All text, graphics, the selection and arrangement thereof, unless otherwise cited as externally sourced are Copyright 2014 by CertiPath, Inc. ALL RIGHTS RESERVED. Any use of these materials including reproduction, modification, distribution or republication, without the prior written consent of CertiPath, Inc., is strictly prohibited.
Integration of Access Security with
Cloud-Based Credentialing Services
Global Identity Summit
September 17, 2014
What the Heck does That Mean?
• Integration of Access Security with Cloud-Based
Credentialing Services?
• Let’s narrow this down a bit
‒ Enterprise Physical Access Control Systems (E-PACS)
‒ Integration with the cloud…
• NOT an isolated system anymore
• NOT an issuer of badges
• NOT solely Federal
• NOT authoritative for everything
Traditional PACS: Site-centric
• Traditional identity credentialing process
FBI CBP
Traditional PACS: The Silo Syndrome
• Proprietary PACS, card
formats
• Duplication of operations
‒ ID proofing
• Low assurance!
‒ Issuance
‒ Registration to PACS
‒ No guarantee of uniqueness
…Think of the expense
…and the Lock Down problem
DHS CBP USCIS AG CDC TSA TSA AG AG USCIS USCIS USCIS DHS DHS CBP CBP DoD DoD GSA GSA FBI FBI DoD
5
The Transformation…
Dependence on Cloud-Based
• Enterprise Identity Management
• Credential Issuance
• PKI Services
FICAM Roadmap Federal Enterprise
Target Conceptual Diagram
FICAM Roadmap Overview of PACS
within the Overall Infrastructure
What is ICAM?
• ICAM represents the
intersection of digital
identities, credentials, and
access control into one
comprehensive approach
• Key ICAM Service Areas
Include:
‒ Digital Identity
‒ Credentialing
‒ Privilege Management
‒ Authentication
‒ Authorization & Access
‒ Cryptography
‒ Auditing and Reporting
ICAM Foundational Architecture
E-IdM and My E-PACS
• ICAM provides
‒ E-IdM: Trusted sources of identity for my
agency/department
‒ PIV: Interoperable credentials for these individuals
‒ PKI: Identity binding and status of the employer/employee
relationship
• Automated
‒ Provisioning: Trusted identities and their credentials into
my E-PACS database
‒ Trust: Is that credential still valid?
• On separation, I will know to remove that person from my E-PACS
within 24 hours
How Policies Govern Implementations
Usage (Buildings/
Facilities)
NIST SP 800-116
Key
PIV/PIV-I per FIPS 201 &
FBCA CP
Lock
FICAM PIV in Enterprise
PACS
NIST SP800-116
• Provides guidance on usage of a PIV technology card
in PACS
• Defines threats/countermeasures when using PIV
correctly
‒ and incorrectly!
• Defines migration of the federal enterprise through a
maturity model
The Tools in my Arsenal…
14
• Performing signature checks and private key challenges at enrollment is not sufficient to achieve these levels of assurance. They must be done at the time-of-access.
• Revocation checking for FASC-N and CHUID modes must be done using the PIV authentication certificate.
Auth Modes Revoked
Counterfeit
or Altered
Copied or
Cloned
Lost or
Stolen
Shared
Auth
Factors
SP 800-116
Security Area
Chip Serial #
None
Uncontrolled
FASC-N/UUID
None
Uncontrolled
CHUID+VIS
1
Controlled
PKI-CAK
1
Controlled
PKI-AUTH
2
Limited
PKI-AUTH+BIO
3
Exclusion
Mapping Authentication Method to
Controlled Areas
15
NOTE: Circled numbers are references to explanatory
PKI-Digital Signature
For Email or PC Login
PKI-Authentication
User Digitally Signs for Access
How LONG is the PKI Cloud Dog’s tail?
SO…
When Someone Shows Up
at My Door…
DoD Sponsored DoD
Other Federal Agency / Sponsored International Government
Commercial
Shared Service Provider
Raytheon
The Boeing Company Carillon Northrop Grumman Lockheed Martin EADS SITA Exostar NL MoD Exostar Federal Common Policy CA DOS Treasury Entrust VeriSign Class 1 SSP Cassidian VeriSign SSP G3 ORC SSP 3 ORC SSP 2 Verizon Business VeriSign Class 2 SSP VeriSign Class 3 SSP DOJ ECA Root CA 2 ORC ECA VeriSign ECA IdenTrust ECA State of Illinois DoD iRoot DoD Root 1 DoD Subordinate
CA’s DoD Root 2
UK CCEB Root UK MOD CCEB Root UK MoD VeriSign SSP CA - G2 Verizon Business DST ACES CA Entrust NFI Root
ORC NFI CA 2 GPO ORC Root 2 USPTO Federal Bridge (FBCA) CertiPath Bridge (CBCA) CertiPath Root CA Veterans Affairs
17
SHA1 Infrastructure
Veterans Affairs
Raytheon
The Boeing Company Carillon Northrop Grumman Lockheed Martin EADS SITA Exostar NL MoD Exostar Federal Common Policy CA DOS Treasury Entrust VeriSign Class 1 SSP Cassidian VeriSign SSP G3 ORC SSP 3 ORC SSP 2 Verizon Business VeriSign Class 2 SSP VeriSign Class 3 SSP State of Illinois DoD iRoot DoD Root 1 DoD Subordinate
CA’s DoD Root 2
UK CCEB Root UK MOD CCEB Root UK MoD VeriSign SSP CA - G2 Verizon Business DST ACES CA Entrust NFI Root
ORC NFI CA 2 GPO ORC Root 2 USPTO Federal Bridge (FBCA) CertiPath Bridge (CBCA) CertiPath Root CA DOJ ECA Root CA 2 ORC ECA VeriSign ECA IdenTrust ECA
18
SHA2 Infrastructure
Raytheon
The Boeing Company Carillon Northrop Grumman Lockheed Martin EADS SITA Exostar NL MoD Exostar Federal Common Policy CA DOS Treasury Entrust VeriSign Class 1 SSP Cassidian VeriSign SSP G3 ORC SSP 3 ORC SSP 2 Verizon Business VeriSign Class 2 SSP VeriSign Class 3 SSP State of Illinois DoD iRoot DoD Root 1 DoD Subordinate
CA’s DoD Root 2
UK CCEB Root UK MOD CCEB Root UK MoD VeriSign SSP CA - G2 Verizon Business DST ACES CA Entrust NFI Root ORC NFI CA 2 GPO ORC Root 2 USPTO Federal Bridge (FBCA) CertiPath Bridge (CBCA) CertiPath Root CA DOJ ECA Root CA 2 ORC ECA VeriSign ECA Veterans Affairs IdenTrust ECA
19
PIV Issuers
Raytheon
The Boeing Company Carillon Northrop Grumman Lockheed Martin EADS SITA Exostar NL MoD Exostar Federal Common Policy CA DOS Treasury Entrust VeriSign Class 1 SSP Cassidian VeriSign SSP G3 ORC SSP 3 ORC SSP 2 Verizon Business VeriSign Class 2 SSP VeriSign Class 3 SSP State of Illinois DoD iRoot DoD Root 1 DoD Subordinate
CA’s DoD Root 2
UK CCEB Root UK MOD CCEB Root UK MoD VeriSign SSP CA - G2 Verizon Business DST ACES CA Entrust NFI Root ORC NFI CA 2 GPO ORC Root 2 USPTO Federal Bridge (FBCA) CertiPath Bridge (CBCA) CertiPath Root CA DOJ ECA Root CA 2 ORC ECA VeriSign ECA Veterans Affairs IdenTrust ECA
20
PIV-I Issuers
Raytheon
The Boeing Company Carillon Northrop Grumman Lockheed Martin EADS SITA Exostar NL MoD Exostar Federal Common Policy CA DOS Treasury Entrust VeriSign Class 1 SSP Cassidian VeriSign SSP G3 ORC SSP 3 ORC SSP 2 Verizon Business VeriSign Class 2 SSP VeriSign Class 3 SSP State of Illinois DoD iRoot DoD Root 1 DoD Subordinate
CA’s DoD Root 2
UK CCEB Root UK MOD CCEB Root UK MoD VeriSign SSP CA - G2 Verizon Business DST ACES CA Entrust NFI Root ORC NFI CA 2 GPO ORC Root 2 USPTO Federal Bridge (FBCA) CertiPath Bridge (CBCA) CertiPath Root CA DOJ ECA Root CA 2 ORC ECA VeriSign ECA Veterans Affairs IdenTrust ECA
