# Presentation: 197209

## Security Concerns in Electronic Procurement

- Barry C. West
- Office of Electronic Government barry.west@gsa.gov
- 202-208-3584
- web: www.egov.gov

**e-Gov Electronic Procurement**
**Conference**
**January 29, 2002**

## E-Government Management Initiative

***Vision:*****  **Deliver an **order of magnitude **improvement in the government’s value to the citizen
***Integral ******Part of President’s Management Agenda***
***Definition****:*  Using digital technologies to transform government operations in order to improve effectiveness, efficiency, and service delivery.
***The Principles:***
*** *****Citizen-centric, Market-based, Results-oriented**
** ****Simplify and Unify**

## E-Gov’t Services Landscape

- Internal
- Effectiveness and Efficiency

- Government to Government

- Government to Business

- Government to Citizen

## Policy Making 

**Telephone**

**-**

**Voice**

**-**

**Interactive**

**Fax**

**Kiosks**

**Face to**

**Face**

**Private/Public**

**Partnerships**

**Mail**

**E**

**-**

**system to**

**System**

***Access Channels***

- Policy Making

- Program Admin

- Compliance

**Consumer Safety**
**Environment Mgmt**
**Labor**
**Law Enforcement **
**Other Regulatory**

**Compliance (e.g.,  **

**Communications) **

**Tax Collection**
**Trade (Import/Export)**
**Transportation**

**Disaster Preparedness**

**Economic  Development**

**National Security, Foreign **

**Relations & Defense**

**Public Safety **

**Regulatory **

**–**

**Creation**

**Asset Mgmt**

**Defense & Nat’l Security Ops **

**Diplomacy **

**Disaster Response Management**

**Energy Production**

**Grants/Loans**

**Insurance**

**Permits/Licensing**

**Social Services: Monetary **

**Benefits, In-kind (Health,**

**-**

**Nutrition, & Housing), **

**Education **

**Recreation & Natural Resources**

**R&D & Science**

**Internal Operations / Infrastructure**

**HR **

**–**

**Finance (GL/AP/AR) **

**––**

**Travel **

**–**

**Supply Chain Mgmt (Procurement/Inventory **

**Cntl**

**/Logistics) **

**–**

**Admin **

***Lines of Business***

**Store**

**Query **

**Distribute **

**Analyze **

**Act **

**Learn **

***Underlying Processes / Value Chains***

**Web **

**Services**

**Capture**

**[ Order**

**Capture**

**Fulfill ]**

**Command & Control or Distributed Decision Making**

**Integrated Government-wide Business Architecture**

**Supply Chain Mgt**

**Notes:**
3 processes Revise Internal Operations – Underlying processes: 1. Capture, order, fulfillment; 2. Command and control
Simplify a process or Unify around a line of business
Info Value Chain, 

## PMC E-Gov Initiatives 

**Government to Citizen****	****	****	**

**Government to Government**
**	****	****	**

**Internal Effectiveness and Efficiency**

- 1.  USA Service
- 2.  EZ Tax Filing
- 3.  Online Access for Loans
- 4.  Recreation One Stop
- 5.  Eligibility Assistance
-      Online

- 1.  e-Vital (business case)
- 2.  e-Grants
- 3.  Disaster Assistance
-      and Crisis Response
- 4.  Geospatial Information
-      One Stop
- 5.  Wireless Networks

- 1.  e-Training
- 2.  Recruitment One Stop
- 3.  Enterprise HR	Integration
- 	e-Travel
- 	eClearance
- 4.  Integrated Acquisition
- 5.  e-Records Management

**PMC E-Gov Initiatives **

**Managing Partner**
- OPM
- OPM
- OPM
- GSA
- OPM
- GSA
- NARA

**Managing Partner**
- SSA
- HHS
- FEMA
- DOI
- DOJ

**Managing Partner**
- GSA
- Treasury
- DoEd
- DOI
- Labor

**Government to Business**
**	****	**

- 1.  Federal Asset Sales
- 2.  Online Rulemaking
-      Management
- 3.  Simplified and Unified
-      Tax and Wage Reporting
- 4.  Consolidated Health	** **
-      Informatics (business case)
- 5.  Business Compliance 1 Stop
- 6. Int’l Trade Process Streamlining

**Managing Partner**
- GSA
- DOT
- Treasury
- HHS
- SBA
- DOC

**Cross-cutting Barrier**:	e-Authentication GSA, Enterprise Architecture OMB

## What Selection Criteria Was Used?

## E-Gov’t Strategy: Solutions to Barriers Incorporates PKI

## Trust Online Is Critical

- Trust is the belief that ***Privacy*** and ***Security*** are being provided
- Demand that ***Recourse ***be available if something goes wrong
- Trust is aligned with** *****Brand or Name Recognition ***
- Consumers want ***Accountability, Ease of Use, ***and*** Responsiveness***
- Businesses want clearly assigned ***Responsibility**** *and ***Liability***

## Identity Credentials

- Paper-based Credentials
- Driver’s License
- Employee Id Cards
- Passport
- Birth Certificate
- Physical Presence
- Social Security Number
- Signature
- Electronic Credentials
- PIN/Password
- Digital Certificates (PKI)
- Smart Cards
- Biometric

- Trust

## When Do Web Interactions Need Authentication 

- Whenever Operations Exceed Risk Threshold
- Privacy protection - Knowing whom you are dealing prior to disclosing “sensitive” data
- User Authentication
- Knowing who your correspondent is
- Transaction Integrity - Ensuring the message sent is the message received
- Non-Repudiation
- Correspondent cannot deny conducting transaction
- Confidentiality
- Only authorized persons can read the message

## Managing Risk

- Agencies must assess security risk
- Three primary risks:
- Improper disclosure
- Program fraud
***Image of the Agency***
- Determining transaction risk
- Recommend an “appropriate” authentication mechanism for a given transaction
- Examine transaction flow and vulnerabilities
- Provide rough cost estimates

**Notes:**
Authentication and electronic transaction risk management

Improper Disclosure- Unauthorized access to private records.  Violation of the Privacy Act.
Program Fraud-Direct access to SSA systems which could allow someone to alter records.  Could impact payments, SSNs
Image-Public perception of risk and SSA’s ability to keep their information secure.

## Internet Increasingly Cited as Point of Attack

- CSI/FBI 2001 Computer Crime and Security Survey
- Source:  Computer Security Institute

- 2001: 384 Respondents/72%
- 2000: 443 Respondents/68%
- 1999: 324 Respondents/62%
- 1998: 279 Respondents/54%
- 1997: 391 Respondents/69%
- 1996: 174 Respondents/40%

**31**

**18**

**70**

## Dollar Losses by Type

- Source:  Computer Security Institute

- 2001: 273 Respondents/37%

**Active wiretapping**

**Telecom eavesdropping**

**System penetration**

**Sabotage**

**Denial of service**

**Insider net abuse**

**Laptop theft**

**Virus**

**Financial fraud**

**Telecom fraud**

**Theft of proprietary info**

**    ****Unauthorized insider access**

## PMC eAuthentication Initiative

**Simplify and Unify**
- Will serve all of the PMC approved E-Gov Initiatives and eventually business lines
- Assist other E-Gov initiatives in defining their identity proofing and authentication needs
- e-Authentication will tie into Firstgov
- Develop applications and reusable toolkits for cross-governmental use
- Coordinate aggregated buy of authentication products and services
- Promote interoperability with other entities like the Federal Bridge Certificate Authority

## Authentication ROI Study

- Standard methodology for agencies to use in projecting ROI when deploying strong authentication
- Synthesize findings from a comprehensive analysis of government and industry business cases and (ROI) studies
- Implications of the different cost models
- Delivery April 2002

## E-Authentication Vision

- Authentication Needs

**None**

**Strong**

- Solution Sets

**None**

**One-Time**
**Password**

**Single Sign On**

**Biometrics**

**PKI**

**User ID/**
**Passwords**
**PINS**

**Pen-based**
**Signature**

**Privileged Management**

**Digital Signature**

**Click-wrap**

- 22 e-Gov Initiatives

**Strong**

**Weak**

## eAuthentication Gateway

- Gateway

- Citizen

- Business

- Agent

- FBCA

- Identity
- Verification
- Required

- Identity
- Verification
- Not Required

- Credential
- Validation
- Process

## Citizens Authentication is Particularly Challenging

- Some populations (students, low-income) lack sufficient means for identity proofing credit history, permanent address, etc.
- Certain individuals object to divulging personal information (lack of trust in who and if adequately safeguarded)
- Cost and administrative complexity of the certificate issuance

## Leverage Investments in Risk and Authentication

- Social Security Administration
-  Risk Methodology and Privacy Board
- Access Certificates for Electronic Services (ACES) www.gsa.gov/aces
- Federal Bridge Certificate Authority
- Other PKI efforts: www.cio.gov/fpkisc
- Smart Common ID for employees
- Other Agency and Alliance Partner
- National Finance Center

## Risk Management Analysis

- How much will it cost to minimize the risk posed by the vulnerability?
- Are the security enhancements costs commensurate with the asset’s overall importance?
- How long will it take to implement fully the proposed security enhancement?

## ACES Concept

**ACES Concept**

- Common PKI solution encourages agencies to work together
- Allows equitable cost sharing among agencies
- Efficient, effective, economical due to aggregation of Federal needs
- One digital identity credential can be used by multiple Agency processes
- “Anonymous” certificate numbering for identification
- Public pays nothing for digital ID.

## Nat’l Institute of Standards and Technology (NIST) 

- ACES used for the electronic submission and review of proposals for the Advanced Technology Program (ATP)
- Uses digitally signed documents to send proprietary information over the Internet, digitally signs and encrypts forms, captures data and populates ATP database
- Uses a web server for downloads/ submission of forms and documents, then pulls them behind NIST and ATP firewall
- Pilot with 12 proposal submissions completed in Sept 2001
- Goes “live” for ATP’s FY2002 competition

## Social Security Administration (SSA)

- Piloting ACES Digital Signature Certificates for on-line annual wage reporting
- Following pilot, SSA had a 90 percent approval by the 100 businesses participating
- Automating W-2 submissions critical to agency where nearly 6.5 million employers submit over 240 million W-2 forms for their employees
- Continuing to expand pilot capabilities and implementing digitally signed forms

## PKI Interoperability

**PKI Interoperability**

-   Policy Interoperability involves the determination of “Trusted” PKI
-    domains which will meet the level of assurance needed.
-  Technical interoperability involves the validation of certificates form
-    a different PKI domain to determine validity of certificates and paths.
-   A small number of PKI domains makes it easier to achieve
-     interoperability --  **However it is still complex****!  **

**Trust **
**Domain 1**

**Trust **
**Domain 2**

**Trust**
**Domain 3**

- Certification Policies
- & Practices Statements
- Validation Protocols
- Bi-lateral Agreements

## The Solution: The Federal Bridge CA

**The Solution: The Federal Bridge CA**

- The Federal Bridge CA simplifies PKI interoperability:
-   Common and easy way to determine “Trusted” PKI domains and assurance levels (policy mapping);
-   Common and, relatively, easy way to validate certificate status through cross certification;
-   Standard Bi-lateral Agreement between the Bridge and Agency CA.

## In the future, what role does PKI play?

- e-Authentication initiative will organize authentication needs for critical government business lines
- PKI is not the answer for all the needs
- Cross-agency policy and support for interoperability exists for PKI but not for other authentication protocols
- PKI for strong authentication addresses mandates such as HIPAA and eSign
- Federal bridge CA facilitates unifying islands of automation

## Smart Common ID Card Regional GSA Program

- Issue Smart Cards to all Regional GSA Associates and Tenant Agencies
- Uses Smart ID Card Specification
- Phased approach w/program options
- Central card management system
- Federal Civic Center, Manhattan
- Javits Federal Building (26 Federal Plaza)
- 290 Broadway Federal Building
- 209 Centre Street Garage
- Future Phases: Other GSA Managed Buildings

## Sources of Help.......

- www.cio.gov/fpkisc
- www.smartcard.gov
- www.egov.gov
- http://csrc.nist.gov/publications/nistpubs
- www.gao.gov
- www.omb.gov
- www.sans.org
- www.utoronto.ca/security/policies.html

## How do we get there??

- Standards
- Interoperability
- Sharing of Lessons Learned & Best Practices
- Business Process Change Agents
- Training
- Planning budgets to reflect security requirements

## The keys in getting there..........

- The Vision: Enable e-Government through
- A cross-governmental, ubiquitous, interoperable Authentication Infrastructure
- Develop and reuse of applications which employ common multi-protocol authentication solutions in support of Agency business processes
- Leverage existing government-wide initiatives:
- Federal PKI Policy Authority
- Federal Bridge Certification Authority
- Recognize DoD, NFC, other credentials
- Access Certificates for Electronic Services
- Other authentication investments as appropriate

## Contact Information

- Barry C. West					Deputy Director				Office of Electronic Government	Office of Government-wide Policy	U.S. General Services Admin.		202-208-3584					barry.west@gsa.gov			www.egov.gov