# Presentation: 385717

## The Need for Trusted Credentials

- Information Assurance in Cyberspace

**Judith Spencer**
**Chair, Federal PKI **
**Steering Committee**
**www.cio.gov/fpkisc**

**Notes:**
Logo: Blue stars and 5 USA flags.
This logo is displayed on all pages.

## Doing Business with the Public Today

**Doing Business with the Public Today**

- Face to Face

- Telephone

**IRS Form 1040**

- Line 32. . . . . . . . . . . . . . . . . . . . . . . . . . . . .  $98,765

- Written Request

**JaneQSmith**

**Notes:**
“Face to Face” has a pictured ID of a woman and a man & woman looking over a document (clip art).
“Written Request” has an opened envelope & letter as well as a woman opening another envelope (clip art).
“Telephone” has a woman looking at a piece of paper with a telephone to her ear (clip art).

## Defining the Risk

- Factors

- Privilege Management

**Signature**
**Required**

**Identity**
**Verification**
**Required**

**Identity**
**Verification**
**Not**** ****Required**

**Low Risk**

**High Risk**

**General**
**Information**

**Change**
**Request**

**Benefits**
**Application**

**Personal**
**Information**

**Proprietary**
**Information**

**Defining the Risk**

- Business Processes

**Notes:**
An arrow labeled “Business Processes” is going from Low Risk (Factors) to High Risk (Privilege Management).

## Are There Levels of Trust?

**No confidence** is placed in the asserted real-world identity of the client or no real-world identity is asserted.
- On the **balance of probabilities**, the registrant’s real-world identity is verified.
- There is **substantial assurance** that the registrant’s real-world identity is verified.
- The registrant’s real-world identity is verified **beyond reasonable doubt**.

*Courtesy of the UK Government, Office of the E-Envoy*

## Types of Evidence

- Personal statement.
- Individual provides personal data about him/herself
- Documentary evidence.
- Individual provides collateral documents to confirm the information provided.
- Third party corroboration.
- A trusted entity that can confirm information provided.
- Biometrics.
- Physical evidence tying individual to the asserted identity.
- Existing relationship.
- Individual’s previous interactions with the registration agent.  (e.g. Bank customer)

*Courtesy of the UK Government, Office of the E-Envoy*

## Doing Business with the Public Tomorrow

- Statutory Requirement to offer an electronic option:
- Government Paperwork Elimination Act, October 1998
- Commitment to on-line government
- Public electronic access by October 2003

**. . . A signature may not be denied legal effect simply because it is electronic. . . **

**Notes:**
A picture of a woman typing on the keyboard with a PC monitor on the desk (clip art).

## Your Choices

- Automated Telephone Interaction
- E-mail interaction
- Web services

## What are Web Services?

- Until now Web-based interactions were:
- Browsing of linked documents
- Manually initiated transactions and purchases
- Downloading files
- All initiated manually via a Web browser
- Web Services is a new model for using the Web:
- To automatically initiate processes via the Web
- Method for describing, publishing, promoting, registering, and initiating processes dynamically in a distributed environment
- New ways of using the web, including intelligent agents, marketplaces and auctions
- And. . . Not necessarily using a Web browser!

## Today’s E-Government Requirements

- Government agencies need to innovate at an ever increasing pace
- E-Government success requires broad interoperability
- Within an enterprise
- Between business partners
- Across a heterogeneous set of platforms, applications, and programming languages
- Internet technologies are assumed, Interoperability is required
- E-Government platforms enable more rapidly developed interoperability

## But . . .

- Without trust and security Web Services are dead on arrival

**Notes:**
A picture of a tree, graveyard site, and a full moon in black (clip art).

## A Note on Achieving Security

- There is no such thing as “Security”!
- There are risks, and there are countermeasures
- Security as an absolute is unachievable
- A good Security plan should:
- Assess security requirements
- Assess security risks
- Consider end-to-end security needs, not just between services
- Identify available countermeasures
- Implement appropriately considering investment

## This is Security

**This is Security**

**Notes:**
A photo of a castle in the middle of a body of water.

## Facets of Building Trust

| Facet | Description |
| --- | --- |
| Identification | Who are you? |
| Authentication | How do I know you are who you claim to be? |
| Authorization | Are you allowed to perform this transaction? |
| Integrity | Is the data you sent the same as what I received? |
| Confidentiality | Are we sure no one else read the data you sent? |
| Auditing | Record of transactions to assist in looking for security problems? |
| Non-repudiation | Can you prove the sender sent it, and the receiver received the identical transaction? |

*Thanks to Karl Best, Director of Technical Operations, OASIS*

## Facets of Building Trust

| Facet | Description |
| --- | --- |
| Identification | Who are you? |
| Authentication | How do I know you are who you claim to be? |
| Authorization | Are you allowed to perform this transaction? |
| Integrity | Is the data you sent the same as what I received? |
| Confidentiality | Are we sure no one else read the data you sent? |
| Auditing | Record of transactions to assist in looking for security problems? |
| Non-repudiation | Can you prove the sender sent it, and the receiver received the identical transaction? |

*Thanks to Karl Best, Director of Technical Operations, OASIS*

## But . . . What About Identity Assurance in Cyberspace?

- No Physical Presence
- No Photo ID
- No Physical Document with Signature
- No Human Voice

- On the Internet,
- Nobody Knows
- You're a Dog!

## A Few Facts

- The Internet is perceived as being inherently anonymous
- In order to conduct trusted transactions, we must know with whom we are dealing
- Knowledge must be within reasonable risk limits
- Trusted electronic credentials provide the means to link an asserted identity in the electronic medium to physical credentials

## Preconditions for Credential ‘Trustworthiness’

- Unique to the person using it
- Under the sole control of the person using it
- Capable of verification
- Credential Pedigree
- Institutional Standing of the Provider
- Governance
- Establishment of Identity
- Credential Control

## E-Authentication Will:

- Evaluate Electronic Credential Providers
- Apply a common set of universally understood Assurance Levels
- Provide a tool for performing Risk Assessment
- Interact with FirstGov portal and Agency business processes to broker identity assurance
- Provide the public with a single sign-on capability and a common interface for doing electronic transactions with government through the Gateway

## Assessing the Need

- Perform Transaction-level Risk Assessment on your e-Government process
- Review OMB e-Authentication Guidance
- Choose the e-Authentication assurance level that meets your needs
**Then**
- Work with the e-Authentication team to ensure Gateway interoperability

## Thank You

**For your Time & Attent****ion**