Kansas PKI Model Brian Stevenson General Manager Nebraska.gov

Kansas PKI Uses Any individual or business required to interact with a state government agency in a transaction needing an ink signature or needing to transmit data through an unsecured network is a potential PKI user.

Make government more efficient and accessible to businesses. Kansas PKI Mission

Kansas PKI History Spent more than 8 years working on PKI Input from many groups –Combined resources (financial & personnel) –Across agency boundaries ITEC, KITO, KSOS, KDOT, KDOR, Treasurer, INK, Kansas.gov (accessKansas) –Enterprise-wide service

Cost Avoidance INK grant covered cost of creating Kansas PKI infrastructure –$261,000 –Represents cost avoidance for each agency that uses PKI

Kansas Infrastructure Statutes – PKI work group drafted legislation in 1999 – Legislation became part of the Kansas Uniform Electronic Transactions Act in 2001 – Legislation ensured various units of state government would not build silos Work group then drafted regulations and certificate policy

Stratified Responsibilities KSOS is responsible for the contract for Certification Authority services VeriSign is the CA INK is the Registration Authority Kansas created procedures to allow trusted parties to vet other trusted parties Certificate Policy

Self-sustaining Only strive for appropriate users Difference Between Kansas PKI & Other States

PKI committee reviews each potential PKI project Selects only those that are truly ready for PKI Evaluated on –need –readiness to implements –associated risks –return on investment Project Evaluation

Currently implementations added one at a time Ensures sufficient resources are available to make it successful Committee builds on knowledge gained from each implementation Implementation Process

Kansas state government treats PKI as a digital signature Digital Signature provides signer & document authentication –Signer authentication – ability to identify the person who digitally signed document –Document authentication – ensures the information was not altered after it was digitally signed Use of PKI

Encryption Digital Certificates have the ability to encrypt information Information can then only be understood by intended recipient

Kansas DOES NOT support treating PKI as access control, but as a supplement to these systems. PKI Is Not Access Control

KDOR E-lien Upcoming – KSOS ELVIS Both these applications will be discussed after lunch Current Uses of PKI

Thank You QUESTIONS & ANSWERS