Bridget-Anne Hampden | Nov. 2012 U.S. Department of Education 2012 Fall Conference

1. Session 29 Enterprise Identity Management – Leveraging Participation Management (PM) to Provide Single Sign-On for COD Bridget-Anne Hampden | Nov. 2012 U.S. Department of Education 2012 Fall Conference

2. Contents • Current State • Objectives of the Enterprise Identity Management Service (EIMS) Project – Phases 1 and 2 • Approach • EIMS Target State • Changes • Important Dates • Next Steps • Questions

3. Current State: User Feedback We Heard You Loud and Clear: Multiple log-ins for COD are frustrating and inefficient. EIMS is a solution which allows a single user sign-on for COD and other FSA systems.

4. Current State Directcontrolover user accounts FSA Internally Hosted Indirectcontrolover user accounts FSA Externally Hosted • Individuals have multiple access identities to internal FSA systems • In some cases the same individual has multiple access identities in one system (Common Origination and Disbursements) • Individuals have additional access identities to externally hosted FSA systems • User account management is fragmented • Inconsistent methods are used for authentication (application specific, personal identity numbers, etc…)

5. Objectives of EIMS Project Phases 1 and 2 Objective: To make registration and sign-on for users a more efficient process while still maintaining security for FSA systems by: • Simplifying access to FSA systems with single (reduced) sign-on • Creating a standardized solution supporting the entire user community and all business systems • Removing Personally Identifiable Information (PII), such as the current use of Social Security Numbers (SSN) and Date of Birth from log-in • Maintaining a consistent data security posture across all FSA systems

6. Approach Step1: Placing all FSA systems behind a single authentication application (AIMS) e.g. National Student Loan Data System (NSLDS), eCampus-Based System (ECB), Central Processing System (CPS) Step 2: Leverage PM system for COD enrollments to provide privileged users a single FSA ID for COD Step 3: Create non-identifiable standard user IDs and passwords for students and borrowers to access FSA systems Step 4: Move from physical (hard) tokens to the use of soft tokens

7. EIMS Target State Current State 2012 Target State 2015 All Users Log-in ID FSA System(s) Privileged Users Log-in ID FSA System(s) COD COD COD COD FSA ID Multiple IDs COD ALL Systems FSA ID NSLDS, ECB CPS, etc… • Create single sign-on • Centralize provisioning • Allow self-service • Replace PII in log-in information • Increase security • Provide eSignature PIN (SS#, DOB) Non-Privileged Users

8. Target State Enterprise Identity Management Service A B C D E F G H I Financial Partners Federal Agencies General Public & Applicants Service Providers Department of Education Borrowers Schools State Agencies FSA Employees NSLDS FAP PCA Systems W S I Enterprise Identity FAAA Website R - SSO TFA Management Service AC IPM (EIMS) W E S I ERMS FPDM Application Level Security Federated Identity Management W E S I CODEN Identity Proofing eZ-Audit Datamart W I Application Level Security DMCS2 e-Campus Based W E S I Application Specific Security Servicer Systems COD Data eMPN PEPS eZ CPS FMS - Audit DMCS CDDTS COD FAFSA 4 CASTER DLSS DLCS Archive FOTW W E S I E W E I W E I I W E S I I E S W E S E W W E I Legend W S I Website E ESB SAIG ITA EIMS Target State Internal Hosting (VDC) External Hosting Identity, Credential, and Access Management (ICAM) Federated Identity National Strategy for Identities in Cyberspace (NSTIC) FSA Identity Federation User Self-Service Centralized Administration (e.g., Logging, Audit, Provisioning, Lockout Disablement)

9. Changes: COD online access Current Future • Primary DPA enrolls users through COD for online access • Users receive different log-ins for each school and profile • Users need to log-out to change schools or profile • Users only have access to report structures created for a specific school or profile • Primary DPA enrolls users through PM for COD online access • Users receive 1 FSA log-in for all schools and profile • Users are able to change schools or profile without logging-out • Users have access to all report structures created for any schools or profile

10. Changes: PM Current Future • PM does not provision enrollments for COD online access • Primary DPAs may need to enter user and enrollment information into multiple systems, COD and PM • PM is not linked to AIMS for COD online access authentication • PM will provision COD online access enrollments • Primary DPA will only need to enter user and enrollment information into one system, PM, for COD, NSLDS, ECB etc... • PM will be linked to AIMS which will provide COD online access authentication

11. Changes: The Transition Period • During the transition period from the first week of March 2013 to the first week of May 2013: • Primary DPAs will need to enroll current COD online users in PM • Users will need to register in PM, if they do not have an FSA ID (john.doe.fsa) • During this period, new COD online users will need to be enrolled in both systems • After 1st week of May, Primary DPAs will only be able to use PM to enroll COD online users

12. Changes: Summary of Required Actions

13. Changes: Privacy and Security Improvements • FSA requires that all users accept their responsibilities regarding the use of FSA systems and information as is written in the Privacy Statement and the Rules of Behavior • In addition, FISMA requires that FSA track this information and provide audit information as requested • On a daily basis, users will be asked to accept both these statements when they first log-in to COD

14. Changes: Annual Security Training Notification • Users are required to complete an Annual Security Training • Provides an understanding of the security responsibilities associated with accessing FSA systems • Reminds users of their responsibilities to protect the information in FSA systems especially the PII data of the students, borrowers, and users • Specifies certain activities as not allowed, such as the sharing of FSA IDs • For the ten (10) days prior to expiration, users will be notified of the expiration of their security training when they log-in to COD • If the Annual Security Training is not complete, user will not be able to access COD

15. Changes: COD Enrollments and Log-in User registers in PM and receives FSA ID Privacy / ROB Accepted, Security Training Complete? User User enters FSA ID and password to access COD User logged into COD YES NO User completes Annual Security Training

16. Important Dates • February 2013 • Initial information available on IFAP website • March 2013 – May 2013 • Detailed instructions available on IFAP website • Primary Destination Point Administrators (DPA) enroll COD users in PM • COD users register and create a profile in PM to get a new FSA ID and Password • First Week of May 2013 • Single (reduced) sign-on for COD goes live!

17. Next Steps for EIMS • Complete enhancements to PM • Send out communications through IFAP (Feb/March/May) • Implement new COD single (reduced) sign-on – COD Release 12.1, first week of May 2013 • Begin work on removing PII for non-privileged users – Late Fall 2014 • Perform feasibility testing with InCommon Federation • Provide ongoing progress information through IFAP

18. QUESTIONS?

19. Contact Info • Bridget-Anne Hampden • E-mail: bridget-anne.hampden@ed.gov • Phone: 202-377-3508