UNCLASSIFIED 1 Authorization and Attribute Service Tiger Team (AATT) Update & Status January 13, 2008

UNCLASSIFIED IC/DoD Authorization & Attribute Service Tiger Team (AATT) December 18, Established the IC/DoD AATT –DoD Co- Chair: Ms. Myra Powell –IC Co- Chair: Ms. Amy Reiss Purpose: –Implement Authorization and Attribute Services across the IC & DoD as part of a dynamic information sharing environment that delivers timely information to authorized users Objective: –Provide Operational user/resource owners the ability to control information sharing Result: Users gain appropriate access to mission critical & business information without manual pre-registration processes –Identify common interfaces and service specifications that can be used to deploy common authorization and attribute capabilities across the IC & DoD environments Unified security services enabling agile information sharing and collaboration for SIE and GIG 2

UNCLASSIFIED 3 Why Authorization and Attribute Services Attribute Based Access Control can enable: –Dynamic service and data discovery* and access –Unanticipated (but authorized) access to critical information –Resource owners can provide services and data to larger community –Dynamic, agile security posture (policy) change to meet mission tempo

UNCLASSIFIED 4 Access Control Information is virtually ‘trapped’ within systems that require account creation, or addition to a list. Manual process to add EACH user to EACH resource Resource 1 Resource 2 Millions of Users Today Future Attributes … Policy Domain Access List Add EACH User to List Administrator Resource 1 Resource 1 Owner Manual Request Access Request Access Add EACH User Account Resource 2 Manual Single User Users gain access seamlessly- no pre-registration, no delay … … while the services and data remain secure & protected!

UNCLASSIFIED 5 IC/DOD AATT Deliverable Status Each deliverable is being developed by a subgroup of the AATT. Each deliverable team is comprised with both IC and DOD membership. Each deliverable team is co-led by an IC and a DOD representative. Present day all deliverable teams have been established and have completed or are nearly finished.

UNCLASSIFIED 6 AATT Major Contributions Technical –AATT CONOP –AATT Interface Specification –AATT Authoritative Source and Attribute Service Guidelines –ABAC Pilot Workshop & Pilot alignment Policy –Recommendations regarding Authorization and Attribute Policy that need to be developed. Governance –AATT identified the need for ongoing Governance to ensure Compliance with the AATT CONOP Compliance with the AATT Interface Specification Availability of timely, accurate authorization attributes Maintenance of authorization attribute definitions & acceptable values AATT Deliverables provide significant contribution toward the implementation of secure, agile information sharing

UNCLASSIFIED 7 AATT Proposed On-going Tasks Establish Authorization and Attribute Service Working Group –The Phase I set of AATT deliverables is just the beginning for building ABAC solutions. More work is needed in support of IdAM and ESM. –Authorization Attribute Governance Committee – Process to add and maintain attributes list – Monitor Authoritative Sources – Facilitate Community Service Level Agreements –Additional SAML Profile Work Presently leveraging only Attribute Assertions Today: 80% Attribute Service - 20% Authorization Service Follow-on: 20% Attribute Service - 80% Authorization Service – Expand the AATT WG membership – Identify pilot opportunities that include DoD, IC, Coalition and other Federal efforts. – Address Advanced Dynamic Policy Capabilities Address Policy (access rule) tools, portability, hierarchy – Address Attributes for Non Person Entities Users, Systems, Data, Environment, Situation

UNCLASSIFIED Resources Deliverables are available via the following: High Wiki – _and_Attribute_Servies_Tiger_Teamhttp:// _and_Attribute_Servies_Tiger_Team Low Wiki – _Attribute_Tiger_Teamhttp:// _Attribute_Tiger_Team DKO AATT Group – 8

UNCLASSIFIED Point of Contact ABAC Lead Martin Costellic,NII/DoD- CIO

UNCLASSIFIED 10 Discussion and Questions

UNCLASSIFIED 11 Build on the AATT Foundation Recommended Policy & Governance Deliverable Set –AATT Policy Recommendations. Develop the authorization and attribute service IC and DoD policies recommended in the AATT Policy Recommendation paper. –Advanced Policy Recommendations. Develop policies based on lessons learned from pilots and operational deployment. –Governance. Establish governance arm to maintain the defined Authorization Attribute Set and report to the DoD and IC Governance bodies. Example Governance topic: Assess and Approve Changes to the Attributes or Attribute Values, based on need for a new attribute, or change to a referenced attribute set. –E.g. OMB Organization Names.

UNCLASSIFIED 12 Build on the AATT Foundation Recommended Technical Deliverable Set –Policy (access rules) Development. Provide guidance and examples for the development of policies (access rules). –Develop Solutions for Broad set of Partners. Adapt existing AATT solutions and/or develop solutions to provide authorization and attribute services for broader set of partners. –Develop detailed Profile Definition with Industry. Further definition of standard profiles for the AATT Interface Specification, to ensure interoperability between DoD and IC implementations, as well as profiles for additional partners. –Standards Assessment and Recommendation. Assess emerging standards for applicability and possible adoption by the DoD and IC, to include industry adoption of standards. –Investigate Emerging Standards and Solutions. Assess the utility of secure token service that combines authentication & authorization for the IC & DoD. –Pilot alignment. Continue work to align pilot activities.

UNCLASSIFIED Recommended Attributes No.Friendly Name JWICSSIPRNETNIPRNET Baseline Future FY Baseline Future FY Baseline Future FY CitizenshipStatus (Single)XX 2.CountryofCitizenship (Single)XXX 3.Clearance (Single)XXX 4.Cleared* (Single)X 5.SCIControls (Multi)XX 6.DistinguishedName (Single)XXX 7.OrganizationName (Single)XXX 8.UniqueIdentifier (Single)XXX 10.POA (Multi)XXX 11.FASC-N (Single)XX 12.PayGrade (Single)XX 13.PayPlan (Single)XX 14.DutyOccupationalCode (Single)XX 15.PrimaryOccupationalCode (Single)XX *Attributes may be available for use prior to the FY timeframe. 9.EmployeeType (Multi)XXX 13