Keith Ward TSCP Inc. President & CEO May 14, 2014

1. Cartes America - Secure ID: Fraud and ID Management Part 1 TrackPersonal Identity Verification (PIV) Case Study within the TSCP Community Keith Ward TSCP Inc. President & CEO May 14, 2014

2. What is TSCP? • TSCP is the Transglobal Secure Collaboration Program was established 2002, TSCP is a non-profit 501(C)(6) technical association. • Government-Industry Partnership isfocused on mitigating the risks, complexity, cost of IT inherent in large-scale, collaborative programs that span national jurisdictions. TSCP provides: • Influence to drive a common approach and specifications • Efficiency of working together on a common problem • Lower costs of development and implementation – leverage common solutions • Requirements, architecture, prototypes, deployed capabilities. • TSCP member companies have invested over $400M into internal federated systems using TSCP’s common operating rules and specifications. • Common Framework for Federated Collaboration • Key focus is on providing the mechanism and governance for: • Trust. Member companies’ and governments’ users digital identities can be trusted by others. • Identity Assurance. Trusted authority assures that its users with cross-certified-enabled digital identities are who they say they are. • Interoperability through Federation. Member companies and credentials are interoperable across the industry and government. PAGE 2 | TSCP

3. What Does TSCP Do? • SPECIFICATIONS DEVELOPMENT.* Develops common specifications for secure collaboration solutions across the TSCP membership that align to government requirements. The specifications fall into these categories: • Secure information exchange • Identity credentials/digital identities and attributes • Federated identity • Information assurance • Data labeling and protection • VALIDATION THROUGH REFERENCE LAB.Before TSCP publishes its specifications, the capability is in production with two or more members. • GOVERNANCE. Establishes policy and governance for TSCP Solutions. • Interoperable Identity Federation Trust Framework • Common Operating Rules • Legal Framework & Allocation of Liabilities • Accreditation & Trustmark • FEDERATED HUB. Hosts a Federated Hub for TSCP Membership that enables secure collaboration between TSCP membership and government customers. * Where relevant, TSCP specifications comply with FICAM/PIV-I specifications and guidelines. PAGE 3 | TSCP

4. Same Smart Card Technology – Different Applications PIV-I Smart Card Illustrative Banking Smart Card Secure chip stores payment information Chip card authentication prevents counterfeiting Adds cardholder verification methods Offers online or offline authorization Secure chip stores strong Identity information .e.g. in-person vetting, biometrics PKI certificates and 3DES encryption prevents cyber threats Adds cardholder verification methods pin and chip and Biometrics verification Offers logical and physical as well as online and offline authorization PAGE 4 | TSCP

5. TSCP Trust Framework: Bank Card Analogy TSCP Member IdP(s) Bank(s) Issue Visa credit cards to customers. Issue identities/ credentials to users Routes payment requests and responses between banks and retailers. Visa conducts settlement. . GOVERNANCE: Establishes and enforces standards, specifications and operating rules. Routes authentication requests and responses between RPs and IdPs. Direct Bilateral Trust Federal PKI Bridge MOD UK Customers present Visa cards for payment. Retailers transmit payment requests to the bank/card issuer through Visa. Users present member credentials to agency applications; RPs transmit authentication requests to IdPs through TSCP. Retailer Acquirers Agency Relying Parties PAGE 5 | TSCP

6. TSCP Trust Framework and Specifications TSCP Federation Framework & Specifications & Hub TSCP Secure E-Mail Specification TSCP Attribute Management/ Data Labeling Specification TSCP PIV-I Specification TSCP Secure E-Mail Specification Secure Document Management/ Archiving Secure Address Validation Identity Provider Services Federated Authentication Service Secure E-Mail/ Messaging (Hosted) Secure Mail & Package Tracking Secure G2C, B2B Communications Secure/Anonymous Shipping Secure Messaging Applications/Services Layer Illustrative Secure Messaging Platform Secure Online Payment Interface AUTHORIZATION AUTHENTICATION MESSAGE SECURITY Secure Messaging Communications Layer Secure Messaging Networking Layer TSCP Trust Framework TSCP Trustmark TSCP Trust Framework, Common Operating Rules & Governance Documents PAGE 6 | TSCP

7. Commercial Industry Base Global A&D Supply Chain Use Case 1:Multi-Layer Security across the enterprise Multi-Layered approach to provide additional security layers across our networks, systems, facilities, data, intellectual property and information assets Local or Remote User Remote & Desktop Login Credential & Rights Management Network Controls Credential Management– Centralized Public Key Infrastructure Data Monitoring & Protection Systems User and Privilege Management– Automated Provisioning Building Access Strong Authentication– PIV-I Credentials Host-Based Intrusion Protection Systems Corporate Access Card User TSCP Common Operating Rules PAGE 7 | TSCP

8. Use Case 2:PIV-I into Adjacent Markets: Financial & Retail Sectors PAGE 8 | TSCP

9. Use Case 2:PIV-I into Adjacent Markets: Financial & Retail Sectors B2G B2B C2B PAGE 9 | TSCP

10. Use Case 3:PIV-I into adjacent markets: Business Continuity Information Sharing Initiative • Private Sector Information is Sensitive and needs to be Secured • Media can miss-interpret fleet movement and cause public concern • Gangs track fleet movement and can steel copper/supplies from hotel lots where fleets park over night • Others can intervene and cause un-needed delays and/or commandeer fleets as in Katrina • Need to share PS Fleet Data & Info w/State EMs, DOTs, Police, other agencies at regional/national levels • Need info from Government to make operational decision to expedite power restoration efforts at regional level • Ultimate solution must: • Be trusted, proven and simple • Allow state/local government agencies to participate • Standards based, scalable in size, adaptable to each organization • Must use Trusted Credentials • Must have a Trust Framework Model for all entities to legally participate • Must have strong security controls PAGE 10 | TSCP

11. Use Case 3:TSCP Trust Framework PIV-I Information Sharing TSCP Trust Framework Data Consumers Data Providers PIV-I Data Access Controls PIV-I GIS Layer Access PIV-I Information Sharing Exchange Cloud Environment EOC ILH DSIF ILH DSIF Identity Claims Providers PIV-I PIV-I Commercial Identity Providers State Government Identity Providers PAGE 11 | TSCP

12. Next Steps – Bridge the Gap! PIV-I Smart Card Banking Smart Card The higher-level credentials represent over ~40M users TSCP is looking for applications, technologies and solutions to Bridge the Gap! PAGE 12 | TSCP

13. TSCP Fall Collaboration Workshop For more information please visit www.tscp.org PAGE 13 | TSCP

14. Questions? TSCP Inc. Keith Ward 8000 Towers Crescent Drive, Suite 1350 Vienna, VA 22182 Phone: (703) 760-7898 Email: keith.ward@tscp.org Web: www.tscp.org