence of a solid security posture and will they agree to the currents and conditions that we need to protect the level of data that's being asked to do here? And I think where this organizational maturity concept comes in is a lot of us are different stages along that path, and a lot of us have been doing that as a one by one. We're going to look at this product and take it through and we're in that state. Again, going back to that jungle analogy where, okay, we're stepping back. There's a lot there. So really we've got to be thinking about adding these things in the context of what's already here and really trying to get to a point where you've got a set of products and services that you can support and compliment each other and integrate well with each other. And you can report on and build metrics against. And we'll get there, but that's definitely the work we need to have the two.

Amrit Ahluwalia (08:21):It's interesting as you kind of lay this out, it brings to mind EDU causes top 10 issues. Justin, obviously having ACIO, having a seat at the table, the tech leader having a seat at the table is a key topic for this year has been a key topic honestly for as long as I remember.

As you think about the effort of streamlining the tech stack of simplifying or navigating the digital jungle a little bit, how do those two things start to come together? How does the effort of creating a cohesive tech infrastructure align with the need for the CIO to play a bigger role in defining and piloting aspects of the institutional strategy?

Josh Callahan (09:10):It's more critical now than ever to have it and your IT leaders be treated as a strategic partner for the university leadership. I mean, you can't get to where you need to go as an institution without recognizing that at this moment in time, technology is just fundamentally embedded in every business function across a university in a way that it maybe wasn't 10, 12 years ago. But really now that when you start thinking about business continuity, is there any area on the campus that can really step back to just pen and paper solutions for any reasonable amount of time? And I think you find pretty quickly as you start to work through those plans that no, you're going to have to come up with some alternative process that still involves technology. So if you don't have your IT leadership who really fundamentally understands the promises and limitations of the tech solutions that are out there in the early part of these conversations, helping to shape what you can do with initiatives and how you go about fulfilling those and you're going to keep kind of painting yourself into corners that you can't get out of easily.

Amrit Ahluwalia (10:30):So you mentioned the importance of assessing accessibility as one of the foundations. One of the factors that a tech leader should be considering when they're looking at that streamlining process, and obviously now this presentation that I've referenced 12 times over the course of this conversation was about EDU causes a higher education community vendor assessment toolkit or hfa. How does the HFA help IT leaders make better choices when there are so many systems in so many vendors all occupying similar spaces in the post-secondary tech landscape?

Josh Callahan (11:10):I mean, the thing that I like about the heba that I talk about a lot about that toolkit is really it becomes a fulcrum to push forward a conversation about these issues on the campus because I think every campus has a different scale, different size, different point on their maturity progress, and so they're going to use it in a different way. But what's important is that you do these assessments, you need to do these assessments, and here's a tool that's not going to build the whole security program for you but is going to fit into that in a way that makes sense for your organization and ideally trigger that conversation that needs to happen. That's not just it. I mean, if we just do this in the security office or just in information technology larger, you're not going to be successful. But when you pull in your partners in procurement and in risk management and the data stewards who fundamentally become responsible for the risk level that the institution has, that risk appetite concept that I talk about a lot, that's really where you're going to see the value of having that broader campus conversation.

(12:31):Because really that's what it comes out to is we're always weighing the risk against the functionality that we need to perform the functions. And if that's done in isolation, you're going to miss things. But if it's a part of a broader conversation, and that's where I think the heck VAT has value in, okay, here's a standard thing that's going to come in from the different vendors that you're doing partners with, there's some quantification in there and there's a process built into that that then can fit into your overall procurement and vendor management process.

Amrit Ahluwalia (13:08):Absolutely. So to your mind, when a academic side leader wants to start a conversation with it around a particular need, potentially they have a tool that they really want to use, how do they start that conversation?

Josh Callahan (13:25):I think opening that conversation with your campus IT group, that could be you're talking to your CIO, it could be that there's kind of a dedicated liaison that's in your IT for your division, however that works on your campus. But I think the most productive and valuable way to start that off is going to be to stay focused on the requirements. What am I trying to do? What problem am I trying to solve? What functionality do we need to offer to our community that we're serving with this product? And then take the conversation from there. And it may be that you've seen a great demo and the product that you've seen is going to end up being the best fit that's out there, but be open to going through this process and thinking about how the technology that are available out there could be purpose built, could be a set of existing mixed use type of applications can best meet your requirements.

Amrit Ahluwalia (14:30):Well, Josh, I mean that pretty much does it on our end. And when we get to the end of an elimination episode, we pivot very, very quickly from being a higher education podcast to being a food podcast as you well know. So if someone is out to dinner in Humboldt County, California, where do they need to go for dinner?

Josh Callahan (14:53):There's so many good options. I think one of the best just, but also it's going to show you just a great part of the county would be Laup and Restaurant up in Trinidad, California.

They've got some amazing dishes and they actually make a mustard dill sauce that's available outside this region and markets. That's really good, especially on salmon. So if you can get your hands on Rabin sauce, I highly recommend it.

Amrit Ahluwalia (15:23):Josh, it's been a pleasure. Hey, thank you so much for taking the time out.

Josh Callahan (15:26):Yeah, happy to.