The Decision to Buy vs. Build Nicholas Davis PKI Project Manager

1. The Decision to Buy vs. BuildNicholas Davis PKI Project Manager

2. Overview • History of PKI at UW-Madison • UW-Madison IT environment • Our PKI requirements • Comparison of benefits we found in buy vs. build • Our experience so far • Integration with existing systems • Critical success factors • Summary of benefits • Future considerations • What we have learned • Questions and comments

3. History of PKI at UW-Madison • October 2000 Internet2 Public Key Infrastructure Lab established at UW-Madison. • 2001 Secure email pilot study

4. History of PKI at UW-Madison • 2002 Provided certificates to Shibboleth testing community and participated in Federal Bridge Pilot project

5. History of PKI at UW-Madison • 2004 Campus requirements gathering initiative • Spring 2005 RFI review • August 2005 Geotrust selected

6. How UW-Madison Differs From Peers • Faculty, Staff, Students • Highly decentralized • Public institution • Research driven environment

7. Core Requirements • Automated certificate delivery • Used for encryption, digital signing and potentially authentication • Off site key escrow • Transparency to end user • Global trust • Implementation within 6 months • Minimum “lock in” commitment

8. Up Front Development Costs • Gartner Group estimates that the average commercial PKI system costs $1 million to implement • 80% of PKI systems never get beyond “pilot” status • Our estimated first year costs are substantially less than this

9. Project Features • Time • Cost • Features • Quality

10. Time to Implement -- Build • To develop our desired feature set would require 2 full time programmers for 12 months • Cost of establishing sandbox, QA and production environments • Hardware acquisition: secure cage, network equipment, Certificate Authority, Registration Authority • CP and CPS statements would need to be written and reviewed by DoIT management and UW Legal • Estimated time to implement: 12 months

11. Time to Implement -- Buy • 1 FTE would be needed to act as Administrator • Upon completion of purchase contract, system would be immediately ready • No need to establish sandbox, and QA environments. • Estimated time to implement: 4 weeks

12. Projected costs for an aggressive PKI rollout schedule -- Build Year 1 system costs 5000 users ~$50,000 2 FTE (salary and benefits) ~$200,000 Total Year 1 costs: ~$250,000 Year 2 and beyond (annual costs) 5000 users ~$0 2 FTE (salary and benefits) ~$200,000 Total annual costs ~$200,000 10 year cost ~$2,050,000

13. Projected costs for an aggressive PKI rollout schedule -- Buy Year 1 System costs 5000 users ~$43,000 1 FTE (salary and benefits) ~$100,000 Total yearly costs = ~$143,000 Year 2 and beyond (annual costs) 5000 users ~$43,000 1 FTE (salary and benefits) ~$100,000 Total annual cost $143,000 10 year cost ~$1,430,000

14. Feature Set – Trusted Root -- Build Unsigned Root means distrust both within and outside our core universe

15. Feature Set – Trusted Root -- Buy Seamless trust let’s us play globally via the Equifax Secure eBusiness CA1

16. Feature Set – Key Escrow -- Build Logistical, financial and political issues with building true off site key escrow

17. Feature Set – Key Escrow -- Buy Keys are securely kept in Atlanta, GA

18. Feature Set – Distance Users -- Build Logistical issues with getting certificates to users who are geographically distant.

19. Feature Set – Distance Users -- Buy All the user needs is a web browser in order to get their certificate

20. Service -- Build • Supporting a PKI in house would require dedicated staff to work on monitoring system health constantly

21. Service -- Buy • True Credentials is constantly monitored, patched, upgraded and backed up by Geotrust at their operations center in Atlanta, GA

22. Our Experience So Far • Customers appreciate: • Automated certificate delivery • Trusted Root • Key Escrow • Uses: • Using certificates for digital signing • Using certificates for encrypted email

23. Integration With Existing Systems • Easily scalable – Load users in CSV format in batch • Public keys are exportable to LDAP and University White Pages • CRL is automated via True Credentials system • Third party software available for high assurance server authentication

24. Critical Success factors for the UW-Madison • A focus on the customer requirements is of pinnacle importance • Financial lifecycle modeling for both short and long term • Being careful not to reinvent the wheel simply for the sake of pride • Top down support from the CIO’s office

25. Summary Benefits of Buying • Lower upfront fixed costs • Lower 10 year costs • Faster road to implementation • Trusted Root • Off Site Key Escrow • Automated certificate delivery • UW-Madison common look and feel • No long term lock in

26. Future Considerations • The beneficial cost argument may change if our user population grows dramatically • Widespread adoption of the Federal Bridge may alter our reliance on a commercial pre-installed root

27. What We Have Learned • A certificate is a certificate • What matters most is what your organization does with the certificate once it is issued • The challenge of implementing PKI is 30% technical and 70% user education, marketing and acceptance

28. What We Have Learned • The key to success in a decentralized environment lies in motivating your users, not obligating your users • Whether you choose to build or buy, remember to keep it simple for the customers • Don’t spend time on duplication of effort

29. Questions and Comments Nicholas Davis PKI Project Manager University of Wisconsin-Madison ndavis1@wisc.edu 608-262-3837 www.doit.wisc.edu/middleware/pki