Brooks Evans – CISSP-ISSEP, Security+ IT Security Officer Arkansas Department of Human Services

Topics  Requirements of State Agencies  Risk Assessment  Digital vs. Electronic Signatures  PKI  Available Technologies

Requirements of State Agencies  Act 722 of 2007: State agencies are required to use or permit the use of electronic signatures by June 2009.

Risk Assessment for Business Process 1. Importance of identity verification for trusted person 2. Importance of knowing person who signed was person validated in #1 3. Importance that document has not changed since it was signed

Digital vs. Electronic Signatures  Electronic Signature: An electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

Digital vs. Electronic Signatures  Digital Signature: A type of electronic signature that relies on a public key infrastructure (PKI) to provide a unique identifier and link the signature to the record, authenticating both the signer and the document.

Public Key Infrastructure

Available Technologies  Low Level Validation  Self-Generated Certificate  Available in Word and Acrobat for Free  Image of Wet Signature  User scans signature and pastes into document  Signature on Electronic Tablet  User signs document on screen without special signature software

Available Technologies  Medium Level Validation  Certificate Purchased from Public CA  ~$20/year  Easy for third parties to acquire  Difficult to manage with large number of users  Wet-Signature with Trusted Method ~$300/device~$100/license Software such as IntegriSign

Available Technologies  Medium Level Validation  Internal CA  Requires significant policy and technical setup  Requires SAS70 audit and root signing if to be trusted outside organization  Automates distribution and management of large number of user certificates to user devices such as PC or smart card  Certificate price decreases as use increases

Available Technologies  High Level Validation  Same methods as medium level, but the CA or root signer requires more documentation to validate identity  This typically costs more due to higher risk and bond coverage

Brooks Evans – CISSP-ISSEP, Security+ IT Security Officer Arkansas Department of Human Services