1. Level of Assurance

2. LOA LOA classic - The strength of the authentication assertion Depends on identity proofing, delivery of credential, repeated act of authentication, audit, etc LOA 1 – 4 from US Federal Gov LOA modern – The strength of the authorization assertions Depends on, hmm... data administration, security of the attribute repository, and... Sources of Authority, and trees May not be an enterprise control point

3. Why does LOA matter Because we all think our own resources are most important and most in need of good security Because some apps and resources are really important Because the US government says so...

4. LOA Technical Issues Identity Credential Identity Proofing Delivery of credential Repeated act of authentication Enterprise Operations Documentation and management of processes Audit Federation Operations ???

5. More discussion How do we manage the WAYF need What attributes do we use How much do we try to control semantics What LOA do we use Virtual organization support Change of contracts Dispute resolution Impact of international peering

6. A Few Thoughts We have come a very long way The real pay-offs are still ahead Sometimes the needs of our community are not different from the other sectors, but just ahead of the curve. This is getting bigger than we are... Some of our conversations should move somewhere else Everyone's English has really improved, except perhaps mine...