Lance M' Calisch

1

• Lance M. Calisch
• Department of Information Services

2
Transact Washington

• An authentication gateway that allows State
  agencies to provide services to their customers
  securely over the Internet
• Meets the Authentication Levels of Confidence
  established in the Information Technology
  Security Standards effective November 20, 2000

3
Authentication Levels of Confidence

• Identification and Authentication
• confirm the identity of an individual
• authentication mechanism used has been securely
  issued
• Authentication Integrity
• authentication mechanism is responsibly managed
  and properly protected to prevent unintended use
  or compromise

4
Authentication Levels of Confidence

• Authentication Validation
• confirm and validate identity upon presentment to
  an internet-based system
• Application Security
• properly insulated from direct access from the
  Internet

5
Application Security
Internet
Transact Washington DIS Fortress
Agency LAN
Agency Server
Client
6
Identification and Authentication
Digital Certificate
7
Identification and Authentication

• Issued by a third party Certificate Authority
• conducts rigorous identity proofing according to
  Washington Certificate Policy
• Trusted centralized policy
• Certificates have multiple uses
• authentication
• encryption
• signatures

8
Authentication Integrity

• Responsibly managed and properly protected
• Digital Signature Trust, licensed to issue
  certificates against Washington State Certificate
  Policy
• http//transact.wa.gov
• http//digsigtrust.com/state/wa

9
Certificate Assurance Levels

• High
• Intermediate
• Standard
• Increasing assurance with each level

10
Washington State Certificate Policy
Identification, Authentication Notification
Reliance Limit
Key Protection
Utility
High (2.16.840.1.113839.0.4.1)
Intermediate (2.16.840.1.113839.0.4.2)
Standard (2.16.840.1.113839.0.4.3)
11
Authentication Validation

• Transact Washington will confirm and validate
  the certificate upon presentment.
• Who decides what level of assurance to use?
• You do, application by application

12
Examples

• LI claimant data (High)
• DOH epidemiology data (High)
• ES tax payments (Standard)
• DOR tax payments (Standard)
• LI tax payments (Standard)
• DSHS alcohol and substance abuse data (High)

13
Agency Roles in Transact Washington

• Agency Registration Authority (ARA)
• identified in SLA
• administers Application Owners
• Application Owner (AO)
• approved by ARA
• administers agency applications
• administers Trading Partners

14
The Transact Washington Process
Applies for role
Approves request
Approves access
Applies for access
Applies for access
Trading Partner
Creates Account
15
For more information, contact

• Lance M. Calisch
• Department of Information Services
• Tel [phone]
• email lancec_at_dis.wa.gov