1.02 – 13/08/2003 – CR 2730 Software Box Ltd Tel : 01347 812100 Scotland Modernising Government, Efficient Governement Conference 29

Software Box Ltd Tel : 01347 812100 www.softbox.co.uk

1.02 – 13/08/2003 – CR 2730

Software Box Ltd

ScotlandModernising Government, Efficient Governement

Conference

29th October 2004


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Supplier Workshop 2

Authentication & Managing Identities


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Authentication & Managing Identities

• Introduction

• A Practical Example

• Panel Session


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Introduction

Neil Boyd

Business Development Manager

SBL Scotland


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Introduction

•Neil Boyd

•Business Development Manager

•SBL Scotland

•Edinburgh


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Introduction

• Software Licensing• Security Specialist• Information Assurance• Public Sector

– MOD– Police– Local Government– Central Government– NHS

• GCat Prime Contractor• DIPCOG/GIPSI/CIPCOG• SIAF


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Introduction

• Definitions

• Setting the scene

• Concepts


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Introduction

“Gaining and maintaining the confidence and trust of individuals, businesses and other organisations will be one of the key success factors for the provision of e.Government services.”

“Registration and Authentication are two necessary activities for gaining and maintaining trust”

Registration and Authorisation

E-Government Startegy and Framework Policy and Guidelines

Office of E-Envoy


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Registration

“The process by which a user gains a credential such as a username or digital ceritificate for subsequent authentication”.



Office of E-Envoy


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Authentication

“The process that an electronic identity of a user is asserted to, and validated by, an information system for a specific occasion using a credential issued following a registration process. It may also involve establishing that the user is the true holder of that credential, by means of a password or biometric.”



Office of E-Envoy


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Identity Changes Through Time

• People are born• People are married• People die• People move house• People move into the

area• People change their

identities


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Identity Changes Through time

• People are born• People are married• People die• People move house• People move into the

area• People change their

identities G8


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Identity

• Something owned

• Something known

• Some personal (biometric) characteristic


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Identity

Name

Address

Mothers Maiden Name

Address

Appearance

NI Number

NHS Number

• Passport

• Driving Licence

• Birth and marriage Certificate

• Bank Statement

• Utility Bill

• Benefits/Tax documents

• Payslips

• Educational Qulaifications


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Identity

Name

Address

Mothers Maiden Name

Address

Appearance

NI Number

NHS Number/Birth NHS Number/Birth Registration NumberRegistration Number

• Passport

• Driving Licence

• Birth and marriage Certificate

• Bank Statement

• Utility Bill

• Benefits/Tax documents

• Payslips

• Educational Qulaifications


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Authentication

• Password/PIN

• Smartcards

• Tokens

• Door Entry Systems

[**********]


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Authentication

• Chip implants

– Obtained US approval this month

– Quickly access patients medical records

– Shares in Applied Digital Solutions jumped 68% on the news


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

“The Four A’s”

• Authenticate

• Authorise

• Administer

• Audit


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Why Authenticate ?

• Security

• Establishing the right to a service

• Registering for that service


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Why Authorise ?

• Security

• To control access to applications and services

• To control citizen access levels


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Administration

• Security

• Registration

• Self registration

• Self service

• Empowering the citizen

• Efficiency/Cost reduction


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Audit

• Security

• Accountability

• Recoverability

• Anti-Fraud


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Audit

• Security

• Accountability

• Recoverability

• Anti-Fraud

• ComplianceCompliance


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Compliance

• Control– Controls affecting internal people– Controls affecting external people

• The citizen• People in other organisations or departments

– “Federated Access Systems”• Automatic enforcement of controls

– Controls affecting applications– Web Services Management

• Enforcing controls between applications– Corporate Applications– Inter-company applications


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Compliance

"Identity and access management related issues are among the weaknesses often cited by companies needing to accurately audit and document interactions with sensitive resources." "Whether it's Sarbanes-Oxley, HIPAA, Gramm-Leach-Bliley, or other security or privacy regulations, customers need a complete identity management solution that can provide control and visibility into the activities of employees, customers, partners, and any other users of corporate applications across multiple systems and domains."

Roberta J. WittyResearch Vice President

Gartner, Inc.


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

IdM in Action

A Practical Example

Birmingham City CouncilBirmingham City Council

Keith Hickson, Keith Hickson, Manager, PwCManager, PwC


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

SolarisSolaris

DominoDomino

Tarantella.Tarantella.

WebWeb

Identity Management Applications

Identity Management Overview

Foster Carers

Users

User Admins

People’s Network

Birmingham City CouncilExtension to People’s Network Foster Carers Secure Pages


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

User Management

ServicesPersonal information profile

Administration

• Centralised

• Delegated

• User Self Service

Group Management

Object Management

Workflow

What is User Management?

User Management is the term used to describe technologies that enable the management of large numbers of users, typically in the millions. Provisioning is also a term used to describe this space.


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Authentication

What is Authentication?What is Authentication?

Authentication mechanisms are tools that provide differing levels of confidence about a persons identity (are they who they say they are?) – so as to enable business transactions

Services

Username and Password

• Basic over LDAP

• Form Based

Additional Criteria

• PIN Number

• Security Question

Stronger Authentication

• Digital Certificates

• Token Based Authentication

• Biometric


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Access Management

Services

Group / User Criteria

Role Based Access

Advanced Access control

Multiple levels of Privileges

HTTP Headers

Cookies

Integration Services

Web ServicesWhat is Access Control?

Ensuring that users are given access only to those applications or resources that they are entitled to see or use. Also known as Privilege Management Infrastructure (PMI)


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Enterprise Directory

What is a Directory?What is a Directory?

A directory serves as a repository for

user information. Access to the

directory is via the Lightweight

Directory Access Protocol (LDAP).

Services

Repository for Identity Information

Directory Enabled Applications

Multiple Directories

Content management

Other Applications

Portals

Lotus Notes

Oracle / SAP

Web Services / The Gateway


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Challenges

Website Design and Security

Libraries Non Web Based Architecture

Authentication Service for UNIX Operating system

Personal Information & Data Protection

Administration Model


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Looking Forward

Government Gateway

Payment Services

Online bookings and Applications

Linked Services such as social services and Healhcare


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

IdM in Action

A Practical Example

Birmingham City CouncilBirmingham City Council

Keith Hickson, Keith Hickson, Project Manager, PWCProject Manager, PWC


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

The Panel

• Peter Gibbon,Senior Manager

• Terry Wilkinson, Manager of Sales Support

• Mike Wawro, Managing Consultant


1.02 – 13/08/2003 – CR 2730

Software Box Ltd

Modernising Government Workshop

SBL ScotlandPO Box 28263Edinburgh EH9 3YT

Neil BoydEmail: [email protected]: 07734 59116www.softbox.co.uk

Documents

1.02 – 13/08/2003 – CR 2730 Software Box Ltd Tel : 01347 812100 Scotland Modernising Government, Efficient Governement Conference 29