Information Assurance... Smart Card Interoperability Steve Haynes Phone

Were We’ve Come From BC (Before Computers) MainframeMinicomputersClient/Server PCs Corporate Net/ Internet Location Technology Central Data Centers Regional Data Centers Desktops across the company Limited Across the world Management Approach Centralized Admin. Team Several Centralized Admin. Teams Pager-based fire fighting Centralized Computing Decentralized Computing IT Security Management First Civilization Age of Empires Dark AgesAge of Enlightenment Time Internet/ Extranet Unlimited Across the world Mission Survivability AD (Assured Doubt)

Objective? “Most people overestimate what is going to happen in two years and underestimate what is going to happen in 10 years.” Bill Gates - Microsoft

Were We’re Going High Low Potential Damage Low High Probability of Occurrence Access 2003 Access Cost 2005 Access Speed Wireless Access Nation-State Attack Terrorist Attack Criminal Activity Hackers 1999

Mission Statement Information Assurance: Conducting those operations that protect and defend information and information systems by ensuring confidentiality, integrity, availability and accountability. This includes providing for restoration of information systems by incorporating protection, detection and reaction capabilities.

Objective? Too Much Access Security Access Exposure to risk Loss of confidentiality Loss of integrity Loss of resources Intentional theft Accidental loss

Objective? Too Much Security Loss of productivity Sense of restriction Uncooperative users Too much time to access (passwords) Write passwords down Bypass security Access Security

Access Information Assurance Comfort Convenience Customization Independence Privacy Balance: Confidentiality Integrity Accountability Availability Restoration Objective?

The Smart Card? Smart Cards

Smart Card PKI Biometrics Technical Applications: Data storage access via Internet Disposable anonymous 64 bits - 64K bits Reusable personalized PIN Memory Single app.- stored value (chip cards) Standard processor 1-16K memory 2 Processor crypto engine (Mondex) Microprocessor Multi-app. capability (“really smart” cards) Smart Cards Note: A ll Smart Cards have microprocessors. For the most part they have been used as memory cards. All Smart Cards have the capability but due to limited apps, and memory, they are used as storage cards.

Functional Applications: Stores Data Routs Transaction To Where Data Is Being Stored Converts & Manipulates Data into Interactive Information Assures Information is Protected Combines Physical And Technical Access Control Transmits Transactions Securely Authenticates Access Combines Multiple Card Requirements (API) Role Based Access Control Single-Sign-On PKI Biometrics Privacy Smart Cards

Objective? The true attraction of a smart card is not a purse to carry electronic money, but a purse to carry around all the various pieces of information that currently take up one dedicated card apiece

Interoperability WS: Win9X/NT/2000 Data Servers PDC / BDC Mail Server File Servers FTP Server HTTP Server Router WS: Win9X/NT/2000 Data Servers PDC / BDC Internet File Servers FTP Server HTTP Server Mail Server Remote User Mail Server FTP Server HTTP Server FTP Server HTTP Server Mail Server Remote User Router Data Storage Internet Access

Data storage access via Internet Information Assurance Smart Card Disposable anonymous 64 bits - 64K bits (Danmont) US$0.70 Reusable personalized PIN (no FSI) US$1-3 Memory Single app.- stored value (chip cards) Microprocessor Multi-app. capability (“really smart” cards) Standard processor 1-16K memory (Proton, most FSI) US$3-6 2 Processor crypto engine (Mondex) US$8-15 PKI Biometrics Information Assurance Private

Objective? So... A smart card may look as a card, but it is actually the smallest portable computer in the world !!!

A Smart Card is a Multi-application solution business Application 1 Application 3 Application 4 Application 2 Provide the “best practice” infrastructure Integration Approach

Questions:  What do I do if my card is lost or stolen ?  How are they replaced ?  Who provides customer service and how is it made seamless to the employee using it ?  Who is going to develop, certify, install and upgrade the applications ?  How are privacy, accuracy and security insured ?  What are the industry (hardware & software) standards?  Who can integrate all this to make it work? Challenges

Electric utilities Consumer electronic companies Consumer software companies Cable companies Information providers Retailers Bank/ financial services Communications companies The poor consumer Database creation Transactions Payments Disintermediation Build and manage “Communities of Interest” The consumer demands : Comfort Convenience Customization Independence Smart Card can hide the complexity and end the confusion Implementation Approach

Objective? Smart Cards are a reality not a technology looking for an application

Smart Card