Appropriate Access: Levels of Assurance Stefan Wahe Office of Campus Information Security

The Case Study The University of Wisconsin System uses a loosely federated authentication system. Each of the 16 campuses maintain their own credential store and identity proofing processes. Business ERPs that contain personable identifiable information are beginning to use the federated authentication system

Case Study: The Problem It was unknown how each campus assures the: –Accuracy of an identity subject –Strength of the authentication token –Reliability of the controls and procedures that protect the credential store

Go from...

... to get to...

to prevent something like... Man-in-the-Middle Replay Attack Password Guessing Brute Force Dictionary Attack DDoS

Case Study: The Goal Identify gaps by assessing the Credential Store against a standard. Measure the risk by considering the gaps. Report the risks to management: – What are the risks – How can the risks be reduced Allow management to determine risk mitigation strategy.

The CAF Assessment Tool Can be located at:

Creating an Self-Assessment Tool Self-Assessment Questions were based on requirements / recommendations from: –InCommon Credential Assessment Profile r0.3 –NIST : Electronic Authentication Guideline –NIST : Recommended Security Controls for Federal Information Systems –Payment Card Industry - Data Security Standard

The CAF Assessment Tool The assessment tool consists of 37 questions (requirements). Five “disciplines” are represented disciplines: –Operations and Management –Authentication Protocol –Token Strength –Registration and Identity Proofing –Status Management

The Questions SectionExample Question Part 1:Operations and Management Configuration Management Part 2:Authentication ProtocolStored Secrets Part 3:Token StrengthPassword Policy Part 4:Registration and Identity Proofing Records Management Part 5:Status ManagementCS Avilability

Part 1: Operations and Management 10 Configuration Management a. Does the CS demonstrate Configuration Management methodology that includes: i. A documented process for reviewing, approving and implementing changes ii. Version control for software system components iii. Timely identification and installation of all applicable patches for any software used in the provisioning of the CS.

Part 3: Token Strength 2828 Password Policy aWhat is the minimum required length of the password? fCan individuals recover lost or forgotten passwords? bFrom password inception, is the total number of failed attempts tracked? gIs password history maintained and used to prohibit the re-use of passwords? How many password changes are stored? cAre passwords prevented from containing the username and/or the Identity Subjects proper name? hAre controls in place that prevent a consecutive character string of three or more (e.g. aaa, 111, dWhat it the maximum number of failed logon attempts before an account is locked? iWhich of the following character sets are required in establishing a password: Uppercase letters, lowercase letters, digits, special characters or control characters? eHow often are password changes required? InCommonToken Strength: 10 At this assurance level, the PIN (numeric-only) or Password, and the controls used to limit on-line guessing attacks shall ensure that an attack targeted against a selected identity subject’s PIN or Password shall have a probability of success of less than (1 chance in 1,024) success over the life of the PIN or Password. Refer to NIST SP Appendix A, and the CAF Suites’s Entropy Spreadsheet to calculate resistance to online guessing.

Case Study: The Process Each campus provided: –A response to the assessment questionnaire. –A network scan of the devices that comprise the Credential Store Infrastructure. The responses were analyzed for compliance with: –Identity Proofing –Token Strength –Technical Controls

Case Study: The Process Each Campus was provided a report that identified – Overall Status – Findings (Gaps and Risk) – Recommendation The Governance Council was provided a report that identified the status of each campus’ credential store.

Case Study: The Process Reports are provided to applications or services owners upon request. Reports may be provided to Legislative Auditors upon request Re-assessments occur every six months.

Who Was Involved CIOs from each of the 16 campuses. Campuses had a differing types of employees involved in completing the assessment Chief Information Security Officer Directory Services Analyst Network Administrator Security Analyst System Administrator * Typically employees with a strong technical understanding of the controls and requirements

Findings: August ‘07 Assessment –No one campus was compliant in all five domains. –Some campuses were good at token strength. –Few campuses were positive in identity assurance. –Few campuses were strong in technical controls and processes.

Findings: January ‘08 Assessment Progress!!!! Two campuses planned to be compliant in all five areas by October –Some campuses improved their token strength. –Many campuses still struggle with identity assurance. Identified plans to meet requirements.

Case Study: General Findings Documentation was lacking in most cases. Process was lacking in some cases (especially identity assurance). Great in some technical controls and cryptographic algorithms. Some positive answers in the first assessment were answered in the negative during the second assessment.

Next Steps We will begin conducting a third assessment in August Some requirements will be audited (tested) during the third assessment. Update the Self-Assessment Tool to reflect the changes in the CAP/IAP. Provide documentation on how to meet requirements.

Other Considerations Office of Admissions: Sourcing Applicants Registrars Office: Sourcing Students Human Resources: Sourcing Employees Photo ID: Identity Proofing Process Help Desk: Identity Proofing Process Typically employees with a strong understanding of the business process. Employees who need to be able to follow the business process. Include Business Partners

Other Considerations ✓ Finalize the Identity Assurance Profile. – With the assumption that it will change overtime ✓ Develop a self-assessment tool based on the IAP ✓ Consider using a maturity scale for determining compliance. ✓ How do we verify our state of compliance.

Discussion... Stefan Wahe University of Wisconsin - Madison y/resources/ y/resources/