Information Assurance . . . Smart Card Interoperability

1. Information Assurance . . . Smart Card Interoperability Steve Haynes steve.haynes@us.pwcglobal.com Phone - 703-653-7140

2. Centralized Computing Decentralized Computing Mission Survivability Several Centralized Admin. Teams IT Security Management Management Approach Pager-based fire fighting Centralized Admin. Team Desktops across the company Unlimited Across the world Location Central Data Centers Regional Data Centers Limited Across the world Internet/ Extranet Corporate Net/ Internet Technology Mainframe Minicomputers Client/Server PCs Time AD (Assured Doubt) BC (Before Computers) First Civilization Age of Empires Dark Ages Age of Enlightenment Were We’ve Come From

3. Objective? “Most people overestimate what is going to happen in two years and underestimate what is going to happen in 10 years.” Bill Gates - Microsoft

4. High Nation-State Attack Access Cost 2005 Potential Damage Terrorist Attack Access Speed 2003 1999 Access Criminal Activity Hackers Low Probability of Occurrence LowHigh Were We’re Going WirelessAccess

5. Mission Statement Information Assurance: Conducting those operations that protect and defend information and information systems by ensuring confidentiality, integrity, availability and accountability. This includes providing for restoration of information systems by incorporating protection, detection and reaction capabilities.

6. Objective? Too Much Access Security Access • Exposure to risk • Loss of confidentiality • Loss of integrity • Loss of resources • Intentional theft • Accidental loss

7. Objective? Too Much Security Access Security • Loss of productivity • Sense of restriction • Uncooperative users • Too much time to access (passwords) • Write passwords down • Bypass security

8. Objective? Balance: Information Assurance Access • Comfort • Convenience • Customization • Independence • Privacy • Confidentiality • Integrity • Accountability • Availability • Restoration

9. Smart Cards The Smart Card?

10. Data storage access via Internet Smart Card Memory Single app.- stored value (chip cards) Microprocessor Multi-app. capability (“really smart” cards) Disposable anonymous 64 bits - 64K bits Reusable personalized PIN Standard processor 1-16K memory 2 Processor crypto engine (Mondex) Biometrics PKI Smart Cards Technical Applications: Note: All Smart Cards have microprocessors. For the most part they have been used as memory cards. All Smart Cards have the capability but due to limited apps, and memory, they are used as storage cards.

11. Smart Cards Functional Applications: • Stores Data • Routs Transaction To Where Data Is Being Stored • Converts & Manipulates Data into Interactive Information • Assures Information is Protected • Combines Physical And Technical Access Control • Transmits Transactions Securely • Authenticates Access • Combines Multiple Card Requirements (API) • Role Based Access Control • Single-Sign-On • PKI • Biometrics • Privacy

12. Objective? The true attraction of a smart card is not a purse to carry electronic money, but a purse to carry around all the various pieces of information that currently take up one dedicated card apiece

13. Router Router Router Router Interoperability Internet FTP Server HTTP Server Mail Server PDC / BDC FTP Server Mail Server HTTP Server Remote User Data Servers File Servers Data Storage Internet Access WS: Win9X/NT/2000 PDC / BDC Data Servers File Servers FTP Server Mail Server HTTP Server FTP Server HTTP Server Mail Server Remote User WS: Win9X/NT/2000

14. Information Assurance Data storage access via Internet Smart Card Memory Single app.- stored value (chip cards) Microprocessor Multi-app. capability (“really smart” cards) Disposable anonymous 64 bits - 64K bits (Danmont) US$0.70 Reusable personalized PIN (no FSI) US$1-3 Standard processor 1-16K memory (Proton, most FSI) US$3-6 2 Processor crypto engine (Mondex) US$8-15 PKI Biometrics Information Assurance Private

15. Objective? So ... A smart card may look as a card, but it is actually the smallest portable computer in the world !!!

16. Application 1 Application 2 Application 3 Application 4 Integration Approach Provide the “best practice” infrastructure A Smart Card is a Multi-application solution business

17. Challenges Questions: • What do I do if my card is lost or stolen ? • How are they replaced ? • Who provides customer service and how is it made seamless to the employee using it ? • Who is going to develop, certify, install and upgrade the applications ? • How are privacy, accuracy and security insured ? • What are the industry (hardware & software) standards? • Who can integrate all this to make it work?

18. Consumer electronic companies Consumer software companies Electric utilities Cable companies Information providers Disintermediation The poor consumer Payments Transactions Bank/ financial services Database creation Retailers Communications companies Implementation Approach Smart Card can hide the complexity and end the confusion Build and manage “Communities of Interest” • The consumer demands : • Comfort • Convenience • Customization • Independence

19. Objective? Smart Cards are a reality not a technology looking for an application

20. Smart Card QUESTIONS?