Subject: Re: [VoT] Trust Framework Comparisons

From: Eric Goodman <[email-masked]>
Date: Wed, 21 Jan 2015 21:05:05 +0000

>Is there a normalized set of assertion requirements? I don't know. 
>There are a few communities that have described their requirements 
>but, in my opinion, I am not sure how easy it is to compare and 
>contrast these descriptions In a manner that might generate a normalized 
>set. This might be a fantastic Masters degree analysis that some enterprising 
>student might undertake. Or, if some federation could find the funding, 
>that a consultant could undertake.

At REFEDs I heard mention of a comparison document someone (Nicole Harris?) may have put together comparing “6 different trust frameworks”. I’ve been successful at finding links that seem to imply such a thing exists, but haven’t been able to find the actual document, so I’m not sure if it’s relevant. I'm interested in seeing a similar comparison. Can someone identify from my vague description what the document is that was mentioned, if it's relevant to this discussion, and perhaps where that document can be found?

Thanks,

--- Eric

---

From: Colin Wallis <[email-masked]>
Date: Thu, 22 Jan 2015 02:48:17 +0000

https://refeds.terena.org/index.php/Federations

Coming to you courtesy of the Kantara eGov WG..

Cheers
Colin

-----Original Message-----
From: vot [mailto:[email-masked]] On Behalf Of Eric Goodman
Sent: Thursday, 22 January 2015 10:05 a.m.
To: [email-masked]
Subject: Re: [VoT] Trust Framework Comparisons

>There are a few communities that have described their requirements but, 
>in my opinion, I am not sure how easy it is to compare and contrast 
>these descriptions In a manner that might generate a normalized set. 
>This might be a fantastic Masters degree analysis that some 
>enterprising student might undertake. Or, if some federation could find 
>the funding, that a consultant could undertake.

Thanks,

--- Eric

_______________________________________________
vot mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/vot

---

From: Nicole Harris <[email-masked]>
Date: Thu, 22 Jan 2015 09:20:57 +0100

Hi Eric

I think that might have got a bit lost in translation.  I carried out a
comparison of all the policies used by the different R&E Federations. 
That work is available over on the wiki:
https://wiki.refeds.org/display/FBP/Federation+Policy+Best+Practice.  It
is more an exercise in trying to bring the R&E space to a standard
baseline.  We also took several of the more mature and compared them to
the Kantara Assurance Framework and the OIX-FICAM framework.  That info
is on the wiki under the assurance tab....it is all very R&E specific. 

In terms of assurance, REFEDS is doing 2 things at the moment.  Firstly
trying to make it easier to identify what "baseline R&E federation
assurance" looks like to other people as we have been absolutely rubbish
at documenting well enough in the insular world of R&E. 

Secondly, we have pretty much thrown out all discussions on frameworks,
authentication strength, profiles etc and instead we are asking the
communities that we are working with what risks they are trying to
mitigate and what the business impact is...so we are working with people
like the SIRTFI folk on a profile looking at security incident response:
https://wiki.refeds.org/display/GROUPS/SIRTFI.  This goes a bit beyond
the notion of having "confidence in the asserted identity"....but is
more about confidence in a system as a whole and a belief that this can
be done to a high level of assurance for that given community, but
doesn't necessarily mean that an organisation has one time passwords,
has verified the signature on a governmentID etc.

So what we will probably end up with is a limited set of assurance
profiles (not levels) that work for large cases in our community, and we
of course then need to ensure that these can be well understood / mapped
outside that space where necessary and that for me is where VoT comes
in.  That's a horribly simplistic way of describing things I know....I'm
often guilty of over-simplifying :-)

Overall, we may have some reasonably well developed case-studies on what
risks our communities are trying to mitigate and what they need to be
assured of to let users in that I hope might be interesting to this
group in the long-term. 

Cheers

Nicole

-- 
Nicole Harris
Project Development Officer
GÉANT Association Amsterdam Office (formerly TERENA)
Singel 468 D, 1017 AW Amsterdam
The Netherlands
Skype: harrisnv
M:+31 64 610 53 95

---

From: Ken Dagg <[email-masked]>
Date: Thu, 22 Jan 2015 12:30:30 -0500

Nicole,

I am not sure of this work that was done by the Government of Canada to
standardize how this community defined the risks associated with identity
assurance. It might prove useful to your communities.

http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=26776

Ken

On Thursday, January 22, 2015, Nicole Harris <[email-masked]> wrote:

> > From: vot [mailto:[email-masked] <javascript:;>] On Behalf Of
> Eric Goodman
> > To: [email-masked] <javascript:;>
> > At REFEDs I heard mention of a comparison document someone (Nicole
> Harris?) may have put together comparing “6 different trust frameworks”.
> I’ve been successful at finding links that seem to imply such a thing
> exists, but haven’t been able to find the actual document, so I’m not sure
> if it’s relevant. I'm interested in seeing a similar comparison. Can
> someone identify from my vague description what the document is that was
> mentioned, if it's relevant to this discussion, and perhaps where that
> document can be found?
> >
> > Thanks,
> >
> > --- Eric
> >
> >
> >
> > [email-masked] <javascript:;>
> > [email-masked] <javascript:;>
> [email-masked] <javascript:;>