Copyright Copyright Ian Taylor 2007. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Management Issues with Risk Assessments and Establishing Levels of Assurance Ian Taylor Manager, Security Middleware Unit Computing and Communications University of Washington

Today’s Discussion Overview of the IAM context at the University of Washington “Explore how to do risk assessments” Drivers for Levels of Assurance User Perspective Exploring the Solution Space

UW’s Environment CENTRALIZED IT: Large central IT organization (~600 staff) All networking infrastructure Data Center All major business applications Email, web hosting Identity and Access Management, directory services, etc. etc.

UW’s Environment DECENTRALIZED IT: Central business units Academic units Research centers Many different groups on campus create or purchase software applications Central IT has little or no control over what departments do Some of them invent authentication/authorization solutions

UW’s Environment Many diverse populations: 80,000 + Faculty, Staff and Students (18,000 Med Center Employees) 500,000 + Alumni and Affiliates 1,000,000 + Patients Other diverse populations (Cascadia Community College, WA State K-12 students, Library Patrons, etc.)

UW’s Enterprise Credential (UW NetID) A large amount of effort has gone into making the UW NetID UW’s single enterprise credential. More than 360,000 active UW NetIDs 300,000+ more potential users (1,300,000 + if we include patients) Our credentials are stored in both Kerberos and Windows AD We have 5 different UW NetID Types (not to be confused with LoAs!)

UW NetID Types Personal UW NetID – A UW affiliated individual’s key to online resources at the UW and beyond Shared UW NetID – Used to share centrally maintained UW computing services such as departmental websites Temporary UW NetID – Used to provide temporary access to services via the UW NetID system Applications UW NetID – Applications/ services that need to authentication and can’t use x509 certificates Reserved UW NetID – UW NetIDs that can’t authn (eg. root, mailing lists, etc)

LEAVING THE COMFORT ZONE Warning! LEAVING THE COMFORT ZONE

What LoAs does the UW NetID Support? One size fits all… well almost! ~ 7,400 people have 2-factor authn (SecurID) We support a group of EAuth level 1 credentials (very small test group)

“Explore How to do Risk Assessments” “Risk-level Assessment is a management technique used to determine the level of exposure associated with unauthorized use of a resource. In the security area, risk-level assessments have a broader use associated with relative priorities and mitigation plans for protecting an institution’s information assets.”

Risk Assessment at UW Is currently instinctive (all art, no craft) with little or no formal process (which is not much of a problem, since we have only 2 levels of assurance :-) Needs to improve since we KNOW we need to institute more levels of assurance How to do it?

Risk E-Authentication Guidance for Federal Agencies: Risk is a combination of a) the Consequences of exposure (cost, harm, impact) and b) the Likelihood of exposure

Categories of Harm and Impact Inconvenience, distress, damage to reputation Financial loss or university liability Harm to university programs or public interests Unauthorized release of sensitive information Personal safety Civil or criminal violations

Risk Levels Low impact Moderate impact High impact (See pp 8-9 for definitions and illustrations. Disastrous? Or merely Catastrophic?)

Whose Job is This? Who has the expertise to make these judgments? Risk Management Office? Specialized function within IT organization? Inquiring minds …

Drivers for LoA Compliance Perspective - Supporting federal, state and university policy requirements. Business Perspective - Supporting university business needs. COMPLIANCE BUSINESS

Compliance Drivers for LoA Regulatory – Government requirements HIPAA FERPA WA State ISB Standards WA State Security Breach Notification Law (6043) – 37 other states now have this Contractual – Liability protection issues Payment Card Industries/ Data Security Standards (PCI/DSS) Local Policy and International Standards E-Authentication ISO, NIST etc. University Policy Different (sometimes competing) requirements Applies to subsets of the NetID populations Requirements vary from common sense to unreasonable

Business Drivers for LoA A subset of applications require a higher assurance level that’s costly to provide A subset of apps require low bar for entrance Globally distributed users create ID proofing challenges Provide service to individuals with little or no known personal data Password restrictions can be potentially unfriendly to certain classes of users

The User Perspective It’s hard to choose a usable password! Why do I have to keep changing my password? Why do I have to give my personal information? What do you mean I have to come show my picture id? What do I need to do to access application ____?

Exploring the Solution Space A formal process for performing Risk Assessments A well defined set of LoAs A set of NetID attributes used to determine LoA A user portal that reports & explains current LoA Clearly defined standards for when each LoA is required Support for LoA in authentication services

How are LoAs Assigned? A rollup of attributes that define level of Assurance? Or the attributes themselves? As attribute values change LoA may decrease Typically the only way LoA increases are when new ID proofing is done accompanied by a password change or additional factors are given at Authentication time

Attributes that Define LoA Type of Identity Proofing # of failed authentications Password strength Password age Is Compromised? Multiple factor authentication?

Types of Identity Proofing High Assurance ID Proofing Photo ID in person Notarized Photo ID via mail/ fax Phone verified ( 5 or more pieces of info ) PAC by mail Low Assurance Phone verified ( 2 pieces of info minimum ) Email verified Verified by trusted member

UW NetID Levels of Assurance (Conceptual) NOTE: This does not reflect the current state of the UW NetID. The UW does not yet have plans to implement this or any other LoA scheme. Level F – Compromised IDs and other IDs that are not allowed to authn Level E – Shared and temporary IDs that have little or no assurance Level C – Low assurance personal UW NetIDs that have minimal id proofing Level B – Higher assurance Personal IDs that have stronger ID proofing. Compliant with EAuth Level 2. Level A – High assurance Personal IDs that authn with 2nd factor (securid for now). Compliant with EAuth Level 3.

More Questions, Comments, Feedback? Ian Taylor iant@washington.edu