1. End Slide Format DO NOT place photos or additional text boxes on this slide. An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation/ASSA ABLOY AB. All rights reserved. Contents are confidential and proprietary and not intended for external distribution. End Slide

2. A case for secure ID Credentials Case Study: US Department of Defense Ian Lowe – Product Marketing – Solutions May, 2013 Identity Assurance (formerly ActivIdentity)

3. *(2012 Juniper Research Report) US Department of Defense

4. Quick Facts DMDC Established in 1974 to collect and maintain accurately, readily available manpower and personnel data. –November 10, 1999, Memo from Dr. John Hamre (Deputy Secretary of Defense) Directive to create a Common Access Card Program –First 70 Beta sites operational by mid 2001 –CAC v2 (GSC-IS 2.1) introduced in 2003 –Federal Information Processing Standard (FIPS) 201 US Government PIV program created (2/2005) in response to HSPD 12 (8/2004) Special Publication SP800-73 created (PIV Transitional card) (3/2006) HID delivered PIV End-Point support in September 2007 Mission: Serve as a central source to identify and authenticate people in the Department of Defense. An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

5. The History An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

6. Challenge 1 From paper ID & Passwords to smart card ID Secure standardized multi-function ID Laminated IDs and weak passwords An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

7. Solution Standardised Credential CAC is a multi-application dual-interface smart card for FIPS 201 deployments Centralized Security: Access Control Rule & Global PIN management Generic Container (on-card buffers): Employee ID Benefits External Benefits Healthcare Information PIV cardholder identity (facial, fingerprint) PKI for Authentication (login), Signature/ Encryption/ Decryption (email): Four RSA Key Pairs/ X.509 Certificates Other Areas: Data Confidentiality Encryption – SMA secure messaging protocol Plug-in support (new CAC applications) Multiple Global Platform Domains JAVACARD GLOBAL PLATFORM CC EAL5+ An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

8. Challenge 2 Infrastructure + issuance/management policies employee HID ActivID Card Management System ActivIDAppliance AAA or AS Server User LDAP PKI CA Hardware Security Module database self service Remote access Windows and Network login digital signature encryption physical access issuance update/ post issuance suspension / termination HID ActivID Batch Management System Identity Management System operator help desk PACS System smart card printer Badging system badging service bureau mass badging

9. Solution HID Credential Management System Multiple DOD infrastructure components

10. Summary Today they issue, track and manage CAC plus several other missions –The PIV-based CAC is used by DoD armed services (Army, Air Force, Navy, Marines) and 25+ DoD agencies. An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

11. What Next? Smart Phones/Tablets and Derived Credentials Future Identity on Mobile NFC Mobile Access Derived Credentials Past Present Current CAC An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

12. Keys, access credentials in your daily life Converged in your NFC-enabled smartphone Used to open cloud- applications, data and doors HID Secure Access Cloud, Data and Door An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

13. Summary An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

14. Best Practices Delivery and management of Secure Trusted Identity Solutions should adopt/use industry standards such as: PIV, FIPS, Global Platform, NFC…etc. Use the FIPS 201 APL as a starting point for selecting compatible products: http://fips201ep.cio.gov/apl.phphttp://fips201ep.cio.gov/apl.php Dont re-invent the wheel. Implement a trusted credential management model (Registration, Vetting, Issuance, Revocation) Take a layered approach to security, consider all components of solution (Card, Chip, CMS, Middleware, future capabilities and impact on users) An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation. All rights reserved.

15. DO NOT place slide content below this dotted line. Photo content should go below this dotted line. DO NOT Change Image 15 0/83/155 sRGB Color Palette Values 0/45/86 248/152/29 0/113/97 97/17/106 139/141/9 211/18/69 255/255/255 176/183/188 176/203/234 Chart Accent Colors Chart Neutral Colors (For charts, use colors in order of appearance.) Title Color 0/83/155 Body Text Colors 0/20/55 An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2012 HID Global Corporation/ASSA ABLOY AB. All rights reserved. Contents are confidential and proprietary and not intended for external distribution. Thank You Slide

16. End Slide Format DO NOT place photos or additional text boxes on this slide. An ASSA ABLOY Group brand PROPRIETARY INFORMATION. © 2013 HID Global Corporation/ASSA ABLOY AB. All rights reserved. Contents are confidential and proprietary and not intended for external distribution. End Slide