Embed Size (px)
Citation preview
PKI Records Management and Archive Issues
October 10, 2002Phoenix, AZ
Charles DollarDollar Consulting
ECURE 2002
Agenda
1. Introduction/Orientation2. Digital Communication3. What is PKI?4. PKI Administrative Records Functions5. PKI Operational Records v. PKI
Electronic Recordkeeping Requirements
6. Recommendations
PKI Case Study: Overview Not a PKI tutorial Work for the National Archives and
Records Administration Opportunity for records
managers/archivists
Digital communication Closed and secure (national
defense, VPN)
Open and secure (SSL)
Open and non-secure (PKI)
PKI a ‘hot technology” E-Commerce
E-Governance
State of Illinois
What Is PKI?
A PKI is an asymmetric cryptography security environment that supports the transmission, delivery, and receipt of digital communications over a non-secure communications channel.
What Does PKI Do?
Authenticates sender of digital communications
Protects integrity of digital communications
Key Pair Private Public
Trusted third party
How PKI Works in Digital Communications
Hash Digest Values
337.60 KB
AaAEAACoAQAKAGjhX84+VC1d3)NgDiPHvG+/R8hKCAUCACOvWKATFOYIz3XS5gAAgI1wrAKO1geAAAAAAAAAAAAAAAA=
337.60 KB
AaAEAACoAQAKAGy2YV8gORjFeuf3yfnn7V)QMKBCgKywNfTD+avB8UVEYKAAAoUB2gKo1gEAALgAAAAAAAAAAAA=
Key PKI management concepts PKI standard: X.509 Certificate Policy (CP): What Certificate Practice Statement
(CPS): How PKI administrative records v. PKI
transaction records Little or no good practice guidance
Certificate Policy (CP) for Access Certificates for Electronic Services General Provisions Identification and Authentication Operational Requirements Physical, Procedural, and Personnel
Security Controls Technical Security Controls Certificate and CRL Profiles Policy Administration
CP Operational Requirements
Certificate Issuance & Acceptance Certificate Suspension & Revocation Computer Security Audit Procedures Records “Archival” Compromise & Disaster Recovery
Certificate Practice Statement (CPS)
To Be Discussed LaterUnder PKI Operational andElectronic Recordkeeping
Requirements
PKI Records
ALL PKI RECORDS
ADMINISTRATIVE RECORDS TRANSACTION RECORDS
UniqueAdministrative
Records
SupportingAdministrative
Records
Subscriber Use ofDigital Signature
ALL PKI RECORDS
ADMINISTRATIVE RECORDS TRANSACTION RECORDS
UniqueAdministrative
Records
SupportingAdministrative
Records
Subscriber Use ofDigital Signature
PKI Administrative Records
PKI Administrative Records Guidance Constraints PKI records are not unique
PKI operational system v. PKI recordkeeping system
Some PKI records are paper-based
PKI functions
Plan/define PKI Establish, startup, install Operate Audit/monitor Reorganize/dismantle
PKI Functions, Activities, and EXAMPLE Records
Function Plan/Define Establish OperateAudit/
MonitorReorganize
Activities
ExampleRecords
Develop business planAuthorize projectDevelop project planPersonnel requirementsIn/out source analysisDevelop Certificate PolicyDevelop Certificate Practice StatementDevelop Certificate Profile
Project AuthorizationProject planIn/out source analhysis decisionCertificate PolicyCertificate Practice Statement
Select Certificate Authority and Registra tion AuthoritySelect/establish CertificateRepositoryEstablish Certificate ArchiveCreate CA signatureInternal -install and test Hw/SWTest security
Analysis/selectionrecords for CA andRA3rd Party validation recordsCA keyInstallation recordsTest recordsSecurity procedures
Identity proof and register usersIssue digital certificatesEstablish CRLMaintain CRLSuspend/revoke certificatesRenew certificatesHire, train staffInstall HW/SW updates
Identity proofingrecordsSubscriberagreementIssuance/rejection ofcertificatesCertificatesCRLAudit trailk of CRL changesJob applications and training records
Monitor external securityInvestigate internal fraudInternal audit of HW/ SW securityExternal audit of HW/ SW securityCreate audit trail of PKI eventsCA/RARenewal approval
Investigative reports and disciplinarry reportsInternal aduit reportsExteranl audit reportsAudit trail of PKI eventsCA/RA renewal, approval documents
Create plan to reorga- nize, consolidate, or terminateApprove terminationNotyify subscribersTransfer inactive keys and CRLs to storageTransfer consenting suscribers to newCA
Decisionn documentsPlan to reorganize or terminate CAList of subscriber notificationSubscriber transfer documentationApproval of termination
Example Operate Functions and Related Records
Identity proofing recordsSubscriber agreementIssuance/rejection of certificatesCertificatesCRLAudit trail of CRL changesJob applications and training records
Identity proof and register usersIssue digital certificatesEstablish CRLMaintain CRLSuspend/revoke certificatesRenew certificatesHire, train staffInstall HW/SW updates
Functions Records
PKI Requirements Overview
PKI Record captureOperational
1. Accurate and complete at or near the time of the event
2. Event log that tracks all activities associated with capture
3. Automatic population of record series title, disposition, and vital records status
Recordkeeping
1. As database tables or as “rendered for viewing”
2. Technology neutral formats
3. Paper-based records4. Document transfer of
records to ERS5. Confirm integrity of
transferred records6. Complete and accurate
transfer of metadata
PKI records metadata
Operational
1. Augment event log data with series title, retention period, vital record status
2. For each unique eventCommon nameCertificate numberDate of eventDistinguished name
3. Restrict changes in metadata to authorized persons
Recordkeeping
1. Minimum attributes specified in operational requirements
2. For CP and CPS use registered Object ID
3. View/print complete metadata
4. Computer generated unique id for each record
5. Record location of electronic and paper records
6. Human readable bar code for all paper records
7. Restrict changes to authorized persons
Recommendations Become knowledgeable about X.509 Get involved in PKI discussions NOW Understand the differences between
operational PKI systems and PKI recordkeeping requirements
Adopt/implement federal government guidance
Don’t accept “we can’t do that” from IT and PKI vendors
Make the risk management argument
Summary
Topics covered
Seize the opportunity
Questions?
