An Introduction to HRXML: Standards for Agile HR Services Delivery

1
An Introduction to HR-XMLStandards for Agile HR
Services Delivery

• Your name,Title

2
Agenda

• What are standards? Why are they needed for HR
  systems integration?
• How do standards cut integration costs?
• Trends HR Process improvements
• What is HR-XML? What is XML? What is Web
  Services? How do they shape the future of eHR?
• What is HR-XML working on? What has it
  accomplished?
• What are HR-XMLs localization plans?

3
The best standards are the ones you take for
granted.
Electricity. A common voltage and plug within
most countries known and standard means for
converting voltages and adapting plugs when
moving between countries.
4
Standards For Human Resources?

• HR is a heterogeneous environment a growing
  number of software and service offerings.
• This is a good thing! Having software and service
  choices is good for employers!
• HR was by-passed by early standardization
  initiatives (e.g., Finance, Purchasing,
  Insurance, Banking, Transportation)
• The lack of standards makes connecting different
  systems difficult and expensive

5
What Is Needed?

• A Standard business vocabulary
• HR-XML, a data interchange vocabulary for human
  resources
• Standard Implementation Frameworks
• Web Services

6
Typical HR Transactions TodayThe Spider Web
Employers
Job Boards
Recruiting Solutions
Staffing/Recruiting Cos.
HRMS Vendors
Other Recruiting Solutions
7
There Has to be a Better WayEnd-User Problems
Every time I add a new HR service provider, I
have to learn another set of conventions for
communication. Even though were using XML,
some of our trading partners arent using XML at
all, while other trading partners are using their
own flavor XML. I would like to try new HR
services, but setting up our database to work
with their systems is costly.
8
HR Transactions Tomorrow
Employers
Job Boards
Recruiting Solutions
Staffing/Recruiting Cos.
Standards
HRMS Vendors
Other Recruiting Solutions
9
Integration Costs and Opportunities

• Agile integration capabilities are not just a
  tactical requirement, they are a strategic
  necessity.
• Software continues to account for a mere 30 to 40
  percent of the cost of making HR solutions
  productive.
• Integration, customization, and maintenance cost
  account for the other 60 to 70 percent of the
  cost.
• Must deliver more for less. The expectations of
  clients and employees are not static.
• In their personal lives, employees conduct most
  Internet transactions in real time. Have HR
  processes kept up?

10
Process Improvements HR Trends

• Delivering manager self-service while ensuring
  uniform compliance with employer screening,
  testing, and selection policies.
• Giving managers and HR personnel access to an
  integrated collection of real-time information
  about candidates in the hiring process.
• Moving from paper, fax, and batch processes to
  real-time transactions.
• Flexibly, integrating best-of-breed hosted
  solutions with core HR systems.
• Reaching ROI faster by reducing the amount of
  custom work necessary for solutions to become
  productive.
• Outsourcing business processes without
  sacrificing access to information or convenience.

11
What is HR-XML?

• Independent, non-profit corporation (Dec 1999)
• Define freely available standard vocabularies to
  streamline HR data interchange
• Open to users, vendors, consultants, standards
  bodies, employers and other end-users, and
  individuals
• 100 organizational members
• International Mission to produce specifications
  that are relevant and useful in many countries.

12
What is XML?
XML is a recommendation issued by the World Wide
Web Consortium, Feb. 1998. Designed for the
Internet a language for creating markup
languages
Jane,Brown
CSV
NM1IL1BrownJaneMI123456
EDI
ltPgtltBgtJane Brownlt/Bgtlt/Pgt
HTML
XML
ltPersonNamegt ltGivenNamegtJanelt/GivenNamegt
ltFamilyNamegtBrownlt/FamilyNamegt lt/PersonNamegt
13
How XML Works
Program Asks for Data
Returns XML defining what is being
sent ltPersonNamegt ltGivenNamegtJohnlt/GivenNamegt
lt FamilyName gtSmithlt/FamilyNamegt lt/PersonNamegt
First John Last Smith
An XML document defines what the data is, not
how it is displayed. Programs parse this XML
data.
14
What Are Web Services?

• A framework for using XML (Not the only one, but
  a primary target).
• Web Services simplify the creation and
  integration of large-scale distributed systems.
• A web service is an URL-addressable software
  component can be integrated with other components
  via well-defined interfaces.
• Web services are implemented by sending and
  receiving XML messages specified by the web
  services.
• Web services content will be based on industry
  XML standards, such as HR-XML.

15
Where Does HR-XML Fit In?
Web Services Stack
Reliable Messaging

• Transport Layer
• Send/Receive HTTP

Security
Workflow

• SOAP Message Layer
• write/process SOAP envelope
• write/process SOAP body
• write/process SOAP header

• Data Layer (Payload)
• HR-XML, the data necessary for an interaction w/
  an HR trading partner.

16
A Loosely Coupled Approach
XML Request
Business Facade
ApplicationBusiness Logic
Listener
XML Response
17
Web ServicesWhat it means for eHR?

• Affordably and flexibly extend your service
  offerings.
• Effectively embed the intelligence encapsulated
  in a partners solution within your solution.
• Conversely, embedding your solution in that of a
  partner expands distribution channels for your
  services.
• Help eliminate 2-step processes multiple
  logins and processes that rely on e-mail.
• Provide seamless user experience.
• Improve functionality and content continuously
  without installing patches or impacting
  interface.
• Better support moving from batch to real-time.
• l

18
Extending The Life of Legacy Apps

• Your move to XML web services doesnt mean you
  have to replace everything.
• Web services often can be used to extend the life
  of legacy applications.
• Keep your existing application and data model,
  but upgrade the interface so that it can be
  addressed through a web services interface.

19
How is HR-XML Helping?

• HR-XML focuses on the XML content specific to the
  HR domain to use within web services.
• HR-XML also is releasing a series of Web Services
  Interoperability Guides. HR-XML profiles
  compose over WS-I profiles, leveraging the work
  weve done and adding industry-specific value.
  This is precisely the model weve been
  encouraging vertical industry organizations to
  pursue
• Tom Glover, IBM, President, Web Services
  Interoperability Organization.

20
HR-XML Today
A Broad Library of more than 100 XML schemas
Forthcoming Indicative Data Specification
designed for outsourcers.
21
HR-XML Chapters

• HR-XML Consortium Chapters put local funding and
  local expertise under local initiatives.
• HR-XML has two affiliate chapters
• HR-XML Consortium Japan
• HR-XML Consortium Europe
• HR-XML Consortium supports localization in a
  number of ways
• A localization architecture and related training
• Localization folders and logins within our schema
  repository and
• Mailing lists and archives to support local
  projects.

22
HR-XML Programming 2005

• A Stack of activities. Each level supports
  those above.
• Localization crosses all areas of programming.

Supporting Adoption
Localization
Creating Awareness of Standards And
Implementers Certification Level 1
Standards DevelopmentAnd Maintenance
23
1999-2003
Adoption
Standards Development
24
(No Transcript)
25
(No Transcript)
26
2006
27
Questions?
www.hr-xml.org

• chucka_at_hr-xml.org

28
Back Pocket SLIDES
29
Methodology
30
Organizational Structure
Board of Directors
Cross Process Object (CPO)
Recruiting
Benefits Enrollment
Indicative
Stock
Assessments
Screening
SIDES
Other Projects
Data Dictionary (HRDD)
31
New Projects

• BSC requirements
• Proposal in standard template
• 3 sponsor organizations
• 8 participants
• Resources identified for major roles

32
Project Methodology
33
Project Team

• Team lead is responsible for determining the
  schedule and facilitating the project.
• Secretary records all decisions and posts minutes
  to team web page.
• Schema editor makes schema changes and provides
  graphical illustrations.
• Document editor responsible for consolidating
  documentation.
• Domain experts share knowledge of the business
  process, enabling team to build a comprehensive
  standard.
• Liaisons coordinate activity between different
  workgroups and other standards bodies.

34
Maintenance

• Team lead is responsible for determining the
  schedule and facilitating the project.

35
Model Business Process

• Describe general business process
• Identify roles and responsibilities
• Identify interaction points
• Use a UML activity diagram
• NOT a prescriptive standard for the business
  process!

36
Model Interactions Between Partners
37
HR-XML Certification
38
HR-XML Certificationwww.hrcertify.org

• Launched in Oct. 2003. One of the most successful
  certification programs launched by an XML group!
• Level 1 certification focuses on valid and
  semantically appropriate use of HR-XML schema.
• The key accomplishment for Level 1 has been to
  create awareness of HR-XML standards and
  implementers. Level 2 will focus on supporting
  interoperability.
• More than 39 organizations have certified HR-XML
  implementations
• HR decision makers are using HR-XML certification
  as procurement and partnering criteria.

39
Level 1 39 Certified Organizations
40
(No Transcript)
41
Certification Steps

• Can be accomplished in a few days
• Pretest on http//testbed.hr-xml.org
• Submit certification request form
  (www.hrcertify).
• Be prepared to tell us how you use the
  specification whether you use extensions and
  whether your solution is actually
  implemented/commercially available.
• You provide us with 5 XML instances for each
  schema.
• We test validity examine semantics.
• Extensions are okay if you use HR-XML UserArea.
• We work together to draft a conformance statement
  to be published on www.hrcertify.org
• HR-XML Board of Directors Reviews and Approves

42
Certification Benefits

• 2 years of Benefits unmatched by any other HR
  sponsorship opportunity!
• Certified organizations are
• Able to satisfy customer and partner requirements
  for HR-XML conformance.
• Awarded use of the HR-XML Consortium Certified
  logo.
• Recognized on http//www.HRcertify.org.
• Given HR-XML Certified placards for trade
  shows.
• Included in marketing collateral distributed at
  HR trade shows.

43
More Benefits

• Recognized in a press release with other
  certified organizations.
• Announced on HR-XML's 6,000 self-subscribed
  announcement list and a media list of 100
  reporters/analysts.
• Recognized in HR-XMLs re-branded, re-designed
  trade show booth.
• Assurance across multiple parser environments.
• Access to HR-XMLs knowledge specialists.

44
Certification Pointers

• To get the maximum benefit from your
  certification
• Pre-test on http//testbed.hr-xml.org
• Involve both a technical lead and a marketing
  lead.
• Consider amplifying the Consortiums announcement
  of your certification with your own press
  release.
• Deploy the HR-XML Certified logo on your website
• Display an HR-XML Certified placard at your trade
  show booth.
• Make sure your sales and marketing staff, trade
  show personnel, know of the certification and
  what it means.

45
Integration Costs
46
The n(n-1) Problem Before
OAGI (www.openapplications.org) has a
mathematical model for sizing the effort required
to maintain an unbounded growth of
interfaces. The number integration points between
objects (assumes two way integration) grows at a
rate of n(n-1). 4 components 12 interfaces
10 components 90 interfaces20 components
380 interfaces The formula looks like this For
n 20 components 20(20-1) 380. Multiply 380
times 0.025 FTEs (a half-day per month). The
effort required to maintain the interfaces for 20
software components could be 9 fulltime
equivalent persons. White Paper Plug and Play
Business Software Integration The Compelling
Value of the Open Applications Group,
http//www.openapplications.org

47
The n(n-1) Problem After
Going from many-to-many to many-to-one
dramatically reduces integration costs. The
formula is simplified to a flat n 2. For n
20 components 20 2 40. Where 40 is the
minimum number of connections between 20 software
components. Multiply 40 times 0.025 FTEs and the
result is 1.0 FTEs. White Paper Plug and Play
Business Software Integration The Compelling
Value of the Open Applications Group,
http//www.openapplications.org

48
Tools Of The Trade
49
Working With HR-XML

• Altovas XML Spy and Tibcos Turbo XML are XML
  editors frequently used within HR-XML.
• Many other XML editors / tools available.
• All HR-XML schemas validated against
• XML Spy, TurboXML, MSXML, Stylus Studio, Oracle,
  and Xerces XML tools

50
Notation In HR-XML Docs

• Elements displayed as rectangles, attributes as
  round-edged rectangles.
• Lines connecting the elements represent the
  relationships between elements.

51
Notation In HR-XML Docs Cardinality
52
Document Management

• TIBCOs XMLCanon repository to store all
  documents in a central location.
• Administrator gives access to team members based
  on their roles, following the consortium security
  procedures.
• Files checked in and out of repository, ensuring
  most current files are available to team members.
• All members have access to view and download
  files.

53
Canon Repositoryhttp//schemas.hr-xml.org8181/
54
What is the Data Dictionary?

• Catalogue of all Vocabularies used in HR-XML
  Schemas.
• Allows consistent use of vocabularies
• Reduces development time due to reuse of
  components
• Contains detailed information for Elements and
  Attributes
• Includes Generic and Contextual Definitions
• Tools
• http//testbed.hr-xml.org/tools/DataDictionary/
• Users Guide
• http//schemas.hr-xml.org8181/Consortium/DataDict
  ionaryUserGuide.doc

55
HR Data Dictionary View
56
Data Dictionary Continued
57

• Localization Architecture

58

Basic Concepts

• Two related, but distinct concepts
• Localization involves accommodations for legal or
  business-practice requirements unique to a
  particular country or jurisdiction.
• Internationalization involves designing
  specifications so that they can be re-used
  broadly across jurisdictions.
• HR-XML has an interest in both.

59
Localization Principles

• Localization is an extremely complex topic.
• HR-XML will strive to re-use relevant standards /
  best practices.
• Above all HR-XML will strive to keep our
  architectural approach simple.

60
HR-XML Localization Major Architectural
Components

• Two broad areas address by HR-XMLs localization
  architecture are
• Presentation of languages.
• Handling local content (new semantic components)
  designed around distinct local legal requirements
  and business practices.

61
Presentation of Languages

• A principal way HR-XML addresses presentation of
  languages is through xmllang, a data type
  defined by the W3C.
• xmllang references IETF RFC 3066, which in turn
  draws upon ISO standards, such as ISO 639.
• Allows the capture of language with
  cultural/country contexts.
• Examples de en-UK en-US fr-CA es-MX
• Even handles dialects en-cockney and
  Klingon tlh.

62
Presentation of Languages HR-XML Design Rules

• HR-XML Design guidelines
• xmllang should be an attribute available on the
  root element of every major HR-XML schema.
  (Enforcing this policy with this summers
  release.)
• Workgroups might want to use xmllang on specific
  components within a schema that need to be
  presented in multiple languages. Guidelines
• Using xmllang only on the root element or only
  on major repeatable elements up toward the
  trunk is the simplest approach. We like simple
  approaches!
• Only makes sense for descriptive,
  non-programmatically handled components.
• In document types with a significant amount of
  language dependent text, workgroups must consider
  at what point does the complexity of specifying
  xmllang on individual components out weigh the
  benefit derived.

63
Handling Local Content

• Local Schema Content Required as a result of
  legal, cultural, or business-practice
  requirements unique to a particular country or
  jurisdiction. Examples U.S. health care benefits
  enrollment.
• Localization architecture needs to address
• How to distinguish / store / manage local
  content.
• XML schema design approaches.

64
How to store and manage local content

• XML Canon Our web accessible repository
• Organized in folders/directories

• 2_3 (root for next release)
• DublinCore
• HR-XML-2_3
• Assessment
• CPO
• Enrollment
• Metrics
• Payroll
• Screening
• SEP
• SIDES
• Stock
• TimeCard
• OAGIS
• W3C

65
How to work locally?

• 2_4
• DublinCore
• HR-XML-2_4
• Assessment
• US
• DE
• JP
• CPO
• Enrollment
• Metrics
• Payroll
• Screening
• SEP
• SIDES
• US
• DE
• JP
• Stock
• TimeCard

Add local folder to each project !!!In 2_4
Release!!!
66
XMLCanon Document Repository

• Where is it
• http//schemas.hr-xml.org8181
• How to use is it
• http//schemas.hr-xml.org8181/xc/canon/TSC/XML_Ca
  non_Usage_Notes-2_1.doc

67
LocalizationXML Schema Design Choices

• At design time
• xsdchoice
• xsdunion (for enumerated values)
• After design time UserArea

68
Localization Enrollment example
69
Localization Enrollment example

• Lets see the code .

70
Localization Payroll example
71
Localization Payroll example

• An alternative for enumerated lists only
• Lets see the code .

72
Localization

• Benefits of this design
• Satisfies 4 design principles simple, simple,
  simple, and simple
• Future proof
• TPA friendly
• Drawbacks
• Need to know where to localize at schema
  design time. Implication -gt JAW and
  coordination between local initiatives is critical

73
HR-XML Data Dictionary

• How might we support localization?
• English is official language for our
  specifications. Japanese have translated SIDES.
  How might our Data Dictionary support other
  languages?

74
Questions?
www.hr-xml.org
75

• Localization Goals and Strategy

76
European Interest in HR-XML
www.HR-XML.org Website Hits Jun. -
Sept. 2003
Austria 15,258
Belgium 11,761
France 18,766
Germany 31,279
Italy 8,445
Netherlands 35,053
Poland 1,922
Spain 2,856
Sweden 6,964
Switzerland 4,733
UK 21,197
77
Localization/Internationalization

• The leadership of the HR-XML Consortium believes
  that locally funded and directed chapters are
  important to achieving the Consortiums
  Localization and Internationalization goals.
• These are two related, but distinct concepts
• Localization involves accommodations for legal or
  business-practice requirements unique to a
  particular country or jurisdiction.
• Internationalization involves designing
  specifications so that they can be re-used
  broadly across jurisdictions.
• HR-XML has a clear interest in both localization
  and internationalization.
• Localization activities are proceeding around the
  World in the France Japan, Germany,
  Netherlands, Russia, Sweden, and the United
  States.
• Interest in localization activity from China,
  South Africa, Australia, India, and other areas.

78
HR-XMLs Opportunities/Challenges In Europe

• Opportunities
• Significant European interest and influence in
  HR-XML.
• Much success in modeling components in
  generalized ways that can be used flexibly across
  borders (e.g., PersonName, PostalAddress, etc.).
• HR-XML has a record of progress at the five
  HR-XML meetings held in Europe during HR-XMLs
  four-year history.
• There are a growing number of HR-XML-related
  projects/implementations within Europe.
• Challenges
• Knowledge of legal requirements and business
  practices within specific European countries is
  not consistently reflected in HR-XML schemas or
  discussions.
• The growing number of European localization
  initiatives are not coordinated.
• Differences in language, culture, and time-zones
  present HR-XMLs existing staff with obstacles to
  integrating local knowledge into specifications.
• Lack of local resources (consultants or
  employees) hinders the process of integrating
  localizations into unified architecture.

79
European Chapter Goals

• Ensure that local requirements and subject-matter
  expertise are leveraged wherever possible to
  strengthen core HR-XML standards.
• Coordinate the proliferating number of
  localization initiatives within Europe.
• Expand the market awareness and adoption of the
  HR-XML standards across Europe.
• Deliver better service to European HR-XML members
  and European organizations adopting HR-XML
  standards.
• Facilitate regular European meetings and project
  conference calls and to host an annual European
  meeting of entire HR-XML Consortium.
• Implement localizations and extensions within a
  unified architecture.

80
HR-XML Chapters Key Elements

• Goal of funding local resources for localization
  and international coordination work
• A separate organization established as
  appropriate under local law. Funded as
  appropriate under local law/business practice.
• A separate organization operating under a
  Affiliate Chapter or similar agreement with the
  HR-XML Consortium.
• Local chapters would engage local
  consultants/resources to assist with technical
  coordination and local promotion of HR-XML
  specifications.
• HR-XML and local chapter would exchange
  intellectual property rights. Local chapter would
  be granted rights to HR-XML name and
  specifications, HR-XML would be granted rights to
  derivative works by local chapters.

81
Proposed Joint Architecture Workgroup

• Each chapter would contribute local staff/member
  representatives to a Joint Architecture
  Workgroup or similar committee tasked with
  technical coordination of HR-XML localization
  activities.
• A primary goal of the Joint Architecture
  Workgroup would be deploying and maintaining
  localized schemas and components within a unified
  architecture.
• Chapter representatives serving on the Joint
  Architecture Workgroup would receive training on
  HR-XMLs schema design guidelines, localization
  architecture, and schema repository.
• The Joint Architecture Workgroup also would help
  identify content, design, and architectural
  issues to be resolved by HR-XML Chapters and/or
  Workgroups or by the HR-XMLs Cross-Process
  Objects Workgroup or Technical Steering Committee
  as appropriate.

82
HR-XML Repository

• The HR-XML core library is large and
  interdependent and grows with each calendar
  quarter.
• A common repository for schemas is key tool for
  coordination between local chapters and HR-XML.
• If you are working on localizations outside of
  HR-XMLs web-accessible schema repository, you
  simply are not working with HR-XML.

83
HR-XML Repository

• HR-XML will update its repository structure to
  accommodate localizations.
• Repository structure will allow localizations to
  build upon HR-XML Cross Process Objects and other
  core schemas.

84
Managing Localizations

• Multiple country-specific communities of
  interest will contribute localized content into
  a common repository.
• These communities of interest are related to
  HR-XML by virtue of a membership with the HR-XML
  Consortium or a local Chapter.

HR-XML Repository
Localizations by ChapterMembers
ECP.NL Dutch SIDES Extensions
Swedish National Labour Market Administration
(AMV)

SIDES France
Bundesanstalt für ArbeitGerman Employment
Service
SIDES Japan
US Healthcare Benefits
85
Lest we forget

• The HR-XML Consortium recognizes that
  country-specific employment, tax, and social
  insurance laws combined with varying business
  practices make localization necessary
• However, a principal goal is to use the
  requirements and work of local groups to
  strengthen core HR-XML specifications wherever
  possible.
• Consider that most of the recommendations made by
  HR-XMLs SIDES France group were changes to
  HR-XMLs core schemas and were not localizations.

86
Pragmatism/Stability

• HR-XML has always pursued its work with a sense
  of urgency, combined with a concern for quality.
• HR-XML desires to remain nimble enough to produce
  specifications in demand by member organizations
  within just a few months. However, the extent of
  interdependencies within the library makes it
  increasingly difficult to modify one portion of
  the library without affecting another portion of
  the library.
• As a consequence of these library
  interdependencies the HR-XML Consortium is
  examining the adoption of a new release policy.
• In addition to providing predictability and
  stability to the current scope of HR-XMLs work,
  the release policy could be leveraged in
  providing a flexible framework for building and
  managing localizations.

87
Proposed Release Policy

• Deliver a reconciled release no more frequently
  than every 2 years. These releases are holistic
  all relevant work brought up to the current level
  of Cross Process Objects and architecture
  requirements.
• A reconciled release is available from and
  supported by the consortium for at least 6 years
  after its release.
• Point releases come as needed between reconciled
  releases.
• Point releases are not necessarily internally
  consistent across work groups or across HR-XML
  local chapters.

88
Release Policy / Localization

• Both point and reconciled releases would include
  localized content.
• The point releases provide HR-XML chapters a
  flexible means to quickly to publish
  specifications of local interest.
• Reconciliation will be an on-going goal among
  HR-XML and its Chapters.
• Point releases will be assimilated as necessary
  in reconciled releases.

89
An 18-Month Reconciliation Proposal

• HR-XMLs chapter formation activities come at a
  time when the Consortium also is evaluating a
  comprehensive, reconciled release.
• A first reconciled release could be scheduled as
  early as June 30, 2005.
• This gives us sufficient but not abundant time
  to accommodate requirements from HR-XMLs
  growing number of localization initiatives within
  a unified architecture and reconciled release.

90
Reconciliation Plan Other Key Elements

• The project will rely on multi-jurisdictional
  contributions.
• The HR-XML Joint Architecture Workgroup would
  facilitate the process of deploying localized
  schemas and components within the common
  repository and release package(s).
• HR-XML Consortium Europe with the assistance of
  other HR-XML Consortium resources will broker
  agreements as necessary between participating
  parties/organizations in Europe.
• HR-XML Consortium meetings and Chapter meetings
  will be leveraged as necessary to work on
  reconciliation topics.

91
Questions?
www.hr-xml.org
92
Stepping Up To WS-SecurityStandards for Agile HR
Services Delivery

• Chuck Allen,Director, HR-XML Consortium

93
Agenda

• Security and the Internet, A brief history.
• Concepts Point-to-Point vs. Message Level
• Distributed Computing It is here!
• WS-security in HR-XML WS Implementation Guides

94
Internet Security SSL

• Secure Sockets Layer Protocol (SSL) developed by
  Netscape in 1994 in response to the growing
  concern over security on the Internet.
• Successfully secured billions of
  browser-to-server commercial transactions! There
  would be no e in e-commerce without SSL.
• Adapted to support other computer-to-computer
  data transfers e.g., transport layer security
  (TLS).
• The most common means today for providing
  confidentiality for XML while it is in transit
  across the Internet.

95
Point-To-Point Security
When Security Is At Just The Transport Level
Security Context
Security Context
Requester
Intermediary
Service Provider
96
Message Level Security
When Security Is Goes Along With The Message
Security Context
Requester
Intermediary
Service Provider
97
Why Worry?

• The way HR does business has changed
  dramatically.
• HRs embrace of e-business, outsourcing, and
  ASP-model services means that work is more
  distributed than ever before.
• Find a process that doesnt involve an
  intermediary?
• HR data by its very nature usually consists of
  personal identifying information.
• The data contained in common HR transactions
  would server well as the complete identity-theft
  starter kit.
• Identity theft is on the rise being carried out
  by individuals and criminal organizations.

98
Why Worry?

• What could you lose if employee data that was not
  secured at the message level was targeted by an
  attacker at one of your business partners or
  other intermediary?
• Can you afford to risk a breach? What is the
  trust and confidence of your employees and
  customers worth?
• You should work business partners with solid
  security programs, but you cant put yourself in
  the position of managing those programs or
  individually vetting their adequacy.
• Consider Egghead Software. For this one-time
  first-to-market leader, a scandal surrounding the
  theft of customer credit card was the last straw.
  As customer confidence crumbled, Egghead was
  forced to declare bankruptcy.