1
IDENTITY ASSURANCE PROFILES AND FRAMEWORK DOCUMENTS:PEEK INTO PROPOSED FICAM CHANGES
12/12/12
12/12/12
2
Topics• Background• Big pic • Detailed pic
12/12/12
Program Basics: Documents• Identity Assurance
Assessment Framework• Identity Assurance Profiles
• Bronze (NIST Level 1)• Silver (NIST Level 2)
• Assurance Addendum to the Participation Agreement
312/12/12
Program Basics: Assurance Advisory Committee (AAC)
What is the AAC, and what does it do?• Represents stakeholders in the assurance process:
IdPs, SPs, auditors• Oversight for program• Advisory to Steering • Assess applications, recommend approval (or denial) to
Steering• Recommend changes to documents or program
5
Program Basics: Assurance Advisory Committee (AAC)
Who is the AAC?• Tim Cameron, National Student Clearinghouse (SP)• Mary Dunker, Chair, Virginia Tech University (IdP)• Steve Devoti, University of Wisconsin-Madison (IdP)• 2nd Auditor• Jacob Farmer, Indiana University (member at large)• Chris Holmes, Baylor University (InCommon Steering)• Scott Koranda, University of Wisconsin-Milwaukee/LIGO (SP)• Steve Kurncz, Michigan State University (auditor)• Ann West, InCommon/Internet2 (InCommon staff)
12/12/12
6
Assurance Advisory Committee (AAC)
Ex-Officio (non-voting)• Marilyn McMillan, New York University (InCommon Steering)• Tom Barton, University of Chicago (InCommon TAC)• Renee Shuey, Penn State (InCommon TAC)• Jack Suess, UMBC (InCommon Steering)
For more information, visit
http://www.incommon.org/assurance/aac.html
12/12/12
7
FICAM Trust Framework Providers• Identity Credential and Access Management Subcommittee
• Federal CIO Council • Information Security and Identity Management Committee
• Trust Framework Provider Adoption Process (2009)• Comparability assessment
• 800-63 as basis for LoA requirements. Incorporates previous work done by the Feds as well under E-Authentication Initiative
• Privacy, organizational maturity, legal status, authority for InCommon and for InCommon to assess for IdP Operators
• Web SSO SAML2 Profile: Over the wire
• Trust Framework Providers • InCommon, Kantara, OIX, Safe/BioPharma
12/12/12
8
InCommon’s History with FICAM• 2009-2010
• Spring - 1.0 begun review by FICAM. Community implememtatino begun.
• Fall - Refining of Silver begun due to community feedback• 2011
• Spring – 1.1 Reviewed and approved by community • Fall – FICAM asks for Simplified Bronze. InCommon develops 1.2.
• 2012 • Spring – 1.0 and InCommon fullly approved TFP. 1.2 reviewed and
approved by community. InCommon submits1.2 to FICAM for their approval.
• Est. 2013 • January – 1.2 approved by FICAM.
12/12/12
9
What’s the hold up?
This is a new audit!• Federal availability• FICAM program evolving
• Negotiating on behalf of Higher Ed• Changes reflected in 1.2
requires resubmission for the spec
• Big pic items
12/12/12
10
Alternative Means• IAAF 1.1: “From time to time, InCommon may identify
alternative means developed by experts from the Research & Higher Education sector as specifying means that are comparable or superior to identified requirements in one or more of its IAPs. “
• Page 2: “Normative criteria to be used in an assessment process are expressed in separate Identity Assurance Profile and approved alternative means documents.”
12/12/12
11
Who’s Spec is it Anyway?• Hot potato
• Time and Trust• How do we evaluate these things?• Who gets to say?
• Where will this show up?• Authentication technologies: multifactor• Cryptography: AD Silver Cookbook• Identity proofing: knowledge-based
12/12/12
12
Other Big Pics: Where we are… Bronze audit and no-audit option Bronze and 4.2.4 Credential
Issuance and Management Bronze and protection of PII Registration and Credential Records
Retention – 7.5 years Approved Algorithm –
Alternative Means Scope: Profiles are password only –
Alternative Means
12/12/12
13
What’s Next?• Develop Process for Alternative Means
with Assurance Advisory Committee
• Continue discussion to work through a couple detailed questions
• Work on FICAM approval expected January 2013
• Publish FICAM-approved spec for community review
• Announce implementation extravaganza and programs!
12/12/12