1. Identity Assurance: When it Matters David L. Wasley Internet2 / InCommon

2. David L. Wasley 2 Service Providers rely on Identity Providers Basic InCommon IdP requirements are Use best common practices Publish what you do Some services need more formal rules When there is risk if identity is wrong Risks vary too …

3. David L. Wasley 3 InCommon Enhanced Identity Services Identity assurance defined by sets of requirements and assessment criteria Initial 2 sets intended to satisfy Federal eAuthentication Levels 1 & 2 See NIST Special Pub 800-63 “Bronze” “Level 1”; “Silver” “Level 2” “Silver” will be required by NIH

4. David L. Wasley 4 Identity Assurance Requirements General areas to be considered include: Business, Policy and Operational Factors Identity Proofing Digital Electronic Credential Technology Credential Issuance and Management

5. David L. Wasley 5 Identity Assurance Requirrements (cont.) Identity Information Management Security and Management of Authentication Events Identity Assertion Content E.g. privacy issues … Technical Environment

6. David L. Wasley 6 Identity Assurance Assessment Essentially an independent “audit” Criteria are defined by InCommon Assessor may be your Internal Auditor if that office is sufficiently independent External auditors may be used InCommon has -no- plans to do audits!

7. David L. Wasley 7 Process will include Notify InCommon of intent Have assessment performed Provide (summary) of audit results If acceptable, then InCommon will require an addendum to the Participation Agreement InCommon will add IdP qualifier(s) to metadata “Bronze” or both “Bronze” and “Silver” IdP then can include qualifiers in assertions Mechanism yet T.B.D.

8. David L. Wasley 8 Q & A ?