PKI use advancing at DOD
Connecting state and local government leaders
The Air Force, Army and Navy have successfully implemented the initial public-key infrastructure technology mandated by the Defense Information Systems Agency, and required under Homeland Security Presidential Directive-12.
In the battle against IT security risks, most of the Defense Department services have a new weapon in their arsenal. The Air Force, Army and Navy have successfully implemented the initial public-key infrastructure technology mandated by the Defense Information Systems Agency, and required under Homeland Security Presidential Directive-12.But officials report that the process has not been trouble-free nor are the challenges over.Navy officials said that virtually all of its personnel now log on to networks using the Common Access Card and a personal identification number, while Air Force officials report usage of 'at least 95 percent.'The Army, meanwhile, said more than 80 percent of its personnel now can log on to its unclassified network using a CAC and personal identification number.Air Force Lt. Gen. Charles Croom, director of the Defense Information Systems Agency, in January set a July 31 deadline for full PKI implementation for user authentication, digital signatures and encryption on all of its desktop and notebook PCs, and servers.DOD has struggled to implement PKI for years because the services did not have the infrastructure to manage the public keys.Before Croom's memo, DOD issued Defense Directive 8500, requiring that e-mail be digitally signed and that online applications and networks use encryption certificates for user authentication.The services never fully met Directive 8500, in part because they had few applications that accepted PKI certificates.But through the wider use of the CAC, that infrastructure slowly is being put into place to make it easier to use digital certificates.Army CIO Lt. Gen. Stephen Boutelle said he was the first in the Army to get a Common Access Card. Thereafter, the program was expanded to his G/6 staff and the Army staff as a whole.'We all had to learn how to get on with dial-up, Cisco [virtual private network], Citrix, DSL and wireless cards,' he said. 'There are nuances to each.'The transition has not been painless. Some personnel were upset that others could not read their encrypted e-mail.'People have learned that security is not necessarily convenient,' Boutelle said. 'Once they understood we were serious, they realized they had to remember their PIN and bring their card to work.'At the Air Force, there were 'huge logistics issues' issuing CACs to over 750,000 users, according to Capt. David Small, a spokesman for Air Force CIO Lt. Gen. Michael Peterson.An additional challenge came in the form of 'getting people to understand that PKI is a technology which enables streamlining of existing business processes and procedures,' Small said.'Most people think of PKI as a thing they can use,' he explained. 'In reality, PKI provides a service to other systems, services and applications. Those other systems, services and applications in turn leverage the benefits of PKI authentication, identification and non-repudiation to provide a more secure offering to their clients.'The ultimate PKI vision will not be complete, Small said, until non-human network subscribers, such as systems, services and applications, are all similarly credentialed.The Navy's biggest challenge was to get individual installations to implement HSPD-12 standards for physical security, according to Navy CIO David Wennergren.'Physical security has always been decentralized,' he said. 'The PKI credential, since it is standard across the Defense Department, becomes a great way to improve physical security. You're seeing more and more bases getting rid of their unique badging systems and moving to the CAC.'The services face a hurdle this fall, when they must start issuing smart cards, which enable the Personal Identity Verification II standard. The Office of Management and Budget has ordered federal agencies to start issuing PIV II cards, which include advanced authentication, biometric and interoperability features, beginning Oct. 27.DOD officials have said they will use a transition card to begin to comply with HSPD-12. They will start issuing PIV II cards in a few years.'There is a way to make the CAC card PIV-compliant,' said Daniel Turissini, chief executive officer of Operational Research Consultants Inc. of Fairfax, Va.'PIV II has a stricter set of data field requirements, which allows for greater interoperability,' Turissini said. 'Right now, the CACs are formatted a little differently and they are still Java-based. PIV will take things to the next level by mandating a true common, standardized card.'
Full implementaion
Logistic challenge
People have learned that security is not necessarily convenient.'
'Lt. Gen. Stephen Boutelle, Army CIO
Olivier Douliery
Full implementaion
Logistic challenge
NEXT STORY: VA to encrypt notebook PCs