Presentation at the MAPS/QUESTnet identity management workshop, Emmanuel College, The University of Queensland, 18-19 August 2008

Viviani Paz, AusCERT

University of Queensland eSpace

1Identity Management 
dan
Joining the AAF
Presented at IdM Workshop
19th August 2008
1
Viviani Paz, AAF Project Manager, AusCERT
aaf@aaf.edu.au
Content
• HE & Research State of Play
• AAF Overview 
• What do Universities need to do?
• Conclusion
2Copyright © 2007 AusCERT   
2HE & Research State of Play
3
HE & Research State of Play
• Increase in the number of phishing attacks on 
universities.
4Copyright © 2007 AusCERT   
3HE & Research State of Play – Recent 
spear-phishing developments
5Copyright © 2007 AusCERT   
HE & Research State of Play – Recent 
spear-phishing developments
6Copyright © 2007 AusCERT   
4HE & Research State of Play – Recent 
spear-phishing developments
7Copyright © 2007 AusCERT   
What can universities do to minimise this threat?
• Educate users
HE & Research State of Play
• Use digitally signed emails
• Use stronger authentication to student records, HR 
systems, financial systems
8Copyright © 2007 AusCERT   
5Government funding
• Increasingly, expensive research infrastructure is a 
joint enterprise of m ltiple research instit tions
HE & Research State of Play
   u   u
– e.g., LIEF-funded equipment or facilities under NCRIS
• Access to the infrastructure itself, or to data from it, 
is typically restricted to researchers from a defined 
collection of research institutions
9
• Research collaboration at distance
Copyright © 2007 AusCERT   
• Privacy and legal environment is changing
– Privacy Policy Review
– Contractual obligations
HE & Research State of Play
• Increase in online access
– Students enrolments and obtaining results
– Learning and service delivery to geographically dispersed 
audience
• Increase in cross-institutional enrolments
10
• Increase in the number of overseas students
• Increase of electronic services that support sensitive 
and critical data
Copyright © 2007 AusCERT   
6HE & Research State of Play
Educause Top-Ten IT Issues, 2008
– By Debra H. Allison, Peter B. DeBlois, and the 2008 EDUCAUSE 
Current Issues Committee
http://connect educause edu/Library/EDUCAUSE+Review/TopTe– . .
nITIssues2008/46605
1. Security 
2. Administrative/ERP/
Information Systems
3. Funding IT
4 I f
7. Governance, Organization, 
and Leadership
8. Change Management
9. E-Learning / Distributed 
T hi d L i
11Copyright © 2007 AusCERT   
. n rastructure 
5. Identity/Access Management
6. Disaster Recovery / Business 
Continuity
eac ng an  earn ng
10. Staffing / HR Management / 
Training
HE & Research State of Play
Identity and Access Management Survey,  2008
• Does your institution have a main directory for identity 
management that contains all staff, students, and affiliates?
62% Y–  - es  
• Does your institution proactively manage the currency 
of user accounts, disabling accounts when a user leaves 
the institution?
– On-campus students – 84% - Yes
Off d 84%
12
–  campus stu ents –  - yes
– Academic and general staff – 75% - Yes
Copyright © 2007 AusCERT   
7AAF overview
13
What is the Australian Access Federation? (1)
Facilitator for trusted electronic communications and 
collaboration within and between institutions of higher 
education and research in Australia and other 
organizations worldwide
14Copyright © 2007 AusCERT   
HEBCA
8• Infrastructure built to support access to 
diverse online resources and services for the 
sector
What is the Australian Access Federation? (2)
– Two technologies
• PKI and Shibboleth
• AusCERT Root Certificate in vendor’s Trust 
Lists
15
– Simplify the end user experience
– Signed server certificates issued through 
the AAF
– Microsoft, Mozilla, Apple
Copyright © 2007 AusCERT   
PKI and the AAF
16
9The use of PKI in the AAF
Spear-Phishing
• Sound PKI is effective in increasing integrity, 
confidentiality and non-repudiation of information 
shared
– PKI links entities, to cryptographic keys,            
through certificates, enabling scalable                      
trust to a defined quality
– PKI provides strong authentication mechanisms.
– PKI certificates support the use and validation of digital 
i t d ti f d t d il
17Copyright © 2007 AusCERT   
s gna ures an  encryp on o  ocumen s an  ema s.
– Server certificates can positively identify the 
organisation behind a web site and Shibboleth identity 
and service providers.
What can we use PKI Certificates for?
• Server and host security,  i.e. SSL, TLS, VPN, etc
• Authentication
• Digital signing of documents/emails
• Encryption of documents/emails
18Copyright © 2007 AusCERT   
10
AAF PKI Overview (1)
• AusCERT Root Certificate
– In browsers: Microsoft, Mozilla, Apple
Definitions:
CA – Certification Authority
V&D – Validation and Discovery
SLCS – Short Lived Certificate System
VHO – Virtual Home Organisation
19Copyright © 2007 AusCERT   
AAF PKI Overview (2)
• Server Certification Authority
– Issues digital certificates to servers/hosts
• University servers/hosts
• Research (For Servers running Grid servers)
• Shibboleth backchannel
• Client Certification Authority
– Issues digital certificates to end users
20
• Universities 
• Research (Grid)
– Standard and Short lived certificates (SLCS)
• Virtual Home Organisation individuals
Copyright © 2007 AusCERT   
11
Wh t d U i iti d t d ?a  o n vers es nee  o o
PKI
21
University Responsibilities (1)
• Sign AAF member agreement
• Assign a point of contact/official representative (I.e. IT 
Director)
• Provide access to email service and web
browser to its staff/students
• Observe the 100 point check for identification of staff 
performing the Registration Authority Role
– HR and Enrolment process may be sufficient
22
• For example staff that has been with the university for over 3 
years
• Fill in Registration Authority Officer form
Copyright © 2007 AusCERT   
12
University Responsibilities (2)
• RAO has the authority to approve or reject a request 
for a certificate which includes the name of his 
institution in the subject (O=…)
• Institution will be accountable if fraudulent certificate 
requests are approved by the RAO 
• Institutions are the foundation for assuring the quality 
of PKI certificates issued within the AAF
23Copyright © 2007 AusCERT   
Register Authorised Personnel to request 
Certificates (1)
• Institution joins the AAF and assigns an Official 
Representative (OR), for example IT Director
• Institutions must identify who will perform the 
Registration Authority Officer Role (RAO)
– For example hostmaster (3 to 5 people).
– Institution may identify others within its faculties that 
may need to request certificates, such certificate requests 
b i h RAO h i i i
24
must e sent v a t e  at t e nst tut on.
– Institutions are responsible for the accuracy of their 
certificate requests.
Copyright © 2007 AusCERT   
13
Register Authorised Personnel to request 
Certificates (2)
• RAO must be identified at member institution
• RAO registration form needs to be signed by OR and          
submitted to AAF Operator
• Following checks with OR, RAO will be issued with 
a certificate to be used to request certificates on 
behalf of its institution
25
   .
Copyright © 2007 AusCERT   
Example:  Requesting End User certificate
Request
ProcessInstall/Use
26Copyright © 2007 AusCERT   
Approve
Issue
Collect
14
Example:  Requesting End User certificate
27Copyright © 2007 AusCERT   
Summary
• AAF is breaking new ground!
• Lessons learned from other federations and tackling 
issues early
– integrated PKI/Shibboleth, framework for assurance 
levels, structured to allow evolution
• People are getting behind the AAF: Grid, WGs, SC, 
DIISR, trials (SharedToken)
• Input requested and received from community
28
• Environment is changing, the AAF will help you respond 
– addressing real needs
• Pilots completed now building production infrastructure
Copyright © 2007 AusCERT   
15
Conclusion
• AAF is designed to ensure a continued focus on the 
community it serves, so you join with confidence
• AAF will facilitate easier access to technology and a         
streamlined framework for collaboration and access 
to resources
• You can be involved right now and start preparing
• Timeframe
To commence operations by the end of 2008
29
–         
– Institutions and service providers to join progressively 
during 2009
• More information: http://www.aaf.edu.au
Copyright © 2007 AusCERT   
Discussion……
f
30
www.aa .edu.au
Queries/Comments: aaf@aaf.edu.au


Identity management and joining the AAF. Workshop presentation 19 Aug 2008

https://espace.library.uq.edu.au/view/UQ:152814/Viviani_Paz.pdf

Identity management and joining the AAF. Workshop presentation 19 Aug 2008

Abstract

Similar works

Full text

Available Versions

University of Queensland eSpace