1. PKI @ WSU A Symphony in Four Movements

2. A Century of Controlled Flight

3. The Symphony  Phase I Certificates for AD  Phase II Cross Certification of WSU VPN  Phase III Certificate Enrollment Extended Beyond AD/User Certificates  Phase IV Cross Certification with External Agencies

4. What is PKI?  PKI (Public Key Infrastructure) is a technology for exchange digital information in a secure manner  Based on Public Key Encryption  Composed of: –Digital Certificates –Certificate Authority –Digital Key Technology (public key, private key) –Policies and Procedures

5. Why Does WSU Need a PKI?  Originally Driven by the Need to Secure Replication  Desire to Eliminate 3 rd Party Certificates for Intranet SSL  Raise Security Awareness

6. PKI Architecture  Stand Alone – Offline – Root CA (Virtual Machine)  Enterprise Subordinate CA  Stand Alone Subordinate CA

7. Phase I Certificates for AD  Root and Enterprise Certificates via Group Policy  Machine Certificates (Auto Enrollment)  Enables IPSec  Enables SSL (Web Servers, Secure LDAP)  Enables Secure Applications (SCS, etc.)  Root and Enterprise Certificates Available for Download for non AD Users

8. Phase I Limitations  No User Certificates  WSU VPN is Not Part of the Trust  Not Intended for Use Outside of AD  External Agencies Must Accept our Certificate Blindly

9. Phase II Cross Certification of WSU VPN  Brings IT-CA Into the Fold –Limits Number of CA’s at WSU  Brings the External Hardware Into the Mix for Potential of Non-AD Users and Computers Getting Certificates  Requires Server 2003 on Both CA’s

10. Phase III Certificate Enrollment Extended Beyond AD/User Certificates  Policies Must Be in Place  Not a Foregone Conclusion  Enables Secure User Activities –Encrypted Email –EFS (with Domain/OU Admin Recovery)

11. Phase IV Cross Certification with External Agencies  The Ultimate Goal  Provides for Secure e-Commerce with a Variety of Agencies  Also NOT a Foregone Conclusion

12. What Next?  Deploy Phase I  Prepare and Deploy Phase II  Investigate all of the Policies Needed for Phase III and Phase IV  Assemble the Interested and Necessary Parties  Write and Approve Policy

13. Resources  PKI & AD – http://www.wsu.edu/ad http://www.wsu.edu/ad  PKI & WSU - http://pki.wsu.edu http://pki.wsu.edu  Terms & Definitions - http://pki.wsu.edu/glossary http://pki.wsu.edu/glossary  This Presentation – http://pki.wsu.edu/show http://pki.wsu.edu/show  Phase Images http://pki.wsu.edu http://pki.wsu.edu