Digital Signatures

1. Digital Signatures Achieving new levels of efficiency & collaboration08 November 2011 Moderator: Nancy Johnson Editor-in-Chief Cadalyst www.cadalyst.com John Marchioni ARX, Inc. www.arx.com

2. Agenda • Digital Signatures: • Why use in Business? • What’s the impact on AEC businesses? • US and PE Board Regulations • Live Demos • Technology Primer • What it looks like for Users and Examiners • Digital Signature Deployment Example • Q & A

3. 2 Categories of Signature Technology • Electronic signature – proprietary, un-vetted, no consistency among vendors • Digital signature – standard, follows NIST and International standards

4. Why Digital Signatures? • Automate signature-dependent processes • Express: ownership, source, custody, acceptance, approval, agreement. • Integrity and verification • Inside & outside the organization; and • In the records archive. • Audit, regulatory, & governance • Compliance & good business practices for automated processes.

5. Business Drivers[Paper is too Expensive] • “Cost Analysis of Inadequate Interoperability in the US Capital Facilities Industry” • 40% of engineers’ time is spent on locating and validating information. • If information can be entered once and used by all – reductions in delivery time,up to 50%, are possible. The average paper document is copied 9-11 times at a cost of ~ $18 and filed at a cost of ~ $20, plus the added cost of storage, media, space, postage and distribution… The average cost of Fortune-500 paper documents is estimated at $10 per document. “The AEC industry spends an estimated $500 million or more each year moving plans from one discipline to another via such courier services as FedEx” “A typical $100 million building project generates 160,000 separate documents: drawings, contracts, purchase orders, RFIs and schedules.” Pfizer estimates the cost of one "wet signature" at $30 (including time to track down the signer, plus storage and scanning costs).

6. Why Digital Signatures? In 56% of organizations, more than half of the printed documents are printed just to add a signature. Source: AIIM Survey 2010

7. Digital Signature Benefits – Existing Users Which THREE of the following would you describe as the biggest benefits of your digital signatures system? Accelerating approvals, processes & time savings are the most significant benefits.

8. Digital Signatures for AEC Do more than 50% of the main business processes/documents in your organizational unit require formal signatures?  AEC processes require highest percentage of signature approvals.

9. Digital Signatures: Positive Impacts on AEC • Collaboration & Quality • Faster Customer Service • Cost Savings & Sustainability

10. Collaboration & Quality • For design precision,AEC firms need to tap their best resources, wherever they may be. • Digital signatures allow: • Team members to sign instantly wherever they are • Each engineer signs and seals his own drawings, leaving a clear audit track and chain of custody • Result: • Better collaboration • Enhanced design integrity • Efficiency “We looked toward digital signatures for the main purpose of enabling remote engineers to sign drawings and other documents and keep the workflow going” Chris Krafft

11. Faster Customer Service • Once the project gets going, clients typical push for faster delivery • Digital signatures cut printing and routing • Result: • Faster turn-around times • Fewer late projects • Greater agility to address clients’ change orders “In the past, it could take several weeks to turn a document around with wet signatures.  Today, with digital signatures, our engineers can electronically sign from our remote offices, as well as remote locations with internet access, thereby allowing us to turn documents around in a day.  Feedback from our customers has been phenomenal!” Chad M. Zielinski

12. Cost Savings & Sustainability • Paper is too expensive! • Staff time • Costs of printing, scanning, routing, archiving, replacing lost documents… • Digital signatures significantly reduce paper • Result: • Lower costs • Improved environmental sustainability “We’re Saving 2,000-3,000 hours a year in labor alone and going green” Brian Hase

13. US Regulations • Digital signatures are legally enforceable in all U.S. States and territories, and in Europe. See http://www.arx.com/industries/digital-signature-for-engineering-regulatory-compliance

14. PE Board Regulations • PE Boards control professional engineer’s seal, and it’s permitted use on content (documents/drawings). • The majority of P.E. Boards (at least 40) encourage use of electronic content and digital signatures on that content, with several recognizing digital signatures as the most reliable and secure option, and/or as the only acceptable, legally enforceable electronic signature.

15. PE Board Regulations [cont’d] • These PE Boards will not endorse a specific solution but, nor will they criticize a specific technology approach.  They do however recognize the economies one gets from: (a) not having to print to sign; (b) commercial off the shelf solutions; that are also (c) based on proven standards. 

16. Live Demos MS Office Example PDF Example

17. Digital Signature Primer Digital Signature (NIST FIPS PUB 186), the Standard that replaces slow, inefficient, paper-based signatures for signing Electronic documents, drawings, designs, and/or records.

18. Digital Signature Primer + X Digital Signature Signer’sPrivate Key Document Signed Document Document Hash Signer’s ID& Public Key • Result: • Digitally signed electronic record • Fully trusted and reliably verifiable • … without requiring any costly, complex or proprietary software • … and without requiring any access to the creating system /organization

19. EU DIRECTIVE ON ELECTRONIC SIGNATURES Digital Signatures: So what? • Technology that’s well known, peer-reviewed & vetted: • Algorithms are public {proprietary techniques are no longer acceptable} • Stanford (Diffie-Hellman) • MIT & Weizmann Institute (RSA) • Secure Hash Standard/SHA • Signature technology that is immune to forgery • Standard (FIPS PUB 186) that provides: • Universally verifiable signatures & documents anytime/anywhere • Signed documents that have effect outside the system that created them • Technology that will outlive vendor & user • Prevents vendor lock (and vendor gridlock) • Technology that is endorsed by: • Governments • Standards & Regulatory Bodies • Fortune 500 Corporations

20. Digital Signatures Allow Easy Verification Identity Identity Intent Integrity

21. Verification Allows Trust Trusted by: • Only digital signatures create self-contained, portable and sustainable electronic records that have value and trust outside of the repository and the organization, independent of the system that created them. Internal Employees External Partners Signature embedded in document External Suppliers External Clients External Regulators

22. Basic Value of a Digital Signature Provides Reliable Integrityof Information Provides Known Origin of Information • Eliminates Deniability It’s a Standard: • Broadly Usable (Supports Many Applications) • Will survive in the long-term archive

23. User and Examiner Experience

24. What does it look like for the users? Valid Signature Visible Signature Block

25. What does it look like for the users/examiners? Valid Signature

26. What does it look like for the users/examiners? I approve this design Signer’s Intent Signer’s Identity Document Integrity

27. CoSign Deployment Example Admin Central Control over Signature Privileges User Directory End-Users Policy User-management Policy (directory) drives signature-privilege management.Signature credentials (keys & certs) maintained in secure appliance. Desktop Apps Securely Request Signature Services Secure Response to Requests Web Apps CoSign = Turnkey Solution (installs in ~2 hours) Mobile Apps Seal and/or Graphic-Signature Management Built-in Key-Management; Private-key Ops Built-in Management for Certificates (CA)

28. What is required for trusted collaboration? • Maintaining the evidence, or proof of: • signer Identity; • signer Intent; • recordIntegrity. • Maintaining control over: • Establishing and revoking signature credentials/privileges.

29. Proper support for Signature Automation • The Signature must: • Have a strong binding to the signed information; • Reliably identify the signer; • Be verifiable by anyone at anytime. • Tampers of signed information should be easily and reliably detectable. • Signature privileges are best managed centrally by your current, pre-established governing policy and procedures.

30. Recorded Demos http://www.arx.com/resources/digital-signature-Applications-demo

31. What do you think?More information … • Replay this webcast • Send your feedback to customerservice@longitudemedia.com • Learn More: http://www.arx.com • Contact ARX: sales@arx.com