Pki a technology whose time has come in higher education educause live web seminar may 11 2004 l.jpg
This presentation is the property of its rightful owner.
Sponsored Links
1 / 31

PKI: A Technology Whose Time Has Come in Higher Education EDUCAUSE Live! Web Seminar May 11, 2004 PowerPoint PPT Presentation


  • 112 Views
  • Uploaded on
  • Presentation posted in: General

PKI: A Technology Whose Time Has Come in Higher Education EDUCAUSE Live! Web Seminar May 11, 2004. Our Systems Are Under Constant Attack. The numbers of vulnerabilities and attack techniques continue to mushroom We need to improve how we secure access to applications and data

Download Presentation

PKI: A Technology Whose Time Has Come in Higher Education EDUCAUSE Live! Web Seminar May 11, 2004

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Pki a technology whose time has come in higher education educause live web seminar may 11 2004 l.jpg

PKI: A Technology Whose Time Has Come in Higher Education EDUCAUSE Live! Web SeminarMay 11, 2004


Our systems are under constant attack l.jpg

Our Systems Are Under Constant Attack

  • The numbers of vulnerabilities and attack techniques continue to mushroom

  • We need to improve how we secure access to applications and data

    Don’t forget the greatest threat often comes from a disgruntled insider.


Some attacks succeed spectacularly l.jpg

Some Attacks Succeed Spectacularly

  • Loss of personal data

  • Outages

  • Potentially huge costs:

    • Productivity loss

    • Remediation

    • User notification

    • Bad publicity

    • Loss of credibility

    • Lawsuits?

  • See “Damage Control: When Your Security Incident Hits the 6 O’Clock News”

    www.educause.edu/ir/library/ra/EDU0307.ram


It security risks escalate l.jpg

IT Security Risks Escalate

  • More and more important information and transactions are online:

    • Personal identity information

    • Financial transactions

    • Course enrollment, grades

    • Tests, quizzes administered online

    • Licensed materials

    • Confidential research data

  • We must comply with increasingly strict regulations:

    • Health information - HIPAA

    • Educational records - FERPA


Specific example email l.jpg

Specific Example: Email

  • Spoofing email is trivial (simple setting in most email clients)

    • Spoofed message from professor postponing a final

    • Inappropriate message seemingly from College President

  • Email is like a postcard written in pencil

    • Others on network can see (or even modify) contents if not encrypted (really easy on wireless!)

    • You may use SSL, but what about other hops between mail servers?

  • Risk of wayward email archives


Specific example student information system l.jpg

Specific Example: Student Information System

  • Online enrollment, schedule, grades

  • FERPA protected information

  • Potentially available to hackers via network

    Q: What if someone hacks your authentication system and potentially downloads students grades?

    A: You are probably obligated by law to notify every individual whose grades may have been exposed!


Password problems user perspective l.jpg

Users HATE username/passwords

Too many for them to manage:

Re-use same password

Use weak (easy to remember) passwords

Rely on “remember my password” crutches

Forgotten password help desk calls cost $25 - $200 each (IDC) and are far too common

As we put more services online, it just gets worse…

Password Problems: User Perspective


Password problems admin perspective l.jpg

Many different username/password schemes to learn, set up, and administer:

Backups, password resets, revoking access, initial password values, etc.

Multiple administrators have access to usernames/passwords – many points of failure

Password Problems: Admin Perspective


Password sharing l.jpg

Corrupts value of username/password for authentication and authorization.

Users do share passwords: PKI Lab survey of 171 undergraduates revealed that 75% of them shared their password and fewer than half of those changed it after sharing.

We need two factor authentication to address password sharing.

Password Sharing


Ending the madness l.jpg

Traditional approaches

Single password

Single sign-on, fewer sign-ons

PKI

Local password management by end user

Two factor authentication

Ending the Madness


Pki s answer to password woes l.jpg

Users manage their own (single or few) passwords.

Cost-effective two factor authentication.

Widely supported alternative for authentication to all sorts of applications (both web-based and otherwise).

PKI’s Answer to Password Woes


Pki passwords are local to client l.jpg

PKI eliminates user passwords on network servers.

Password to PKI credentials is local to user’s computer, smartcard, or token.

User manages the password and only has one per set of credentials (likely only one or two total).

No need for password synchronization.

Standard PKI infrastructure.

Still need process for forgotten password, but it is less likely to be forgotten (used frequently and not so many of them).

PKI Passwords Are Local to Client


Underlying key technology l.jpg

Asymmetric encryption uses a pair of asymmetric keys, each is the only way to decrypt data encrypted by the other.

One key is private and carefully protected by its holder. The other is public and freely distributed.

In authentication, the server challenges the client to encrypt or decrypt something with the private key. Its ability to do so proves its identity.

Private key and password always stay in the user’s possession.

Underlying Key Technology


Pki provides two factor authentication l.jpg

Requires something the user has (credentials stored in the application or a smartcard or token) in addition to something a user knows (local password for the credentials).

Significant security improvement, especially with smartcard or token (a post-it next to the screen is no longer a major security hole).

Reduces risk of password sharing.

PKI Provides Two Factor Authentication


Pki benefit encryption l.jpg

Strong encryption with extensible number of bits in key.

Can use same PKI digital credentials as authentication and digital signatures.

More leverage of the PK Infrastructure.

Encrypt data for any individual without prior exchange of information – just acquire their certificate which contains their public key.

PKI Benefit: Encryption


How pki encryption works l.jpg

Asymmetric encryption prevents need for shared secrets.

Anyone encrypts with public key of recipient.

Only the recipient can decrypt with their private key.

Private key is secret and protected, so “bad guys” can’t read encrypted data.

How PKI Encryption Works


Pki benefit digital signatures l.jpg

Our computerized world still relies heavily on handwritten signatures on paper.

PKI enables digital signatures, recognized by Federal Government as legal signatures:

Reduce paperwork with electronic forms.

Much faster and more traceable business processes.

Improved assurance of electronic transactions (e.g. really know who that email was from).

PKI Benefit:Digital Signatures


How digital signatures work l.jpg

Signer computes content digest, encrypts with their private key.

Reader decrypts with signer’s public key.

Reader re-computes the content digest and verifies match with original – guarantees no one has modified signed data.

Only signer has private key, so no one else can spoof their digital signature.

How Digital Signatures Work


Pki benefit user convenience l.jpg

Fewer passwords!

Consistent mechanism for authentication that users only have to learn once. (UT Houston Medical Center users now request that all network services use PKI authentication.)

Same user credentials for authentication, digital signatures, and encryption – lots of payback for user’s effort to acquire and manage the credentials.

PKI Benefit: User Convenience


Pki benefit coherent enterprise wide security administration l.jpg

Centralized issuance and revocation of user credentials (goes hand in hand with identity management).

Consistent identity checking when issuing certificates.

Same authentication mechanism for all network services.

Single process to recover from lost passwords or keys (not per application).

Leverage investment in tokens or smart cards across many applications.

PKI Benefit: Coherent Enterprise-Wide Security Administration


Interoperability with other institutions l.jpg

Allows authentication, digital signatures, and encryption using credentials issued by a trusted collaborating institution:

Signed forms and documents for business process (e.g. grant applications, financial aid forms, government reports)

Signed and encrypted email from a colleague at another school

Authentication to applications shared among schools (e.g. grid)

Peer to peer authentication for secure information sharing

Interoperability With Other Institutions


Standards based solution l.jpg

Standards provide interoperability among multiple vendors and open source.

Wide variety of implementations available and broad coverage of application space.

Level playing field for open source and new vendors – promotes innovation and healthy competition.

Standards Based Solution


Pki enjoys unequaled client server and application support l.jpg

Commercial and open source

Windows, Macintosh, Linux, Solaris, UNIX

Apache, Oracle, IIS, SSL, Web Services, Shibboleth, Browsers, email, VPN, Acrobat, MS Office, AIM, and many others Software and hardware key storage

Development libraries, toolkits and applications

Certificate Authority, directory, escrow, revocation, and other infrastructure tools

PKI Enjoys Unequaled Client, Server, and Application Support


Momentum outside higher education l.jpg

Industry support for PKI

Federal and State governments major adopters

Microsoft, Sun, Johnson and Johnson, Disney, banks heavy industry adopters

Major deployment in Europe

China pushing WAPI wireless authentication standard that requires PKI

Web Services (e.g. SAML uses PKI signed assertions)

Momentum Outside Higher Education


Federal collaborations l.jpg

FBCA, HEBCA bridge projects

Proof of concept NIH EDUCAUSE project to demonstrate digitally signing documents for submission to the Federal government

Possible DOE, NSF, NIH applications for Higher Education?

Federal Collaborations


Dartmouth pki lab l.jpg

Dartmouth PKI Lab

R&D to make client side PKI a practical component of campus networks

Multi-campus collaboration sponsored by the Mellon Foundation

Dual objectives:

Deploy existing PKI technology to improve network applications (both at Dartmouth and elsewhere).

Improve the current state of the art.

Identify security issues in current products.

Develop solutions to the problems.


Production pki applications at dartmouth l.jpg

Production PKI Applications at Dartmouth

  • Dartmouth certificate authority

    • 780 end users have certificates, 558 of them are students

  • PKI authentication in production for:

    • Banner Student Information System

    • Library Electronic Journals

    • Tuck School of Business Portal

    • VPN Concentrator

    • Blackboard CMS

    • Software downloads

  • S/MIME email (Outlook, Mozilla, Thunderbird)

  • AOL AIM (PKI-secured sys admin communications)


Open source ca in a box l.jpg

“Open Source CA in a Box”

  • Hardened open source Certificate Authority (based on OpenCA) bundle suitable for trial and simple deployment

  • PKI Lab’s “Enforcer” TPM-hardened Linux

    • Controversial “TCPA” technology turned to use for good and freedom (secures Linux boot process and provides much enhanced run-time protection against hackers)

  • Packaging for easy installation (bootable CD)

  • Carefully chosen enhancements to OpenCA

  • We welcome feedback on requirements, contributions, testing, etc!


Deploying pki l.jpg

Deploying PKI

  • Client-side PKI is usually a significant undertaking and requires planning and commitment.

  • Get buy in and support from management, legal, audit, others – a little fear in today’s cyber world is healthy.

  • Learn from examples and experiences of others.

  • Deploy in phases, plan for future extensibility.

  • Choose initial applications to maximize benefits versus cost.

  • Take a long term view - PKI ROI is excellent when leveraged broadly, but probably not as strong for individual applications.

    See www.dartmouth.edu/~deploypki/deploying/


Blatant advertisement l.jpg

Blatant Advertisement

  • We seek a few schools that we can assist as you deploy PKI credentials and applications for end users! An explicit part of our mission is to directly assist you in the planning/justification, implementation, and deployment phases.


For more information l.jpg

For More Information

www.dartmouth.edu/~deploypki

[email protected]


  • Login