Federation Manager Authentication Risk Assessment

The security of the InCommon Federation Manager (FM), the application used by RA administrators, site administrators, and delegated administrators, is critical to the confidentiality, integrity, and availability of InCommon IdPs and SPs. This document discusses threats, impacts, and potential controls, with emphasis on those threats that relate to identity and access management for the FM.

The approach taken here is based on the risk assessment framework outlined in NIST Special Publications 800-30 and 800-53 and other documents referenced in the text. In brief, this process has the following steps:

1. Identify threats to the system and the impacts of those threats.
2. Based on the severity of the impacts and the likelihood of the threats, determine an impact level for each threat.
3. Implement controls that are appropriate to mitigate the identified risks.

It should be noted that "security" in this context is not simply about the threats posed by digital criminals. Security also concerns itself with any threat to the confidentiality, integrity, or availability of a system. The NIST framework is much broader, addressing not only technical security, but also physical security, disaster recovery, organizational maturity, etc. That said, this document concentrates primarily on digital security.

Finally, the goal here is not to identify the best/strongest controls available to address a threat. Rather, the goal is to identify controls that are appropriate to the impact levels that have been identified.

Metadata Management

The maintenance of InCommon metadata is a shared responsibility between InCommon Operations (represented by the RA administrators) and InCommon participants (represented by the site administrators and delegated administrators). In general, the site administrators and the delegated administrators are responsible for submitting correct metadata, while the RA administrators are the stewards of that metadata. More specifically:

• Site administrators and delegated administrators are generally considered to be the source of metadata content. There is an exception, however:
  • The RA administrator may insert additional information into an entity descriptor. Examples of such information are organization data, Identity Assurance qualifiers, and service provider category attributes for which the Federation operator is authoritative.
• As the steward of metadata, the RA administrator is responsible for:
  • The integrity and availability of participant metadata. (Confidentiality is not an issue.)
  • Controls, to be leveraged by site administrators and delegated administrators, that aid in the submission of correct metadata by authorized individuals. The use of these tools may be required for all administrators, required for certain administrators depending on certified assurance levels, or may be optional. Examples of such controls are authentication mechanisms, secure communication channels, notification of completed transactions, enforced separation of duties, etc.
  • Services such as domain validation that help administrators create and maintain correct metadata.

Note: Despite the controls and services performed by the RA administrator, the responsibility for correct metadata still rests with the participant.

When assessing threats to the Federation Manager, we consider the following issues:

• The impact on an affected IdP's certified assurance level.  The Federation Manager currently holds metadata for unassured, LoA-1 (Bronze), and LoA-2 (Silver) IdPs.
• The impact on an affected entity's (IdP or SP) requirements for confidentiality, integrity, and availability.
• The impact on the reputation of InCommon and its members. This is of particular importance, as the Federation is fundamentally dependent on mutual trust.

The metadata contains different types of information that may be categorized according to the impact of that information being incorrect.  In order to provide guidance for the implementation of appropriate controls, the following table summarizes those categories.

Potential Threats

The following table provides a summary of threats and their impacts.  It also lists potential controls, but the selection of specific controls for implementation is the subject of another document.  [InCCollaborate:Need a link to Ops's document...]

Comments about Reputation

Any of the threats listed in the previous section represent a threat to the reputation of InCommon and its members. As mentioned earlier, the impact of these threats is not merely a matter of public embarrassment. If IdPs and SPs cannot come to trust the federation administration and each other as a whole, then the federation can bring much less to the table to foster the deployment of services that are widely available to the community. Reputation is critical to InCommon. One reputation-damaging incident will not destroy InCommon, but a string of them will.

The level of impact on reputation, unfortunately, cannot be related directly to the assets affected by a security incident; it is largely a matter of public perception.  Incidents with low impact on assurance, confidentiality, integrity, or availability can have the same, or even higher, impact on reputation than high-impact incidents.  Assuming successful, reputation-building operation, risk to reputation will diminish over time.

Categorization of the Federation Manager

Given the analysis above, and using the "high water mark" principle referenced in section "3.2 Categorizing the Information System" of NIST Special Publication 800-53, "Recommended Security Controls for Federation Information Systems and Organizations," the Federation Manager is a moderate-impact system.

For reference, NIST Special Publication 800-30, "Risk Management Guide for Information Technology Systems" defines low, moderate (medium), and high impact as follows:

Notes:

• This assessment is based on InCommon's currently-defined Bronze and Silver identity assurance profiles, which have low to moderate impact. Introduction of high-impact assurance profiles (e.g., LoA-4) at some time in the future would require reclassification of the Federation Manager to high-impact.
• The categorization of SPs within InCommon is not known at this time.  It may be useful at some time for SPs to be able to declare their categorization, and high-impact SPs should be warned that they may need to implement mitigating controls if they participate in InCommon.
• Not all operations performed by the Federation Manager are of moderate impact.  Protection of public keys and federation-controlled metadata are probably the highest impact from the point of view of the federation.  Impacts categorization for other metadata is more dependent on the needs of the IdPs and SPs themselves, so the need for associated controls could be self-declared.

Appendix: Risk Assessment for Assurance

NIST Special Publication 800-30, “Risk Management Guide for Information Technology Systems,” provides general guidance for risk assessment. This guide is leveraged by E-Authentication Guidance for Federal Agencies (OMB M-04-04), which describes a risk assessment framework for determining the Level of Assurance an SP should require. The following table summarizes how LoA is determined:

The meanings of "Low," "Medium," and "High" are defined in OMB M-04-04 on pages 6 and 7, and, in the case of unauthorized release of sensitive information, in Standards for Security Categorization of Federal Information and Information Systems (FIPS PUB 199):

Potential impact of inconvenience, distress, or damage to standing or reputation:

• Low: at worst, limited, short-term inconvenience, distress or embarrassment to any party.
• Moderate: at worst, serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party.
• High: severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals).

Potential impact of financial loss:

• Low: at worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, an insignificant or inconsequential agency liability.
• Moderate: at worst, a serious unrecoverable financial loss to any party, or a serious agency liability.
• High: severe or catastrophic unrecoverable financial loss to any party; or severe or catastrophic agency liability.

Potential impact of harm to agency programs or public interests:

• Low: at worst, a limited adverse effect on organizational operations or assets, or public interests. Examples of limited adverse effects are: (i) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness, or (ii) minor damage to organizational assets or public interests.
• Moderate: at worst, a serious adverse effect on organizational operations or assets, or public interests. Examples of serious adverse effects are: (i) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or (ii) significant damage to organizational assets or public interests.
• High: a severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (i) severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions; or (ii) major damage to organizational assets or public interests.

Potential impact of unauthorized release of sensitive information:

• Low: at worst, a limited release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS PUB 199.  ("The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.")
• Moderate: at worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a moderate impact as defined in FIPS PUB 199.  ("The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.")
• High: a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a high impact as defined in FIPS PUB 199.  ("The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.")

Potential impact to personal safety:

• Low: at worst, minor injury not requiring medical treatment.
• Moderate: at worst, moderate risk of minor injury or limited risk of injury requiring medical treatment.
• High: a risk of serious injury or death.

The potential impact of civil or criminal violations is:

• Low: at worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts.
• Moderate: at worst, a risk of civil or criminal violations that may be subject to enforcement efforts.
• High: a risk of civil or criminal violations that are of special importance to enforcement programs.

Appendix: Risk Assessment for Confidentiality, Integrity, and Availability

NIST Special publication 800-53, "Recommended Security Controls for Federation Information Systems and Organizations" provides an extremely detailed description of security controls in the areas of access control, awareness and training, audit and accountability, security assessment and authorization, configuration management, contingency planning, identification and authentication, incident response, maintenance, media protection, physical and environmental protection, planning, personnel safety, risk assessment, system and services acquisition, system and communications protection, system and information integrity, and program management. For the purpose of this document, the controls selected for analysis may be found in the "access control" and "identification and authentication" sections.  A complete risk assessment of the Federation Manager, though, should include all areas.