Kantara Initiative Identity Assurance WG Teleconference

Date and Time

• Date: Thursday, 12 September 2013

• Time: 07:00 PT | 10:00 ET | 14:00 UTC (time chart)

• United States Toll +1 (805) 309-2350
  Alternate Toll +1 (714) 551-9842
  Skype: +99051000000481

  • Conference ID: 613-2898

• International Dial-In Numbers

Agenda

1. Administration:

   1. Roll Call

   2. Agenda Confirmation

   3. Minutes approval: IAWG Meeting Minutes 2013-09-5

   4. Action Item Review

   5. Staff reports and updates

   6. LC reports and updates

   7. Call for Tweet-worthy items to feed (@KantaraNews or #kantara)

2. Discussion

   1. Charter Refresh (continuation)

   2. Status update: Glossary

   3. Status update: Resilient Networks

   4. Status update: Call for comments on ISO 29003 draft clauses

3. AOB

   1.  

4. Adjourn

 Attendees

Link to IAWG Roster

As of 1 July 2013, quorum is 5 of 9

Voting

• Scott Shorter

• Matt Thompson

• Rich Furr (V-C)

• Cathy Tilton

• Myisha Frazier-McElveen (C)

• Andrew Hughes (S)

Non-Voting

• Peter Alterman

Staff

•  None

Apologies

• Bill Braithwaite

• Richard Wilsher

Notes & Minutes

Administration 

Minutes Approval

IAWG Meeting Minutes 2013-09-5

Motion to approve minutes of 2013/09/05: Rich Furr
Seconded: Matt Thompson
Discussion: None
Motion Passed 

Action Item Review

See running table below

Staff Updates

• Director's Corner Link

• Event Radar 2013 and 2014

•  None this week - holding an off-cycle call 18 September to get Charter update statuses

• None this week

Discussion

Charter Refresh

The current working version of the Value statement is:
"Kantara exists to develop and/or operate rules for operators of online services, enabling verification of  the trust layer providing high-value, privacy-preserving identity and access."

Discussion 12 September 2013:

Reviewed updated draft

• General agreement that 2 Vice Chairs would be preferable - one technology, one policy

• "As IAF improves, users of IAF see potential reduction in identity related fraud risk"

• Look for synergy between IAWG and HIAWG work on multi-TF harmonization

• CSP point of view - forum for influencing the IAF to meet market requirements. Measurable set of criteria to build systems and proceses and policies against.

• Assessors: Standardization of assessment processes. Forum for influencing IAF toward more streamlined and standardized.

• CSP Customers: IAF allows CSP to assure and customers to be more confident in trust worthiness of services

• Assessor Customers: Assessed entities risk of weak implementation of services is reduced.

• As a discussion forum: IAWG gives an opportunity to work with assessors and Kantara resources to help understand the Approval processes and requirements

• As a discussion forum: IAWG is essential for understanding the overall Approval processes - on ramping new entities getting into Trust Frameworks

• Scope: include 'edit/author the IAF itself

• Scope: Engaging other parts of Kantara to improve the IAF/expert knowledge

• Out of Scope: looks fine

• Question: if an Applicant has technology that is not described in 800-63, how does Kantara deal with evaluation of equivalency. 

  • If going for FICAM approval, need to be assessed against the FICAM Technical profile - that's where the risk assessment of the technology must happen

  • For non-FICAM - the analysis by Kantara is appropriate. Perhaps the Federation Interoperability group would be the place for technical evaluation discussions for non-FICAM approvals

  • IAWG could contribute to a Report that does an analysis of the technology from a policy perspective - would need other WGs to contribute from a technology evaluation perspective.

• Technology agnostic: add "to the extent possible"

• ACTION: Andrew to update Charter working drafts

Discussion 5 September 2013:

These bullets are instructions to the draft charter editor - they will be reflected in the working copy at 2013 IAWG Charter Refresh - Fall 2013 - markup working draft

• Align the draft charter text with the text in the glossary

• The 'communication' bullet is for the purposes of evolving the IAF; include an outreach and communication part

  • "Understanding the requirements of the marketplace and informing and influencing the marketplace"

• Determine equivalence of other TF schemes to the IAF; validate profiles that accommodate the other TF schemes; 

• Include 'sector and trade association' in the list

• Discussion of 'value added' by the existence of IAWG

  • the IAWG adds value by keeping the IAF current and responsive to the marketplace requirements - ensures that the certifications are usable and meaningful for inter-party transaction

• Need text describing the fact of multiple TF Schemes - the value add is the IAF - it brings together different TF schemes and multiple certifications

  • It is really the current "value statement" but in the IAWG terms and context

  • Need to state why we are unique, embedded, hard to copy 

  • Myisha to tackle this statement

• "The methods by which participants trust each other"

• Scope

  • in terms of roles and responsibilities in Kantara

    • support Kantara to foster adoption

  • subject area coverage

  • action and presence in the marketplace - do we exert our presence 'out there' - speaking on behalf of

  • marketplace interaction - inbound requirements vs outbound

  • services offered?

    • maybe: subject matter experts as it relates to the IAF - to other WGs - this might be roles and responsibilities

    • Support to KI business development in understanding IAF

    • analysis of equivalency

    • verification/validation of profiles

  • Customers 

    • The LC and the Board (includes sub-committees)

    • Board

      • IAWG represents the board to other TFPs (the other TFPs are not our customer)

  • Liaison

From the August 29 2013 call:

Chair called for topics needing coverage in the Charter:

• Need to include roles and responsibilities division between ARB and IAWG and LC for the IAF processes

  • Where does execution of processes for certification of credential providers live?

  • Joni planning a "Leadership deck" to help chairs to understand processes and their execution

  • Many of these processes are already defined in the Kantara Operating Procedures

• Need to reflect the firming up of the distinction between Kantara's Service Operations versus Kantara's Innovation divisions

• IAWG should be confirmed as the Subject Matter Expert pool that the ARB can draw on 

• ARB is the operational arm of the IAF

• ARB is not refreshing their charter at this time

• Stronger language needed in charter to keep IAF documents up to date

  • Difficult to keep document set current due to the nature of the documents. Focus in necessarily on the SAC.

  • Need to focus on low barriers to adoption and consumability by entities wishing to seek Approval - should not have to rely on experts to do basic interpretation of documents

• Further discussion needed to examine current IAF document set structure, areas needing refresh and perhaps extraction of non-core information.

Status update: Glossary

• See action items

Status update: Resilient Networks

• No new information at this time

Status update: Comments for ISO 29003 draft

• Scott thanks the IAWG for their feedback and comments on the drafts - they are being incorporated as appropriate

AOB

Action Items

Recently Closed Action Items

Attachments

Next Meeting

• Date: Thursday, 19 September 2013 

• Time: 07:00 PT | 10:00 ET | 15:00 UTC (time chart)

• United States Toll +1 (805) 309-2350
  Alternate Toll +1 (714) 551-9842
  Skype: +99051000000481

  • Conference ID: 613-2898

• International Dial-In Numbers