{'fraction_non_alphanumeric': 0.025771555838370982, 'fraction_numerical': 0.0006363347120585428, 'mean_word_length': 5.325955734406438, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Security and Cost Considerations of Using Middleware to Facilitate SAS Integration

Middleware is “programming that serves to "glue together", mediate between, or enhance two separate and usually already existing programs” (see References). Middleware can be used to integrate SAS into web site functionality. However, there are security and total cost of ownership (TCO) considerations that must be considered in the design. This paper focuses on best practices and recommendations for securing the use of middleware and SAS within a multi functional interactive web site as well as identifying TCO issues related to support and maintenance of the design. A brief overview of the SAS data warehouse, benefits that the middleware infrastructure provides to the client community, and security challenges created by using a middleware/SAS infrastructure design are explored. The paper concludes with lessons learned and best practices for addressing middleware/SAS infrastructure security concerns. This topic is appropriate for analysts, managers, and technical staff concerned about the growing number of security issues and the impact those security issues have on providing service to the client community. INTRODUCTION Middleware has been used at the University of Memphis Office of Institutional Research (OIR) interactive web site for the last five years. The middleware was developed by an employee who was familiar with PERL programming. He was the sole knowledge repository for the PERL scripts and infrastructure design. Potential problems with security and infrastructure maintenance were created when the employee left the organization. With the departure of the knowledge repository and with the proliferation of viruses and worms beginning, several security challenges were created. The general design of the web site consists of a data warehouse which is the back end for interactive “table generator” reports as well as static reports. There is a secure access section which contains more sensitive information (i.e., average standardized test scores, course section grade distributions, and salary data). The site was designed to serve many internal and external customers. Internal clients include the provost, other administrators, faculty, students, and deans. The state board of regents, the press, recruiters, and potential students comprise the external customers. An easy-to-use web page allows the user to select table elements (i.e., page, row, column, and data elements) as well as options to sub-set the data being reported. Sub-setting options include, but are not limited to, demographic characteristics, semester(s), majors, and student classifications. When the customer clicks the submit button the web server passes the information to SAS. The middleware consists of PERL scripts that “glue” the web interface to the SAS programs that generate requested tables. The table generator process works in real-time by processing requests submitted via the website. SAS returns the data requested by the client in a nicely formatted web page showing the report and selection criteria. Applications Development SUGI 31