# Presentation: 346388

## Federal Approach to Electronic Credentials

- For services to citizens, businesses, other governments, and employees

- Mary J. Mitchell
- Office of Electronic Government mary.mitchell@gsa.gov
- 202 501-7092web: egov.gov

**AFCEA **
**January 23, 2002**

## E-Government Management Initiative

***Vision:*****  **Deliver an **order of magnitude **improvement in the government’s value to the citizen
***Integral ******Part of President’s Management Agenda***
***Definition****:*  Using digital technologies to transform government operations in order to improve effectiveness, efficiency, and service delivery.
***The Principles:***
*** *****Citizen-centric, Market-based, Results-oriented**
** ****Simplify and Unify**

## E-Gov’t Services Landscape

- Internal
- Effectiveness and Efficiency

- Government to Government

- Government to Business

- Government to Citizen

## Policy Making 

**Telephone**

**-**

**Voice**

**-**

**Interactive**

**Fax**

**Kiosks**

**Face to**

**Face**

**Private/Public**

**Partnerships**

**Mail**

**E**

**-**

**system to**

**System**

***Access Channels***

- Policy Making

- Program Admin

- Compliance

**Consumer Safety**
**Environment Mgmt**
**Labor**
**Law Enforcement **
**Other Regulatory**

**Compliance (e.g.,  **

**Communications) **

**Tax Collection**
**Trade (Import/Export)**
**Transportation**

**Disaster Preparedness**

**Economic  Development**

**National Security, Foreign **

**Relations & Defense**

**Public Safety **

**Regulatory **

**–**

**Creation**

**Asset Mgmt**

**Defense & Nat’l Security Ops **

**Diplomacy **

**Disaster Response Management**

**Energy Production**

**Grants/Loans**

**Insurance**

**Permits/Licensing**

**Social Services: Monetary **

**Benefits, In-kind (Health,**

**-**

**Nutrition, & Housing), **

**Education **

**Recreation & Natural Resources**

**R&D & Science**

**Internal Operations / Infrastructure**

**HR **

**–**

**Finance (GL/AP/AR) **

**––**

**Travel **

**–**

**Supply Chain Mgmt (Procurement/Inventory **

**Cntl**

**/Logistics) **

**–**

**Admin **

***Lines of Business***

**Store**

**Query **

**Distribute **

**Analyze **

**Act **

**Learn **

***Underlying Processes / Value Chains***

**Web **

**Services**

**Capture**

**[ Order**

**Capture**

**Fulfill ]**

**Command & Control or Distributed Decision Making**

**Integrated Government-wide Business Architecture**

**Supply Chain Mgt**

**Notes:**
3 processes Revise Internal Operations – Underlying processes: 1. Capture, order, fulfillment; 2. Command and control
Simplify a process or Unify around a line of business
Info Value Chain, 

## PMC E-Gov Initiatives 

**Government to Citizen****	****	****	**

**Government to Government**
**	****	****	**

**Internal Effectiveness and Efficiency**

- 1.  USA Service
- 2.  EZ Tax Filing
- 3.  Online Access for Loans
- 4.  Recreation One Stop
- 5.  Eligibility Assistance
-      Online

- 1.  e-Vital (business case)
- 2.  e-Grants
- 3.  Disaster Assistance
-      and Crisis Response
- 4.  Geospatial Information
-      One Stop
- 5.  Wireless Networks

- 1.  e-Training
- 2.  Recruitment One Stop
- 3.  Enterprise HR	Integration
- 	e-Travel
- 	eClearance
- 4.  Integrated Acquisition
- 5.  e-Records Management

**PMC E-Gov Initiatives **

**Managing Partner**
- OPM
- OPM
- OPM
- GSA
- OPM
- GSA
- NARA

**Managing Partner**
- SSA
- HHS
- FEMA
- DOI
- DOJ

**Managing Partner**
- GSA
- Treasury
- DoEd
- DOI
- Labor

**Government to Business**
**	****	**

- 1.  Federal Asset Sales
- 2.  Online Rulemaking
-      Management
- 3.  Simplified and Unified
-      Tax and Wage Reporting
- 4.  Consolidated Health	** **
-      Informatics (business case)
- 5.  Business Compliance 1 Stop
- 6. Int’l Trade Process Streamlining

**Managing Partner**
- GSA
- DOT
- Treasury
- HHS
- SBA
- DOC

**Cross-cutting Barrier**:	eAuthentication GSA, Enterprise Architecure OMB

## E-Gov’t Strategy: Solutions to Barriers Incorporates PKI

## Trust Online Is Critical

- Trust is the belief that ***Privacy*** and ***Security*** are being provided
- Demand that ***Recourse ***be available if something goes wrong
- Trust is aligned with** *****Brand or Name Recognition ***
- Consumers want ***Accountability, Ease of Use, ***and*** Responsiveness***
- Businesses want clearly assigned ***Responsibility**** *and ***Liability***

## Identity Credentials

- Paper-based Credentials
- Driver’s License
- Employee Id Cards
- Passport
- Birth Certificate
- Physical Presence
- Social Security Number
- Signature
- Electronic Credentials
- PIN/Password
- Digital Certificates (PKI)
- Smart Cards
- Biometric

- Trust

## When Do Web Interactions Need Authentication 

- Whenever Operations Exceed Risk Threshold
- Privacy protection - Knowing whom you are dealing prior to disclosing “sensitive” data
- User Authentication
- Knowing who your correspondent is
- Transaction Integrity - Ensuring the message sent is the message received
- Non-Repudiation
- Correspondent cannot deny conducting transaction
- Confidentiality
- Only authorized persons can read the message

## Managing Risk

- Agencies must assess security risk
- Three primary risks:
- Improper disclosure
- Program fraud
***Image of the Agency***
- Determining transaction risk
- Recommend an “appropriate” authentication mechanism for a given transaction
- Examine transaction flow and vulnerabilities
- Provide rough cost estimates

**Notes:**
Authentication and electronic transaction risk management

Improper Disclosure- Unauthorized access to private records.  Violation of the Privacy Act.
Program Fraud-Direct access to SSA systems which could allow someone to alter records.  Could impact payments, SSNs
Image-Public perception of risk and SSA’s ability to keep their information secure.

## Internet Increasingly Cited as Point of Attack

- CSI/FBI 2001 Computer Crime and Security Survey
- Source:  Computer Security Institute

- 2001: 384 Respondents/72%
- 2000: 443 Respondents/68%
- 1999: 324 Respondents/62%
- 1998: 279 Respondents/54%
- 1997: 391 Respondents/69%
- 1996: 174 Respondents/40%

**31**

**18**

**70**

## Dollar Losses by Type

- Source:  Computer Security Institute

- 2001: 273 Respondents/37%

**Active wiretapping**

**Telecom eavesdropping**

**System penetration**

**Sabotage**

**Denial of service**

**Insider net abuse**

**Laptop theft**

**Virus**

**Financial fraud**

**Telecom fraud**

**Theft of proprietary info**

**    ****Unauthorized insider access**

## PMC eAuthentication Initiative

**Simplify and Unify**
- Will serve all of the PMC approved E-Gov Initiatives and eventually business lines
- Assist other E-Gov initiatives in defining their identity proofing and authentication needs
- e-Authentication will tie into Firstgov
- Develop applications and reusable toolkits for cross-governmental use
- Coordinate aggregated buy of authentication products and services
- Promote interoperability with other entities like the Federal Bridge Certificate Authority

## Authentication ROI Study

- Standard methodology for agencies to use in projecting ROI when deploying strong authentication
- Synthesize findings from a comprehensive analysis of government and industry business cases and (ROI) studies
- Implications of the different cost models
- Delivery April 2002

## E-Authentication Vision

- Authentication Needs

**None**

**Strong**

- Solution Sets

**None**

**One-Time**
**Password**

**Single Sign On**

**Biometrics**

**PKI**

**User ID/**
**Passwords**
**PINS**

**Pen-based**
**Signature**

**Privileged Management**

**Digital Signature**

**Click-wrap**

- 22 e-Gov Initiatives

**Strong**

**Weak**

## eAuthentication Gateway

- Gateway

- Citizen

- Business

- Agent

- FBCA

- Identity
- Verification
- Required

- Identity
- Verification
- Not Required

- Credential
- Validation
- Process

## Citizens Authentication is Particularly Challenging

- Some populations (students, low-income) lack sufficient means for identity proofing credit history, permanent address, etc.
- Certain individuals object to divulging personal information (lack of trust in who and if adequately safeguarded)
- Cost and administrative complexity of the certificate issuance

## Leverage Investments in Risk and Authentication

- Social Security Administration
-  Risk Methodology and Privacy Board
- Access Certificates for Electronic Services
- Federal Bridge Certificate Authority
- Other PKI efforts: www.cio.gov/fpkisc
- Smart Common ID for employees
- Other Agency and Alliance Partner
- National Finance Center

## ACES Concept

**ACES Concept**

- Common PKI solution encourages agencies to work together
- Allows equitable cost sharing among agencies
- Efficient, effective, economical due to aggregation of Federal needs
- One digital identity credential can be used by multiple Agency processes
- “Anonymous” certificate numbering for identification
- Public pays nothing for digital ID.

## Nat’l Institute of Standards and Technology (NIST) 

- ACES used for the electronic submission and review of proposals for the Advanced Technology Program (ATP)
- Uses digitally signed documents to send proprietary information over the Internet, digitally signs and encrypts forms, captures data and populates ATP database
- Uses a web server for downloads/ submission of forms and documents, then pulls them behind NIST and ATP firewall
- Pilot with 12 proposal submissions completed in Sept 2001
- Goes “live” for ATP’s FY2002 competition

## Social Security Administration (SSA)

- Piloting ACES Digital Signature Certificates for on-line annual wage reporting
- Following pilot, SSA had a 90 percent approval by the 100 businesses participating
- Automating W-2 submissions critical to agency where nearly 6.5 million employers submit over 240 million W-2 forms for their employees
- Continuing to expand pilot capabilities and implementing digitally signed forms

## PKI Interoperability

**PKI Interoperability**

-   Policy Interoperability involves the determination of “Trusted” PKI
-    domains which will meet the level of assurance needed.
-  Technical interoperability involves the validation of certificates form
-    a different PKI domain to determine validity of certificates and paths.
-   A small number of PKI domains makes it easier to achieve
-     interoperability --  **However it is still complex****!  **

**Trust **
**Domain 1**

**Trust **
**Domain 2**

**Trust**
**Domain 3**

- Certification Policies
- & Practices Statements
- Validation Protocols
- Bi-lateral Agreements

## The Solution: The Federal Bridge CA

**The Solution: The Federal Bridge CA**

- The Federal Bridge CA simplifies PKI interoperability:
-   Common and easy way to determine “Trusted” PKI domains and assurance levels (policy mapping);
-   Common and, relatively, easy way to validate certificate status through cross certification;
-   Standard Bi-lateral Agreement between the Bridge and Agency CA.

## In the future, what role does PKI play?

- e-Authentication initiative will organize authentication needs for critical government business lines
- PKI is not the answer for all the needs
- Cross-agency policy and support for interoperability exists for PKI but not for other authentication protocols
- PKI for strong authentication addresses mandates such as HIPPA and eSign
- Federal bridge CA facilitates unifying islands of automation

## Smart Common ID Card Regional GSA Program

- Issue Smart Cards to all Regional GSA Associates and Tenant Agencies
- Uses Smart ID Card Specification
- Phased approach w/program options
- Central card management system
- Federal Civic Center, Manhattan
- Javits Federal Building (26 Federal Plaza)
- 290 Broadway Federal Building
- 209 Centre Street Garage
- Future Phases: Other GSA Managed Buildings

## Features/Services

- Identification
- Physical access
- Logical access
- Biometrics
- Property control

-  Analysis, integration
-  Maintenance
-  Training
-  Testing

- Optional value-added services

-  Cryptographic services and digital signatures
-  Electronic purse

-  Transit program
-  Electronic forms
-  Medical information

## Open in 1⁄2 second
Anti-tailgating feature
Detect, deter and report unauthorized entry
High security glass panels
Hands-free open
Fail safe -- automatic open in case of emergency

- Anti-tailgating feature
- Detect, deter and report unauthorized entry
- High security glass panels
- Hands-free open
- Fail safe -- automatic open in case of emergency

- Smart Turnstiles

## Closing Words

- The Vision: Enable e-Government through
- A cross-governmental, ubiquitous, interoperable Authentication Infrastructure
- Develop and reuse of applications which employ common multi-protocol authentication solutions in support of Agency business processes
- Leverage existing government-wide initiatives:
- Federal PKI Policy Authority
- Federal Bridge Certification Authority
- Recognize DoD, NFC, other credentials
- Access Certificates for Electronic Services
- Other authentication investments as appropriate