Presentation on theme: "Federal CIO Council Information Security and Identity Management Committee IDManagement.gov Attribute Exchange and Information Sharing in Action Federal."— Presentation transcript:
Federal CIO Council Information Security and Identity Management Committee IDManagement.gov Attribute Exchange and Information Sharing in Action Federal ICAM Day June 18, 2013
2 Martin Smith, PM-ISE Ted Sobel, DHS Office of Policy/SCO David Coxe, ID/DataWeb Dieter Schuller, Radiant Logic John Wandelt, GTRI Anil John, GSA (Moderator) Panel Participants
3 An Entity 10- Who is anonymous 20- Using a uid/password 30- Using a software OTP … Using 10- An Org managed PC 20- A Personal PC 30- An Org Smartphone … From 10- Org Network 20- Via VPN 30- Internet … To Access 10- Admin functions 20- An AD integrated App 30- Network Device … When 10- During normal hours 20- During weekends 30- When no AuthZ service …
4 http://www.IDManagement.gov Martin Smith, PM-ISE
User Attributes for ABAC Authorization Martin Smith, PM-ISE IdAM Coordinator June 18, 2013
Some (Rebuttable) Assertions about Person Attributes (for Authz) The more attributes we have, the more data can be responsibly shared ◦ But provisioning high-quality (authoritative, accurate, timely) attributes is expen$ive Responsible sharing across the environment (multiple organizations) requires common syntax/semantics of relevant attributes ◦ But not everyone will use or provision all “registered” attributes Today, a user’s home organization provisions most attributes; but ultimately each attribute is likely to come from a different source ◦ This means attribute aggregators or real-time aggregation via BAE is essential Authorization attributes are not particularly relevant to a major class of use-cases: for access to one’s own personal info (e.g., Social-Security account, bank account.) ◦ But they are essential for controlling access by a user to “OPD” (other people’s data), privileged functions, “need to know” data Governance of attribute provisioning and use has to be as lightweight as possible (but not more so) ◦ Basic strategy is to rely on transparency (disclosure of attribute quality, with audit) so that relying parties can make informed choices about acceptable risk in using an attribute ◦ Initially, attribute quality and suitability (match to “ideal” data) will be poor, but there are incentives for relying parties and attribute providers to meet in the middle
8 Minimum Standards for the Assertion, Evidence, and Verification of Personal Identity The Identity Proofing and Verification (IDPV) Standard Development Project Ted Sobel DHS Office of Policy/ Screening Coordination Office (SCO) June 2013
9 Background: Need Common practices to support an identity chain of trust Requirements that align with established risk categories Evaluating how an organization proofed an identity
10 Design: Hierarchy Identi ty Defines an unique identity Attribute Authenticates the asserted attributes Evidence Determines degree of confidence in the evidence Verification Checks
11 Design: Example Robert Smith Identi ty Legal First & Last Name Full Date of Birth Attribute Driver’s License Evidence Check DMV records Examine sec. features Manually match photo Verification Checks
What You Have…What the Other Party Expects… samAccountName=Ellen_AdamsUID=Ellen_Adams givenName=Ellen, sn=Adams, o=MicrosoftEmailemail@example.com memberOf=SalesGroup=Seattle employeeType=managersecuritylevel=1 samAccountName=Ellen_AdamsProjectMembers=Ellen_Adams, Joe_Smith, Tom_Leahy st=WAState=Washington And This?
Correlation: Same Users-Different IDs No SSO unless you have this RJones RobertaJ Disambiguation: Same IDs – Different Users Potential for authorization based on wrong profile RJones Profile Lookup at Directory Speeds Groups Matching Application Needs Translation of Protocol, Schema, Structure, and Data Scalability and Performance of a Directory Global User List (Union) Complete Profile (Join) Group Management Consumer Specific Views Smart Synch Cache Lessons Learned
Identity and Context Virtualization Aggregation Correlation Integration Virtualization Population C Population B Population A Groups Roles LDAP SQL Web Services /SOA App A App B App C App D App E App F Contexts Services SCIM REST
38 GFIPM Metadata 2.0 NIEF Profile MANDATORY (Required for Audit Purposes) Federation Id Given Name Sur Name Email Address Text Telephone Number Employer Name Identity Provider Id MANDATORY (Required for Audit Purposes) Federation Id Given Name Sur Name Email Address Text Telephone Number Employer Name Identity Provider Id HIGHLY RECOMMENDED (Required by ≥2 SPs) SLEO Indicator Public Safety Officer Indicator Employer ORI Employer Organization General Category Code Electronic Authentication Assurance Level Code Id Proofing Assurance Level Code 28 CFR Certification Indicator HIGHLY RECOMMENDED (Required by ≥2 SPs) SLEO Indicator Public Safety Officer Indicator Employer ORI Employer Organization General Category Code Electronic Authentication Assurance Level Code Id Proofing Assurance Level Code 28 CFR Certification Indicator RECOMMENDED (Required by 1 SP) NCIC Certification Indicator Counter-Terrorism Data Privilege Indicator * Criminal Investigative Data Privilege Indicator * Criminal Intelligence Data Privilege Indicator * Criminal Justice Data Privilege Indicator * Government Data Privilege Indicator * Local Id N-DEx Privilege Indicator RECOMMENDED (Required by 1 SP) NCIC Certification Indicator Counter-Terrorism Data Privilege Indicator * Criminal Investigative Data Privilege Indicator * Criminal Intelligence Data Privilege Indicator * Criminal Justice Data Privilege Indicator * Government Data Privilege Indicator * Local Id N-DEx Privilege Indicator All other attributes are PERMITTED. * Indicates presence of search privilege on behalf of self in user’s home agency.
39 Law enforcement officers from the Texas Department of Public Safety need fast, reliable access to gang and criminal related information while in the field. The Regional Information Sharing System (RISS) has a database of intelligence information that would allow an officer to conduct a quick background check on potential criminal suspects and assess their criminal history and personal information. In order for a law enforcement officer to gain access to the system at RISS, he/she must have successfully completed the 28CFRPart 23 training with the Bureau of Justice Assistance. Use Case Example
41 For More Information GFIPM: http://www.gfipm.nethttp://www.gfipm.net NIEF: https://nief.gfipm.net/https://nief.gfipm.net/ Global Information Sharing Initiative: http://it.ojp.gov/default.aspx?area=globalJustice
Your consent to our cookies if you continue to use this website.