CAISO Public Key Infrastructure: Supporting Secure ICCP Leslie DeAnda Senior Information Security Analyst, Information Security, CAISO EMS Users Group Conference Austin, Texas September 24 th, 2007

2 Secure ICCP Data sharing between systems is necessary ICCP’s inherent lack of security Regulations require security controls be implemented

3 Basic Trust Model When two parties engage in a transaction they must: 1.Mutually trust each other's identity 2.Trust that both parties are allowed to engage in the transaction 3. Trust that no third party can know the details of the transaction 4. Trust that no third party can change any part of the transaction 5. Trust that neither party can deny having engaged in the transaction 6. Trust that a record of the transaction is kept for future reference

4 Public Key Infrastructure Overview Infrastructure which enables secure communication over unsecured networks, utilizing public and private key pairs obtained through a trusted authority. Public and private keys are created simultaneously, and have a direct correlation Private key must never be divulged...If so, the certificate must be revoked and reissued Can be used in a variety of ways to support security requirements

5 Public Key Infrastructure Components Certificate Policy and Certificate Practice Statements CP: What must be done to meet security requirements CPS: How security requirements must be met Certificate Authorities Trusted authorities which issue credentials to validated entities Registration Authorities Trusted authorities which validate certificate requests and communicate securely with certificate authorities

6 Public Key Infrastructure Components (continued) Certificates Credentials issued to validated entities from a trusted source Certificate Revocation Lists (CRLs) and CRL Distribution Points (CRLDPs) List of un-trusted, valid certificates issued from a specific CA Lightweight Directory Access Protocol (LDAP) Central directory providing data to Subscribers and Relying Parties

7 Public Key Infrastructure Overview CAISO_Test_CACAISO_Issuing_CA CAISO_Root_CA LDAP RA Entity CRLs CRLDPs CSR Certificate CSR Certificate CAISO Website CP CPS

8 Certificate and Key Lifecycle

9 Benefits of Public Key Infrastructure Mutual identification Allows participants to confidently know with and authenticationwhom they are conducting business without third party intervention Access ControlEnsures that an entity can only perform actions for which it has permission Confidentiality Ensures that only the intended recipient can protectioninterpret the data Integrity protectionEnsures that the sender of a message can detectif data has changed while in transit

10 Questions ???? Contact Information: Leslie DeAnda, Sr. Information Security Analyst, CAISO or (916)