Oct. 15, 2001
Please feel free to invite some of your colleagues from your or another city/county if you think it would benefit them to be part of our group!
Attendance
Rich Lovett, KCMO
Susan Waters, Overland Park
Randy Ellis, Overland Park
Barbara Hensley, MARC
Chris Audano, Overland Park
James Varner, Raytown
Robyn Stewart, Leavenworth
Danny Rotert, MARC
Digital Signatures/Certificates
Karen West from DST, Digital Signature Trust (http://www.trustdst.com),
spoke at our October meeting about using digital signatures and certificates over the Web.
Her best advice for understanding how a digital signature works is to think of it as a credit card. It has rules
and policy for it, but you do not need to agree on one vendor or technology.
DST is a service company that is regulated and audited; it is not a technology policy. DST helps an organization
develop policy for use of digital signatures. If different agencies have similar policies (even with different
technologies) they can interact.
Their company runs the digital signature programs for the states of Washington and Utah and is in discussions with
Kansas.
There are two main functionalities to digital signatures/certificates:
- Access control: only allow certain users to see/modify information.
- Signatures: recognition of approval for documents.
A digital signature is not:
- A picture of a signature
- A password or PIN
It is a transformation of a message using Public Key Cryptography. Digital
signatures are virtually impossible to forge, are not visible on a document, must be verified, and are stored electronically.
Once you sign a document, it cannot be changed or it will be invalid.
A digital certificate is a passport while doing business on the Internet. You hold the private part and the public
(decoder) part of the signature can be used to unlock your encryption.
An agency can be its own certificate authority (provides infrastructure and issues certificates) or it can contract
with one.
Issues to consider when developing digital signature policy:
- Audit requirements
- Archiving
- Desktop security
- Certificate liability
- The registration process
Besides having your private portion of your signature sit on your desktop, other options include:
- A token that plugs into any USB port that you can keep on a keychain
- Smartcards
For more information, contact Karen at (801)326-5422 or mailto:karen.west@trustdst.com.
MAGWeb site
If you have any suggestions for or can help maintain the MAGWeb
group site, please contact Rich Lovett, KCMO, mailto:rich_lovett@kcmo.org. We can also share documents via the site;
send him your RFPs, policies, ADA stuff, links, etc.
Use the listserv for questions and to share ideas. E-mail
mailto:webmasters@lyris.marc.org
Next Meeting: .Net
On November 19, Dan Davis of Jackson Co. will bring in a guest
speaker to talk about Microsoft .Net.
We may do a roundtable (with holiday treats) in December to share any ideas or questions we may want to discuss.
If you have any ideas for future topics or guest speakers, please share them with Rich Lovett, KCMO (rich_lovett@kcmo.org)
or Susan Waters, Overland Park (sjwaters@opkansas.org).