And that's how we've created all these great tools to support South Africans on the journey of home ownership. I think it's important for our country. And we really encourage the market to really take that step, think about it. Now is the time. I think the environment is really favourable. Good evening and welcome back to the First Time Home Bioshow. I'm your host, Estie Klaassen. As you heard tonight, I'm sitting with the wonderful Zyde manual all the way from Apsa. Before we get started, as you know, we've got amazing content coming to you live every weeknight this week. We've got some Antungua Kamala with the private property podcast that's live on Facebook and YouTube at 7 p.m. from Monday to Friday. And of course Mbali comes to you with the agriculture podcast that's Tuesday and Thursday at 8 p.m. We cannot miss Chad Vavieros as he travels around Mzanzi, looks at amazing mansions, townhouses, apartments, all the way in Johannesburg. Chad is Friday and Monday evening, start of your week with the bang with Chad at 8 p.m. And of course I come to your screens every Wednesday at 8 p.m. And tonight is no different. I'm chatting to, like I said, Zyde manual all the way from Apsa. We talk about how we can make your home ownership journey easy and the digital platforms that Apsa has done and taken into consideration to make this process easy for us. Good evening, Zyde. How are you? Evening. Evening, Estie. And thanks for having me today. I'm wanting to sit down and have this conversation. I remember having a chat with you at one of our panel discussions and we wanted to talk, you know, just about how the access to even getting a home loan, you know, being a young woman of Kale in South Africa, all of these things. But we'll get to that a little bit later, Zyde. I want to talk a little bit about getting applying for a home loan. Let's start from the beginning and take us through the entire process. Thank you, Estie. Evening everybody. I think from applying for a home loan is really a big decision, especially for your first-time buyer. What you really need to consider and start preparation is understanding your budget. Understand can you afford a home loan? So you really need to look at what are your income, what are your expenses. Secondly, you need to have a good understanding of your credit history. So understand your credit bureau profile. You are eligible to retrieve a credit report annually from one of the credit bureaus like TransUnion or Experian. And then you need to also consider doing a pre-qualification. EPSA has a great tool that can help you with a pre-qualification to determine how much you can afford from qualifying for a bond. Thereafter, you need to then assess what are some of the attorney costs associated to the home buying process. There's bond registration costs, there's initiation fees, there's transfer attorney costs. And check if you have enough savings to pay for those costs. Also consider new expenses coming into your budget such as insurance that has to be, that you have to take up as part of the home buying process. Check levies. What are some of the levy expenses, depending on the property type you'll be buying? Rates and taxes. The ones of electricity costs to get that onto your name once you've purchased your home. And then of course moving costs. What would be your moving costs once you're ready and you're approved for a home loan? And thereafter you can then, once you've got a pre-qualification of what you can afford, you can then start shopping around, search on private property's website for their property that you're looking for and different suburbs as well. And I think it's so important because I'm sure to a lot of first time home buyers or even people who are just looking into buying property now, a lot of young people who've watched the first time home buyer show, probably all those terms and all those steps that you mentioned, they probably had no idea this existed. There were one or two that I was like, oh, I need to do that, you know? So I think it's very important and I love that you gave that almost in bullet form. And I think it's so pivotal for us as the younger generation to take notes of this and go and do further research on these terms. But today we're going to try and go deeper into this, which I really would like us to do. One of your first things was, check your budget. And we spoke about this just a little bit before and I think it's so important because you kind of preach that there are certain things that we can just exclude from our budget, certain lifestyle changes that we need to actually change. So how do we go about some advice from you? How do we go about actually working better with our budget, being financially savvy? I think guidance is always to look at your income and what are your expenses and assess expenses that are really required versus some luxuries and see where you can really minimize, you know? But I think taking time to assess your expenditure and spending time is very important. It's a very difficult task to do, but you have to do it. I think it's very important because you need to, in your budget, you need to ensure that you've got expenses allocated according to what's really necessary. There are some luxury items and then always make room for savings for that time when you might really need an emergency and you have that accessible. And I think part of buying a home is, you know, there would always be some kind of emergency, whether it's a repair of a home or some renovations or some unexpected costs. And you always need to make sure that you have room for all of that once you are homeowner as well. And I think really assessing your budget is actually very, very important. So I really encourage you to assess your budget and check the income and expenses as well. And look, if you're not getting ready to purchase the home right now, after you've assessed your budget, start looking at how can you downsize, decrease expenses so that you can work towards the goal of home ownership. And I think that's really, really important and encouraging from my side as guidance in terms of preparation towards home ownership. And you're right, it is scary to just, you know, to assess that budget and make these lifestyle changes because to some people, you know, it could be like a drastic change that we need to make or some people are just like, but I can't afford to make that change just yet. But I think it's important to assess the budget. I mean, I'm going to leave you and go do the exact same thing. Because it is now is the right time, even just before this, we were talking about how it's such a perfect time to buy right now, right? But I want to get to that later. Another one of the steps that you mentioned, Zida, was doing the whole pre-qualifying step first. How important is that step before the final? I think it's very important because I think having an understanding of what you could qualify for gives you the confidence to shop around. So, like I've mentioned, APSA has a great tool. It's available on our website. It's accessible on our website for everybody to use. It's called the APSA Home Loan Estimator tool. It's our pre-qualification tool. Easy steps to insert some of the fields required for you to determine what you could afford from a home, from a bond qualification perspective. It gives you an estimate and you are able to do that estimate up to five times within a 90 day period. And that can help you shop around and to see what you could qualify for. It helps you with your search process, you know, different suburbs, different price ranges. And then you can start searching confidently for properties and starting having the engagement process to view properties. And I think that really gives you good guidance as to what you can afford. And I encourage everybody to go and do a pre-qualification. As mentioned, ours is available on the APSA website. And we'll give you a certificate with what you could qualify for after you've inserted all your necessary information. And you can happily go and shop around for the property you're looking for. And you can start by searching on private properties website. And I think it's so important because once you have that figure, you know exactly what you're looking for. And that's when you can play around, especially as first time home buyers. Do you want to? You can even keep below that figure, you know? And if it's maybe your first home or family home, also again, what's so important, especially with first time home buyers, is the intention of buying, whether it's investment purposes or if it's your home home. You just spoke about that, you know, that's a good way digitally. And a lot of younger people are always on their phones, always, you know, going through all the apps and it's just easily accessible, you know, this thing, this phone. So how has APSA helped us, especially digitally, make this process so much easier for first time home buyers? Oh, great. I think, you know, with the world evolving digitally, transforming all industries has to really adapt to this digital world that we transform into and we've got to evolve. So APSA has great digital tools that can help you towards the buying process. It's our pre-buying tools. Once again, it's available on our APSA website and it's accessible to everybody. We have the pre-qualification tool, as mentioned, to help you shop confidently. We then have a great tool, which is an e-learning tool that teaches you about home ownership. All the ins and outs about home ownership. It's our APSA My Home Owner Journey tool. It's a free tool. You access the tool and you can actually learn about home ownership, the buying process, type of properties, type of lending facilities, insurance solutions, the attorney processes, the deeds office processes and the different type of properties that you can be interested in purchasing, as well as the buying process, such as what is an offer to purchase. You know, what are some of the next steps during the buying process? So it's a really great, great e-learning course that I encourage everybody to actually access, register on our website, go through the course. It's really, really, really great and helpful. And then the final exciting one is that in order to submit your home loan application, we've got an online digital sales process and you can actually log on, complete your home loan application in under 15 minutes. It's simplicity, it's speed and you can submit your application and get an outcome. You can do it with any device on your tablet, on your mobile, on your laptop. And I think that's the beauty part of where we are from a digital perspective. We've really made it very easy and convenient and simple to access. Also, we've got great calculators on our website also to help you calculate some of your bond attorney costs, especially after you've done the pre-qualification tool. It gives you an indication of what could some of those costs be and you can work around and play around with different price ranges so that you can determine what is your budget once again and what you can afford and what does that look like if you have to take into account rates in taxes, levies, insurance as well. We've got great insurance solutions too. So all these digital tools are available on our website to help first-time buyers prepare for their home ownership journey. We spoke about the e-learning tool and earlier, remember I said a lot of the jog and you used was, could be foreign to a lot of people, but having this option as the e-learning, it literally teaches you in depth all of these terms and terminologies that you might come across on your home ownership journey, which is so important. I love that we have that, you know, easy right here on your phone, online. And under 15 minutes, that's absolutely amazing. Yes. No, with the times, keeping up with the times, I love that. Especially, I think, Estie, we really try to transform digitally and we're really trying to make it convenient and reassuring the market that we have the right tools to help you on this important journey.  You don't need to be an app's a customer to access the tools, learn and prepare for your journey. And we've made it so much easier where you can actually go and complete your own application and submit it and wait for it and get an outcome. It's as simple as that. From the comfort of your home on any device. Exactly. And I think that's really, really transforming this journey. And that's the journey we've invested in and we really wanna support first-time buyers in this regard to really reassure them that we are here. We wanna walk the journey with you as you take this important decision as buying a home. Exactly, I just wanted to say that even though, you know, we're in the midst of a pandemic and things are done virtually, you're still holding our hand. Not physically, but through the process, which I love. Zayda, talking about first-time home buyers, and I know even within my own circles, a lot of people, young adults, are buying property for the first time. These first-time home buyers are just the numbers are expanding and it's just an influx of all of them. And I love that for us. What are the current trends that you are seeing from your side with regards to first-time home buyers? How is there an influx? What's happening on your side? Wow, I think you rightfully mentioned, even though it's a pandemic, we've really seen increase in the property market from an activity perspective, which is really great. We have the lowest interest rate in years. It's 3% down since July, 2020. And I think that really makes it a very favorable environment to encourage consumers to consider home ownership. You know, some are probably renting and wants to move towards owning their own property. And I think that's really encouraging. Some are buying a home for the first time in their families, you know, for themselves, for the extended family. And that's really encouraging the environment's favorable. And also to add, I think transfer duties are exempted for properties less than a million grand. And I think that's a real saving for first-time buyers. And I think that's really encouraging for the market at this point in time. And we have really seen a good increase in activity from first-time buyers in the market. And it's really exciting. And I think, you know, it's really great that we can be the bank to support, you know, and to be a part of that home ownership in South Africa as a society and play that role. I think it's very important. And that's how we've created all these great tools to support South Africans on the journey of home ownership. I think it's important for our country. And we really encourage the market to really take that step, think about it. Now is the time. I think the environment's really favorable. And we encourage you to take the step towards home ownership. There's no better time than now. Absolutely. You've said it really well. I wanted to find out, so we obviously, you know, we've seen that a lot of new people are buying property right now, but are the other trends maybe from, especially with regards to first-time home buyers that you are seeing? So what we've also seen is that look, I think we've seen an increase in women playing a role in the market. We've seen a lot of activity from first-time buyers. Like I said, you want to own a property. You don't necessarily, you know, you're moving from renting to owning. The time is favorable. So we really seen that activity in the market at this point in time, which is encouraging. I think different suburbs, you know, sometimes you'd have thought that I could never afford a property in the suburb, but with the rates being relatively low, the lowest in years, I think, you know, sometimes you can actually afford a property in a different suburb where you actually thought that you couldn't, and I think that's really encouraging. And that's why I think that the market has really turned very favorably in the property industry, even if though it's a pandemic, but I think it's encouraging during this time, you know, for consumers, we really saw the Africans to consider home ownership. So those are some of the key things we've seen. And I think that it's exciting. I think it's exciting, you know, as young adults to take the step on the journey.  So it's really amazing to see some of these, these lifestyle changes, but in a positive light and making home ownership is really something big. And it's exciting and it's important as well.  Absolutely. I love that. Zaira, we spoke, I mean, we don't often get to speak to, you know, someone from APSA. And first time home buyers often have a lot of questions when it comes to getting money from the bank and being, and qualifying for this home loan. I wanted to know, like, maybe just a few, like, frequently asked questions that you've gotten from first time home buyers. And maybe if you can use this opportunity to answer them as well. So I think a lot of the times we get that, oh, I don't know where to start. And like I've mentioned, the starting point is, look at your budget. Understand your income, your expenses. Is there room for you to actually afford a bond repayment? Then go and look at, and look at, see what you can afford, you know. And once you have those two things, then you can start shopping around. But it's also important that to understand your credit history. Because if you have certain things that are not favorable, you can try to sort those out before you embark on the journey of home ownership. And you can also learn about the journey of home ownership. And that's why we've got our great tool that you can learn about this process. And I think other things that's important to consider as well is, you know, when you start searching for a property, there's certain things that you need to consider. So as you shop around, view properties in certain suburbs on a Sunday, have a look at volume of traffic, have a feel of how does that look in certain suburbs that you might be interested in. Then understand, you know, these suburbs, do they have good transport networks? Is there good amenities? Is there schools, shopping centers closed by? Hospitals? Also understand that look, some of us are working from home, so fiber connectivity is important. And I think also what's something else also is the security, you know, the suburb security. If you're buying in a sectional title property, understand the levy costs, what is associated to that. And then just overall the suburb, understand is it a suburb that's growing in value, property value? You can get property reports, you can access that from private property's website to help you understand, and have an understanding of some of the suburbs that you might be interested in. So those are some of the things that I can actually give guidance on as to consider as a first time buyer when you start searching for your property and as you prepare for this journey. My biggest question is the negotiation thing. You know, everyone says, no, you can negotiate. We can, now, how far can I take it? How far can I push this negotiation? I think as you engage with maybe estate agents or the actual, if it's a pre-owned property or a developer, you know, see what's the costing of price range, how far you can negotiate. I think it's a good adult conversation. And then you take it from there. I think, look, it's how you establish that rapport and what are you looking for. I think it's also important to understand what you're looking for. And that's why I say the preparation, there's a lot of preparation, understanding the suburb, the type of property you're interested in, what is important to you to have in the property, you know, fiber, security, you know. And those are key things to understand. And as you go on your search and you look for the, in different suburbs and different property types that you're looking for, whether it's sectional title, estate loving, goodbye, a freestanding property. And with freestanding property, you consider some of the other additional security considerations like an alarm system, electric fence, et cetera. And I think those are some of the things that you need to, you can, once you have a good understanding of what you're looking for, as you enter into, to engage with estate agents, you then can do the negotiation around costing and price ranges and what you could put in and offer for to, if you are interested in a property that you've seen, and then you can then go ahead and start doing the preparations around signing and offer to purchase with the respect of, either it's a pre owner or the estate agent or the developer. And then you wait for the outcome. Right. I like how you said it's an adult conversation. It's an adult conversation. You know, you need to put on your big old hat. The next question is, you know, I have so many questions on this. I feel like for the next question, this topic needs its own show and needs a whiteboard and it needs to be, literally, we need to dive deep into it. It's a flisp. And I have so many, you know, I've even searched and a few, gotten a few questions from friends and family members who have obviously done more research, you know. And one of the most important questions, before I even ask that question, maybe you can explain flisp. And why is the form so long? Why is the form? I think let's start with what flisp is. So the government really introduced flisp back in 2012, the Department of Human Settlements as a government housing subsidy to support home ownership and carry home ownership for first-time buyers. It's a subsidy for income earners that earns below 22,000 grand. Also, what's important is that you've got to be a first-time buyer and you must have not benefited from previous housing subsidies. You need to be over 18 and you need to have a home loan approval from a bank before you submit your flisp application. It is a separate application to that of your home loan application. So you really need to first get a home loan approval and thereafter, they need to gather your documents for the flisp submission of application. The form is long. The criteria really is for the first piece to assess your income, your expenses because it is a subsidy granted to you based on your salary income on a scale perspective as well. And the subsidy is really there to assist you either through a deposit or to help you reduce the outstanding balance on your home loan. And the vetting process is intense. So you've got to submit really key documents as part of the application process like your pay slips, your bank statements. If you have beneficiaries that you're taking care of and affidavit, your ID, your proof of your home loan application, I mean, you submit those and you can submit it to the National Housing Finance Corporation. You can visit their website. They've got great information about what the flisp is and they're really good at taking in applications and sharing the outcomes. And that's really flis when it's an encouraging tool to support, it's an encouraging tool. I call it a tool to support first-time buyers. And I really think that a lot of South Africans, we speak about it but it's something that's still very vague. A lot of people don't understand it. But at EPSO we really try to advocate and we really educate our consumers and our customers actually about what flisp is because I think it's important. I think it's a really, really nice tool that the government has introduced to support first-time store home ownership for first-time buyers. And you're right, a lot of people don't know about this and that's what's so shocking to me because I'm out there all the time and I'm like, guys, but there's flisp and they're like, huh? And I'm like, no, we can do this. As first-time buyers, we can do this. So the biggest question from a lot of the people in my circles is, is it something I have to pay back? Or what happens after that? So once the flist application is assessed and you receive an outcome, if the outcome is positive where the subsidy is granted to you based on what you've submitted, it then gets paid over towards your home loan, whether it's in form of a deposit or to reduce your outstanding balance. You never, you don't pay the government back for the money, but it's really to assist you with your home ownership journey. And that's actually what the flisp is for. So banks have partnered with the government to ensure that we really try and speak and do thought leadership about flisp to government subsidy. And we work with the Department of Human Settlements and government to support the advocacy of flisp and to encourage it for first-time buyers that qualify for the flisp subsidy as well. And they obviously do their own calculations to determine how much one is gonna qualify for. Absolutely, absolutely. And that's why I say it's a separate application. Banks cannot tell you what you can get. You submit your separate application, like I said, to the National Housing Finance Corporation. They will assess your application and they will share an outcome with you with what you've submitted to them. Right, okay, perfect. Thank you so much, Zyda. I think flisp is very important.  I know it is a hefty form. That is what I opened with. It is quite a hefty form. But take the time and fill it out. And like you said, it's a lot of personal documents that's needed. And I think the biggest thing about first-time home buyers is that beginning process, that start. It's all the documents, it's all of this, all this information needed. As soon as that's over, it's, I'm not gonna say smooth sailing because I don't wanna sell dreams, but it's almost easier. The first process is really just a lot of documentation and filling out all of these things.  It's been two weeks. They're still filling out the documents. So I think just take that step and fill out those documents. Do your research. Zyda, just before we close off, again, still let's focus on the first-time home buyers. APSA obviously offers numerous things. So let's talk a little bit about the offerings that you offer to first-time home buyers. Great, so AC, we've got great, we have got great solutions for first-time buyers. We've got, for our digital, we've got a great, exciting digital solution for our first-time buyers where you can submit your application online. And you could be eligible, you could qualify for a UPS subject to your home loan being approved. And this offer is exciting. It ends on the 31st of January, 2022. So that's quite exciting. And then we've got our my home proposition where we, for income earners below 26,000 RAN, soon as 6,100, we offer them a 50% discount on attorney costs.  We can also do a financial assessment for you through our financial consultants that can assist you with understanding your financial status as well as giving you guidance around how to financially get fit from a needs analysis perspective. We then also, you're also eligible to get a free home ownership training course which you go through to teach you more ins and outs of home ownership. And then we've got a young professionals solution for our young professionals out there. You can get a loan to value of up to 105%. You could use the additional 5% for your cost that you might need to pay for properties under 1.5 million. You get a 30% bondage discount there. We also give you access to all our insurance solutions that is accompanied with buying a house. You need home owner structure insurance. You need content cover to cover your content in your home. And then of course, we really encourage the market to always take up a life insurance that's seeded to your home loan so that in case of anything that might happen in case in event of death or terminal illness or disability, the outstanding home loan balance can be settled subject to that the life insurance value is covered for the entire home loan value as well. And I think that's very important. We also can draft rules so that you can leave your asset to a beneficiary as well. And I think we've got access to all your other great solutions such as great transactional accounts, check accounts as well. And you can get additional apps and rewards as well for being a home owner. And we've got a, we're a full bank. We offer full solutions and we've got everything there that can support you on your home buying journey, on your looking for insurance solution, looking for estate and walls, financial planning. And I think that's really important where you can get everything in one place as you embark on the important journey of home ownership as well. So we've got all these great solutions to support first-time buyers. Exactly, and with everything that you've said, you're supporting first-time home buyers before the process, during the process, and after. After the process, absolutely. I love that. You spoke about a lot of different types of insurances that one needs. Especially for first-time home buyers, if we could use a few moments just to educate those watching at home about the different types of insurances. Is that the word insurances? That customers need when, yeah. Purchasing their home. So I think when you purchase in your home, firstly, you have content that's in your home, like your appliances, and you'd want to insure those. So we have home content insurance cover that we can offer you. We have the home owners comprehensive cover, which is your structure insurance associated to your home, which is important to take up, which is accompanying the purchasing of your home. And then there is life insurance, which needs to be ceded to the home loan. So that in case of death or disability or terminal illness, the bond can be paid up, the outstanding balance can be settled. But that is subject to that the life insurance that you've taken out and ceded to absent home loans does cover the full outstanding home loan balance. So that your beneficiaries are not left with a surprise. They are then covered in that event. And like I say, drafting a wall is very important as well. You'd want to leave your asset to a beneficiary. And I think we've got all these solutions to support you as you embark on home ownership. Yes. Thank you so much, Sairda. If you can just let us know as we end off, how easy is it to apply for a home loan at EPSA? Well, let's visit our website and our home loans page to access all our digital tools, our pre-buying tools, and submit your home loan application online. Access our digital sales application tool, complete your application and submit it in under 15 minutes and you can get a home loan outcome. I think our app, our home loans website has all our tools available. It's accessible to everybody. And I encourage you to make use of our pre-buying digital tools as well as do the pre-qualification, learn, take our e-learning course and submit your home loan application online and get an outcome. And that is everything available to you. And that's how you can get hold of us at EPSA home loans. And it really is that simple. Before we close off, Sairda, I'm going to ask you very nicely to take off your EPSA hat quickly. Okay. Just for two seconds. Just please take off your EPSA hat. My question is, I'd love for you as Sairda manual to give first time home buyers advice who are doing it for the first time. It's a daunting experience and they are so afraid. Some advice from you, please, Sairda. The biggest, the guidance I'll give is that please assess your budget. Understand your income, your expenses. Secondly, understand your credit profile. Understand your status and retrieve a free credit report from the bureau, such as Experian and TransUnion. You are eligible for one annually. And understand your credit history. And I think those two together is important to understand. Can you actually afford a home loan or not? And I think that's the starting process. And then make use of the tools that we have available on our EPSA website to help you prepare. Sairda, you just went and put the EPSA hat back on. Thank you so much, Sairda, for taking the time out and sitting with us and explaining how simple and easy EPSA has made this home ownership journey process. Thank you so much. To everyone at home, don't forget, we still want to hear your story. If you have a first time home ownership story to share with us, what it was like going through the process, send us a message on Instagram or Facebook, and we'll be in touch.  See you guys again next weekend, live at 8 p.m. Take care.


Thanks, everybody, and welcome to the folks out in internet land. Glad to have you with us in addition to the folks in face-to-face. So my name is not Ron, I'm actually Anne, so just letting you know that we switched here. And I'm going to kick us off and provide a little bit of background on what we're planning to talk about today. So in essence what we're looking at are a set of profile practices basically for how you should manage your authentication from end to end. These will do a little quick introduction on these profiles, these practices. And then we'll hear a case study from Chicago about what they learn in their implementation of these practices and how they're using them. And then we'll give you a little bit of background about how you can learn more. There's a whole community out there working on this. And so if you read through them, you have questions, you're looking at strategies for how to better your passwords. This is the place to be. So brief intro. The basic premise behind these practices comes out of the identity federation context. So if you think about it, if you're familiar with an in common identity federation, there's a split between who does the authentication and the identity management portion and who does the actual service providing and the authorization. So the campus traditionally does the identity providing, issues the credentials, manages the authentication, but it's the service provider that may be a government organization like NIH or it might be people admin, for instance, that actually has an is incurring the risk of that authentication transaction that you're managing on your campus. So the whole profile nature came out of federal government and HSPD 12. I won't go into all of that, but you may be familiar with some of the work they've done at NIST. In essence, what they're looking at and what they've come up with is a set of practices in 863. I'll tell you a little bit about that later. So the campus then issues these practices or issues these credentials and the individual then accesses the service provider. The service provider needs to trust the campuses that they've done due diligence. They need to understand that the risks of their service that they're offering to the campus has been met. But as you can kind of imagine, you know, if I have relatively low risk service, so you're just accessing, for instance, a minimal data set that has no PII in it and is freely a shareable to everyone, you may not as a service provider want to require the campus to have a really strict level of security on the authentication. The actual implementation and the cost that the campus would have to incur to support your security needs really don't match, right? And so you would have very few identity providers actually accessing your service because it's not cost effective for them to do so. So there's a balance between balancing the risk that a service provider has and the cost and the effort the identity provider has to better their practices to address the risk. So I'm going to tell you a little bit about what's in the in common assurance profiles first, and then we'll go into kind of some of the background and why I think this might be a good thing for you to take a look at. These eight sections really make up the identity assurance profiles. We also have another document that's a framework that really describes the trust and how this all fits together, but the profiles are really where the meat is. So as you can see, the basis of trust in identity assurance and federated transaction has a business and policy aspect to it. We have to make sure that the organization first is who they say they are, right, before we even get to the individual, right? We have to make sure that the registration and identity proofing of the individual is set. We have to make sure that the technology that you use to do your authentication, the actual token is a good one, the approach you're using, and then of course how you distribute it to the individual is also solid. The actual authentication process, the transaction has to be well thought out, and then a key piece is how do you make sure that the individuals are kept separate in your identity management system and manage that relationship, and then the information that you convey about that person to the service provider has to be solid as well, and then of course your technical environment, how you protect your network and your systems physically, for instance, is also a component. So as you can see, the authentication process goes from inception, creation of the account to the actual decommissioning of that credential. So it goes from end to end. I guess you could say in a way the authentication lifecycle. So you might say, well, this is great. These profiles are actually password-based. Why should I really care about these profiles? So don't we want to use multi-factor? And I would say, yeah, I think multi-factor is absolutely the way most folks are going. It makes a ton of sense, but you're going to have passwords around for a while. You won't have multi-factor probably rolled out to every service and for every individual, possibly for a while. And you need to kind of look at the services and the data. You still are protecting with passwords. There may be some really good reasons why you want to do some best practices on how you handle authentication. Also, not every risk that you're dealing with with respect to passwords is phishing, right, which is what multi-factor tends to address. There may be issues like fraud, like issuing the credential to the wrong person, for instance, because you didn't identity-proof. So there are other risks that one incurs if you're not looking at the full gamut of your authentication service. So what are your choices there? Your choices are you can use stronger credentials where you can, like multi-factor, and you can improve the passwords until you no longer need them. So I just want to give you a little bit of background that will hopefully make you feel all nice, warm and fuzzy about the incoming profiles and where they come from because you may not know what these are. And they really have a quite substantial provenance that is meant to both help you implement and then also ensure that you're doing the right thing. So you probably have heard of the 863 e-authentication guidelines. It was written for the federal government by NIST. This is complimented by OMB MO404, which is really a risk analysis methodology that GSA, that OMB put together. So the two for the federal government came out of the HSPD-12 directives that were come out of 9-11. And they were meant to, in essence, increase the security and verify the identity and increase the level security transactions for federal services federating with each other. So these are federal specs meant for federal agencies. So the U.S. government, though, came out and said, you know, we don't really want to be in the authentication business for things like, you know, consumer credentials. The IRS does not want to manage your authentication to their services. They really would like to federate. That is their long-term vision. And so they put together an organization under the CIO console called the Identity Credentialing and Access Management Subcommittee, FICAM. So the F is federal, something that we non-federal people put into those acronyms, a federal ICANN, federal grouping. So you think of what they're doing is an API for trust. They're taking 863 and saying, we understand this is written for the federal government, right? But we want to put it out there and wrap it with some actual trust framework requirements like verifying business, right? 863 has nothing in there about business and business requirements. It doesn't have much in there about technical and facility controls. It doesn't have a lot about, in fact, nothing about policy and how often do you renew and verify, for instance, that what you're doing to support their requirements is still true, is still valid. So FICAM put some wrapper around this and then they put it out there, the community, and they said, community, we would like you to apply as trust framework providers and tell us how, develop your spec that is comparable to 863 and we will assess whether it's comparable or not. So in common, of course, you know, acting on behalf of higher education, because that's our gig, right? We know that higher education has very strong ties with federal government. We already federate with NIH and NSF and over 40 services and they're a really big, both obviously grant partner as well as compliance partner for us. So we know that the federal government is really key service provider for us. So we said, yeah, let's do that. Let's write one of these specs. So we did. We wrote the identity assessment, identity assurance assessment framework, which describes our whole framework in terms of how you get approved, defines all the terminology, things like that. And then we wrote a document called the identity assurance profiles, which is equivalent to NIST 863 level 1 and level 2. I should say comparable to, right? So we then went through long story short, a full audit of our profiles against the FICAM program and came out the other side with a nice stamp of approval. So these practices really are written for higher ed because they are not 863. Those of you who are well versed in that will read it and understand that immediately. They are written with intent, not specific requirements, because we didn't want to go through and change and really chase the technology development. We wanted to leave it open so that campuses could come to us and say, I really like these requirements, but we're going to do it this way. And here's the risk assessment that we did and here's why we should be able to do it that way, right? That's called an alternative means. And then we have an assurance advisory committee that's made up of service providers, relying parties and auditors that reviews those. Once those alternative means are accepted, they're added to the specs. So the spec then grows and morphs depending on what the community is interested in doing and what works for you. Now, it has to obviously comply with the spec, but it enables the spec to be a less rigid and more flexible with respect to implementation, which is what we're trying to get at. So I guess I would end my section before I turn it over. I'm the potatoes. He's the meat before I turn it over to Ron. And ask you a question. When you're doing your authentication, you're designing your processes, you're looking at your end to end, what processes and what practices are you using for guidance? If you have a breach and your president comes to you and says, how do I know we've been doing due diligence? You can hold up these practices. They're approved by the federal government. They're written for higher education, by higher education and say, these are the practices we're using. Good thought. So my colleague, Ron Thielen from University of Chicago. Thank you, Ann. Apparently, as you cause, could only afford one lavalier mic, so I'm going to be tethered to the podium. If I wander off and you can't hear me, you can feel free to throw something at me. Just be aware if I see you dozing off, I might toss it back at you. So while Ann started out at the 50,000 foot level, I'm going to dive down a little bit deeper into actual technical challenges that we faced at the University of Chicago. Hopefully, I won't nose dive into the ground, but you can help me there. You see me going way off the rails. You could also move closer if you feel like it. There are plenty of seats up here. We could actually turn this into a round table if you wanted to, if it weren't for the Internet audience. So if you were at the 11 o'clock general session this morning, you saw a slide that said compliance is not security, and I want to reinforce that a little bit. Sometimes you implement a control because you want to achieve compliance, and sometimes you do it because you're trying to improve security. Hopefully they're both aimed at the same target, but that's not always the case. But what I have found in working on silver, in common silver compliance at the University for the past five going on six years now, is that trying to comply with the standard has led us to see several different ways in which we could improve our security, and I'm going to talk about some of the ones we're working on right now. If you go to in common and you look at the identity assurance assessment framework, which is a lot of words which describes identity assurance and the process and what it's aimed at, it doesn't really have the profiles itself. There's a separate document for that. But one of the things that's really useful in the assessment framework is appendix C defined terms, because you have to be familiar with what's the difference between an identity provider and a verifier, and the role that different pieces of technology play in your own environment. So some of the things I'm going to be referring to are the identity provider, which in our case is shibboleth. It's the thing that actually makes SAML assertions. The credential stores any place where you're storing the authentication secrets that the identity provider is relying on. And the verifier is the thing which actually verifies that the authentication secrets are correct. So in our case that's LDAP. In the latest version of the identity assurance framework and profiles, they introduced a couple of new terms, protected channels and approved algorithms. And these have been the bane of my life for the last two years because the words used to be industry standard, which was a lot easier. Industry standard could mean a lot of things. Protected channels refers to approved algorithms. Those approved algorithms has a very specific meaning. And there's a little bit of leeway in that in common could approve an alternative means, as Anne alluded to, alternative means, which satisfies the approved algorithm requirements, but they haven't done that yet. So you really have to fall back on what NIST says is an approved algorithm. And this is talking about hashing and encryption algorithms. Why do these terms causes problems? Well, one is that if you look at the NIST documentation, you'll see that, for example, SSL version three is no longer adequate. You have to move to TLS. So we have to change our services to use TLS. So we need to use approved algorithms and protected channels for things like the web page where users manage their accounts. The web page, the identity management staff uses to manage the services. CIS admins, SSHing into the servers and the identity management systems have to be using appropriate algorithms to protect their SSH sessions. The Java libraries that we use to support some web services in our environment needed to be upgraded. Shibboleth and Grupper required some changes. And mostly it was just a lot of grunt work to do. There's one aspect to this which I'll talk about towards the end that we're not going to exactly fix, but we're not exactly required to either, and I'll explain why. The biggest area where protected channels and approved algorithms has caused aesthetics is in active directory. So Internet2 and InCommon and before that the CIC has had a couple of different iterations of working groups looking at the issues in active directory and supporting the InCommon Silver Standard and what the implications are because we pretty much all have active directory in our environments and there are issues. We just finished a reiteration of the active directory Silver Cookbook. I worked on both the first version and the second version. It's taken us a couple years. It took us a full year to get this new version out because there was a lot of parsing of the spec that we had to do and finding information can be difficult. So even though this says these are the approved algorithms that I'll use for encryption, finding out from Microsoft what algorithms they actually use, the different parts of their main controller and active directory architectures was very difficult. Even though we had Microsoft on the calls with us sometimes, it still was difficult prying out the exact information about well, where is our seat four used versus shell one versus AES versus whatever. So when you go to look at the AD Silver Cookbook and I encourage you to take your time digesting it and understand how it fits to your environment. So this is the slightly modified identity management functional model. You can find the original in the assurance framework document, but we modified it just a little bit to include the box in the lower right-hand corner that says active directory verifier. So let me explain what that means. Active directory in our environment is not the verifier that Shibboleth uses. Shibboleth is the IDP, the identity provider there. That's a key piece. It uses LDAP as its verifier. The issue for us is active directory is still a verifier and active directory has the same authentication secrets that the IDP relies on because everybody in our environment has one network ID and password that they use regardless of whether it's LDAP or active directory based authentication. So that means you have to understand in your environment the role that active directory plays. Is it a verifier or is it the verifier for the IDP because different requirements in the profile may apply differently depending upon how you answer that question. Some universities actually have separate credentials. So your Shibboleth user ID and password may be different from your active directory identity. In that case, a lot of what I'm going to say, what I'm going to talk about may be off the table for you. A lot of us though have moved in the direction of single user ID and password for everything. So if we look at active directory, these are the challenges that we faced. Our LM compatibility level was set to 4. What that means is that even though according to the documentation NTLM v2 is preferred, NTLM v1 is still accepted. And while I say according to the documentation, that's because you would think that if a client could do both and one was preferred, that's the one it would use. It turns out that's not always the case. Sometimes clients get lazy and just use the first one that works. So even if the client uses NTLM or supports NTLM v2, it might wind up using NTLM v1. I'll explain why that's bad in a minute. I found looking that NetFlow is going to the domain controllers, I was surprised to see that there was a lot of traffic that was not going over SSL. And when I looked at it further, I found that it's not signed. So it's not encrypted. And so there are LDAP binds. Even though we have an LDAP service, Active Directory, of course, presents the domain controllers present an LDAP service as well. And some clients are perfectly happy to send their credentials to Active Directory as an LDAP service completely unencrypted. So you may have user IDs and passwords flowing over the wire in clear text in that case. If you look at the cookbook, and I'll explain the details of why this is later, one of the recommendations the cookbook makes is that you may want to look at something like BitLocker for your domain controllers because there is a requirement that you encrypt the password store, the credential store. In our environment, we can't use BitLocker. It's not supported under VMware, and most of our domain controllers are virtualized. So those are our current AD challenges in dealing with Incom and Silver. And are they compliance or security issues? Well, what I've been telling the users mostly to try and convince them that we need to do the work to solve these problems is that these are not compliance issues. These are security issues. They were brought to light by our compliance efforts, but the fact that you have user IDs and passwords flowing over the wire in clear text, that's certainly a compliance issue, but it's more of a security issue, and we would want to solve it regardless of whether we were trying to comply with Incom and Silver. So our response so far has been a combination of technical controls and one or more alternative means statements. So again, that phrase alternative means, and if you're more, say, familiar with the audit world, if you're kind of an ISAC, a kind of person, you might think of an alternative means statement as a compensating control. So I'm not going to go through all the profile requirements because we only have an hour, but I'm going to look at error two in particular that affected us. So one that the AD Silver cookbook working groups have spent a lot of time working on is 4236, which says that you have to protect the authentication secrets. Now there's a 42362, which is specific about authentication secrets used by the IDP, and in our case, since the AD credentials are the same as your LDAP credentials, even though AD isn't the IDP, they're the same authentication secrets. If those credentials are sent between services, the services have to use protected channels, and again, that implies they have to use the NIST FIPS-approved encryption algorithms for that with an exception, which I'll propose later. And the other one which hits us is that if non-IDP apps use them, then you have policies and procedures in place to minimize the risk of their exposure. So where this comes into play, and I'll talk about this, is if, for example, you've got a web page that uses form-based authentication, that's a non-IDP app, probably, it's maybe just some random student-government-run application on your campus that decided they wanted to use LDAP to authenticate the users. Then in that case, they don't need to use protected channels, but you have to have some sort of a policy or practice in place to mitigate the risk of them doing things wrong and shooting themselves in the foot and exposing your passwords. So how do these apply specifically to the active directory NTLMv1 and unsigned LDAP bind issues that face us? Well, as I said, because we still accept NTLMv1, but NTLMv1 isn't actually passing the password. NTLMv1 is actually passing an NT hash that's encrypted with the password. So who cares? Well, it turns out that for $34, you can run that NTLM hash through something like Cloud Cracker and then run the result of that through Cloud Cracker, and then, so after you're two runs, you get the password back. So even though NTLMv1 credentials are not your password, they're just a step away from your password. So given how weak the credentials are, again, it's a security issue, not a compliance issue. So our first thought was, well, let's turn our shields up, let's go to LM compatibility level 5 and just stop accepting NTLMv1. Turns out that it may not be possible, or at least as easily possible as we may have thought, for one very particular reason, and that's radius. So MSChapv2 is the phrase used in the literature is cryptographically equivalent to NTLMv1. Just say it's NTLMv1. And EAPMVSChapv2 v2 is fairly ubiquitous. If you use edgerome or support edgerome, you have to deal with these issues. EAPTLS supports or protects, actually creates a protected channel between the client and the radius server. So you're good there. Even though you're using NTLMv1, it's flowing over a protected channel. The problem is if your radius server is one of those that has implemented some of its authentication using Samba code, then between the radius server and the domain controller, your NTLMv1 or MSChapv2 credentials are flowing over the wire again. So this diagram from freeradius.org illustrates exactly our situation in that we're okay up until we get to the radius controller, and since we are using freeradius on our campus, along with a couple others for historic reasons, we do send NTLM to the domain controllers. So what are we going to do about that? Well, one solution is to get away from using EAPTLS, so instead of using the Chapv2 credentials, you're actually relying on certificates issued to clients, but that means you have to do client certificate management for all the devices on campus connecting to wireless, and that's not going to happen in my lifetime, or at least certainly not before I retire. Another option would be to move off of freeradius and move to something like Microsoft's NPAS on Windows, and then the credentials aren't flowing over the wire, and Microsoft has done some little tricks to make sure that if you go this route, you're not exposing your credentials in that way. Another option would be to actually create protected channels between all your radius servers and domain controllers, and this is the route that we think we're going on, so you could do something like create IP sect tunnels between all the radius controllers and the domain controllers, and that's what I thought we were going to do until the Windows administrators got cold feet because we've got a big cluster of radius servers, we've got a dozen or more domain controllers, and they just thought that it was getting way too complex. Another option, and this is my opinion, but I think if you created something like a private backnet between them, it wouldn't technically meet the definition of protected channel, but I suspect based on conversations I've had that if I submitted an alternative means statement in common saying, hey, we call this a protected channel because it's a non-routable VLAN, non-addressable in any way. It's basically a private backnet, and hey, if you really required me to, I could do it at layer one. That would be as good as a protected channel based on encryption. Another option we're looking at is to use radius proxies and actually putting radius proxies on the domain controllers themselves and then using something like radsec to create TLS tunnels between the radius serving the wireless infrastructure and the radius proxies sitting on the domain controllers. So we actually haven't picked the approach that we're going to take for this yet. I think it'll be one of the latter two. We're still assessing it. The other thing that you have to do then, though, is what I call monitor and mitigate. If you're going to leave NTLMV1 on, you may have to put in some other control to deal with the fact that your domain controllers are still accepting NTLMV1 credentials. So this is a case where not everything can be fixed with the technical control and there could be lots of reasons for that. So we're going to implement the monitor and mitigate strategy, which we've documented and submitted in common, and if you go to the Internet2 community pages for insurance, you'll see some statements up there describing monitor and mitigate. I'm going to go into a little bit of detail here about how that works. So for NTLMV1, a logon event is generated and that logon event, if it's an NTLM logon, has a field which tells you which version it is. I recommend that you filter these events because in our case 98% of them are for anonymous. It turns out anytime somebody goes to an IIS web server anonymously, even though they're not doing any authentication, it says, oops, I got an anonymous logon. And so it generates an event which is completely useless and meaningless. So you can save yourself a lot of traffic and storage cost if you just filter those out. Also, I found that all these radius authentications don't generate 4624 events. Apparently, they're not considered logons. They're merely authentication. So they weren't showing up in any of my logging. So what we did do is we created some PowerShell scripts that filter the events, write them to flat files on a file share. I'm probably going to be replacing the PowerShell scripts with an X-Log if you're familiar with that. I'm finding that to be a better tool for this sort of thing.  So I said to the Windows admins, here's a problem. Tell me how you want to solve it. They came back with the PowerShell scripts. I said, okay, great, go do that. Now we're a year down the road with this. I'm going to go back to them and say, okay, let's look at this NX-Log thing because I think it's better for a lot of different reasons and I'm going to be doing some education around that. So it writes out an event and here's a sample. It tells you the domain controller, where it happened and the user and what domain they were authenticating to and what system they were on and what the address for that system is. So then we have a Perl script, which once a day goes through all those log files, creates some reports based on what it finds. If it finds a user showed up at one of those events and that user was a valid, in common, silver user, then we take away silver from that person and we create a help desk ticket saying to the help desk, you got to go help this person because they did something bad on the network. They did something that generated an NTLM V1 logon. Dad exposed their credentials in an unacceptable way, so we had to turn off silver. In the long run, I don't think this is scalable, but it's good enough for us for now. What happens is if they can't figure out how to help the user, the user then goes and gets silver re-enabled for themselves and then they just wind up losing it again a week later. So we have to actually fix the underlying causes. So as I say here, this might be good enough for compliance. I think it'll be good enough for our achieving silver, but it doesn't really solve the underlying security problem in that we still have NTLM V1 credentials flying over the network. We don't have a lot of them fortunately. I think in our case, we will eventually be able to get to a better technical control for this. But for now, the next step is go fix the problem at the source. So go talk to the user, find out what they did, we know what system they were using, find out what it is about that system that causes it to use NTLM V1, and then fix it to use something else. Second problem with credentials going over the network in the clear with Active Directory is LDAP binds in the clear. So by default, Active Directory is perfectly happy to provide LDAP services and take binds in the clear. There are some things that you can do to fix this. You can turn out LDAP signing, which it turns out also encrypts the payload. You can require LDAP to use SSL or TLS, so basically only use LDAP-S. Or you can do IPsec for everyone, which again is like putting certificates on all the mobile clients. It's not something we're going to do. Requiring LDAP-S is likely a non-starter because some schools have found that that adversely impacts your Windows clients.  Active Directory is there for your Windows environment. However, if you turn on LDAP data signing, your Windows clients won't be affected. They're happy to deal with that. But it's likely to break some non-Windows clients. So Max and Samba may have issues. You then have to go mitigate those. So just like with the NTL MV1 events, if you're using Windows Server 2008 or later, you can turn on an event, 2889, which says very verbosely, the following client performed a SAS whole bind. I'm not going to read the whole thing. What we did again is we had the PowerShell scripts go through, filter those, reduce that verbose event to the facts that we want, and write it out to log file. And then the same Perl script that handles the NTL MV1 events handles these events as well in the same way. And again, this may be good for compliance, but doesn't solve the underlying security problem that you've got passwords going across the network in the clear. So somebody still has to go talk to the client and find out what was it that you did that caused this to happen. And we've found a few common scenarios, but there are some that we still haven't been able to resolve. So for example, Microsoft Office on the Macintosh by default loves to do these unsigned binds to Active Directory as an LDAP service, one of the stewing lookups for people. You can go in and you can change it to do it securely, but it's not the default. Other circumstances, we've had cases where people generated an unsigned LDAP bind. We went and talked to them. We tried to dig through the logs. We never were able to figure out what it was that caused the problem. In that case, at least in one infamous case in my office, we told the user, look, you don't need silver right now, actually. There's no use case for it in your case. So until we figure out what the problem is, just leave things as they are and we'll work on it. A week later, he went back, reasserted silver, and then lost it promptly and got quite upset because he did something we told him not to do. But I think we all deal with situations like that too. The other profile requirement I'm going to talk about much more briefly is the one that says that if you're storing authentication secrets, then they need to be secured. And there are three ways the requirement gives you to secure them. And again, in our case, remember, these authentication secrets are not the authentication secrets. LDAP, I mean, our IDP is using, or LDAP is using directly, but they are the same authentication secrets those services use because we have one user ID and one password for everything. So the NT password store needs to protect these authentication secrets either by storing them using Assault at Hash, encrypting them using an approved algorithm, or protecting them using something approved by NIST level of Assurance 3 or 4, which none of us is going to do. We tend not to be protecting the nuclear arsenal, so level of Assurance 4 is not where any of us are really aimed. The problem is Active Directory does none of these by default. It doesn't salt the hash, it just stores the hash. The algorithms that they use to do the encryption are not approved. And so your Active Directory store cannot meet this requirement if you want to do silver. The AD Silver Cookbook recommends that you use some other third party technology to encrypt the password store. And the example we provide in the Cookbook is BitLocker because it's free, it's there. And BitLocker will use an approved algorithm as it turns out. I think BitLocker will use AES as its algorithm for doing the encryption. The problem in my case is that BitLocker is not supported under VMware and some of our domain controllers are virtualized. Now there are other encryption solutions out there, but we haven't vetted any of them yet. So if we were to go down the route of getting a third party encryption product that was aimed at VMware vDiscs, there would be an adoption speed bump for us. So we're going to try a different approach. And that is we're going to create an alternative mean statement based on our risk analysis of what this whole requirement is trying to address. So for example, we're on the domain controllers themselves, we're whitelisting applications so that if there were a breach, it would be much more difficult for somebody to exfiltrate data by introducing tools which weren't native to the platform and already whitelisted. We have physical media management controls. So if the requirement to encrypt the store is there because you're afraid that a hard drive is going to walk out, well, for one thing these are virtual drives. So they're spread out all over the storage infrastructure. But we have physical media management controls that we've already been audited against for FISMA compliance. So I think that that circumstance would be covered in a federally accepted way. We do use multi-factor authentication for administrative access to all the window servers in our data center. And we use bastion hosts. We rely heavily on net flow analysis. So we've got alarms specifically set up looking at the traffic on the domain controllers. And basically we're doing anything that we can think of to mitigate against data exfiltration from the domain controllers. So we'll see if that gets accepted as an alternative mean statement. But I was an English major for a while, so creative writing is in my background and I think I can manage it. Now the last thing I'm going to talk about, this is not an active directory issue, but this goes back to the requirement that you have to protect the authentication secrets on the wire. So it's similar to the NTLM V1 issue. But it's the 42363 requirement that says that you have to have policies and procedures to minimize risk of exposing those credentials to non-IDP applications. So the IDP being the identity provider, the IDPO being the identity provisioning office. The things under our direct control all use protected channels and approved algorithms, but there's lots of things out on the campus that could be using the same variable. So we're locked down, but on our campus anybody can use LDAP as an authentication service. So that means that even though we encourage the use of shibboleth, there's still lots of forms-based web pages on campus where people are entering in their network ID and their password to get into some application that is not centrally administered. I mentioned student government a few minutes ago. As I said, anybody on campus can put up an application and use our authentication service. Now because we've locked down the LDAP service itself, the communications between their web server and our LDAP server are secure. On the other hand, we have no way of knowing in advance that they've done the right things on their web server like configuring it to use SSL on the page where users are putting in their user IDs and passwords. So what we've done is we've created some scripts that go through the LDAP logs and identify all the addresses where our binds are coming in from. We look at those addresses, try and figure out what kinds of services might be running, what kind of ports are open. Then we crawl over those addresses to look and see if we can find web pages where users are entering in user IDs and passwords. And if we find any that are not using SSL, we create a ticket and then somebody has a conversation with whoever's responsible for that machine to try and motivate them to fix the problem. Motivation meaning if you don't get it fixed within a reasonable time frame, we'll actually block you from the network. So that's it for the, we went from the 50,000 foot level down to about the two foot level. So there's quite a wide range there. Does anybody have any questions about what we presented or assurance in general? Any questions from the internet? Hi. I have a question and that is, how do you go about designating this person or that person as meeting a certain level of assurance as defined by in commons, bronze and silver statuses or profiles? You said that you were able to revoke an individual's silver status. Do you just award that by default and then remove it when somebody does something they're not supposed to or do people specifically apply for this or how is that all managed? So the 50,000 foot question is, not everybody necessarily needs to have a level of assurance or even the same level of assurance. It depends on what services they need to access and what the service provider is going to require. The way we've done that on our campus is, and I didn't go into the business process aspects of all this. I went right into the technical because I knew that there were a lot of technical people in the audience. When we first started down this road, my belief was that the business process aspects were going to be the most difficult. The questions around how do you actually verify that this person who says they're Ron Thielen is Ron Thielen? And there are requirements spelled out for ways to do that, but actually implementing the business processes to do that can be quite tricky. So in our case, if somebody feels that they need in common silver, and I'll talk about that in a second, then they actually have to show up in person to our identity and privileges office and prove that they are who they say they are. They also have to register a non-university electronic address. So you have to have an electronic address of record so that we can contact you in case there is some security-related event that affects your ability to have your silver assertions. Once you do that and then once you meet the password entropy requirements, so you have to have changed your password within the past year, that sort of thing, then we actually have a page where it shows you as you progress through meeting all those requirements, you get a little green check mark, and then when you get all the little green check marks at the end, you now could get silver assertions made on your behalf. How that's all handled under the cover is through a bunch of grouper groups, and so what we do when we take away silver from somebody is we just put them in a grouper group that says silver denied because they failed the AD audit.  Now in the case I talked about where I said to that user, you don't need silver, it was literally because they weren't using any services that required them to have silver. They were just doing it because they wanted to be good citizens and they thought that going through the silver process would be useful to them, and eventually it will be, but until I can figure out what the heck is Macintosh is doing to make him lose silver on a regular basis, there really isn't any point for him. Did you have anything you wanted to add? I was just going to say that a number of campuses have addressed this problem. I think Penn State in particular developed a central person registry, and it's actually available, it's an open source that tracks assurance as part of that. So they do it in their central person registry, and I think have seven or eight different fields under each entry that make sure that addresses all the specific requirements they have for that individual. Because not only does the organization get, as you know, certified, but then each individual, it's a transactional thing that's expressed using authentic context at SAML, a SAML 2 authentic context assertion to at that point in time is that individual bronze or silver. So what Ron is doing is exactly what needs to be done, and that is if a person does something that compromises their silver credential, it needs to be removed and then re-elevated again when the silver issues are addressed. Can you do it with the microphone please so we have the... Does that drop that person down to a lower level like to bronze or do they lose any kind of assertion at that point? It probably depends on the campus and what their policies are, but yeah, a lot of times it can be bronze. I think it probably depends on the breach and the issue, too. Right, we actually... We've been concentrating on silver because for us we think that's where the value is. We'll worry about bronze later. Once we get silver, we think doing bronze will be pretty easy for us. But in cases like that, we're going to have to think through whether they should be dropped down to bronze or have all their assertion capability removed. And it will depend on the nature of the issue that caused them to lose silver. So if you go through the profile, you'll see some things are highlighted as being bronze requirements, some things are highlighted as being silver requirements. So if the thing that they do highlights a silver requirement, but not a bronze requirement, then theoretically we could just drop them down to bronze. But that will require a lot more logic on our end, I think. So you mentioned the thought of having two authentication stores to isolate these primarily Microsoft issues, two different authentications, one for silver and then the other for the NTLM V1 requirement. Did you just rule that out because of convenience? Was there just too large of a community that would be juggling the two credentials? I'd say there were two things. The latter is the primary in that we just decided that in our case the community is too large for us to go to the extent of setting up a whole new credential system for them just to deal with this issue. And the other one is that we have a senior director who really believes strongly that this should be possible and that if we can do this and show people best practices and how to accomplish this, it'll be good for the entire community. And so it's sort of my mission statement to go forth and show that this can actually be done. If we can solve the hard problem, then you don't have to. That's right. And I guess in keeping with that, I wanted to point you at the questions and answers slides here that goes over basically the community that's out there to help you implement these. And I think they're valuable, even if you're not interested in common assurance and getting certified using them to inform your authentication service. As you can see from Ron's in-depth discussion, it really helps you shine a light on those cobwebby little corners that you don't normally look in. And you kind of assume that it's all working. And then when you kind of do a deep dive, it helps you do that. So I think even if you're not interested in any common assurance, it's a helpful thing. And as I mentioned, it helps with the due diligence. But there is a group out there. We have an entire Wiki devoted to helping folks deploy this. The AD Assurance Cookbook, we did a webinar actually today at 11 o'clock, and that will be put up there on that Wiki also talking about what the AD Assurance Cookbook is about, what are the major components of it, and so forth. And you can take a look at that. We also have a case study from Virginia Tech. They are bronze and silver certified, and they put all their information out there. In terms of the NTL MV1, we had a chat with Brian Arquils, and he's going to be doing a presentation on that, getting rid of NTL MV1 at University of Washington and his adventures in doing that. So he's going to be sharing that also with the assurance community. So this is basic security stuff, folks. So it would be great to have you join us. And thank you very much for coming. So we've been given the hook. If you've got any other questions, here's our contact information. Feel free to shoot an email to us. Thanks for coming.


It was great to sit down with some students earlier because health care starts with people, with the workers who dedicate themselves to taking care of others, make sure they get the training, skills and support they need to give patients the very best care. I was lucky to meet people who study in health science a little earlier, people who are ambitious and inspiring. These students represent the future of our health system, and today we are here to talk about the future of health care in Manitoba. Every year, thousands of people put up their hands to become health care workers in Canada, like these students here at RRC. They join the hundreds of thousands of professionals who uphold one of the key promises linked to being Canadian. That no matter where you live, what you earn, you will always have access to high quality, publicly funded health care. We have to be honest with ourselves, even as we take pride in our system, there are some real challenges facing our health systems right now. It can be too hard to access a family doctor or a nurse practitioner. Emergency rooms are too often overwhelmed. People are waiting for the surgeries they need, and health care workers are under immense pressure working in conditions that make it even harder to be there for their patients. The people of Manitoba deserve a system that is there for them that they can rely on. That's what every Canadian deserves, and that's why last year our government stepped up. We've committed $200 billion over the next decade to strengthen public health care in Canada. As part of this investment, we said we'd work on tailored agreements with each province and territory to help address their unique challenges and needs. And today we're announcing that we've reached our seventh agreement, this one with the Great Province of Manitoba. Last year, we committed to investing $200 billion over the next decade to strengthen public health care in Canada, and we work with each province to respond to their unique needs. Today, we have a major announcement to improve the health system of Manitoba. Our government will invest $434 million over the next three years to help Manitoba. It will increase the number of doctors in the province and recruit health care workers for rural and northern communities. It will make it easier for health care professionals to practice in Manitoba, including those with foreign credentials. We'll see reduced wait times at ERs, and we'll address blockages and backlogs. We'll ensure people have access to the mental health care they need, including young people. We'll modernize the health care system, and we'll be addressing gaps in care experienced all too often by Indigenous peoples. In addition, we're making real investments to improve the lives of seniors in Manitoba, almost $200 million on top of the previous 434, which will mean more home and community care and better quality long-term care, including more personalized care for people who live in long-term care. In summary, we have two agreements with Manitoba today. It's a total of $633 million to improve health care, including investments in home care, community care, and long-term care for seniors. We are eager to continue our work together to transform care and deliver concrete results. These investments are about delivering real results, about improving patient care and patient outcomes, including for the most vulnerable. Nothing is more important than your health. The federal government is therefore stepping up to make sure that provinces and territories are equipped to deliver the care you expect and deserve, and to protect the promise of our universally publicly funded health care system that is core to who we are as Canadians. The pandemic has shown us all the importance of investing in health care, and has reminded us at what point the health workers are essential.  Wabonai just had a great conversation with a number of young people who talked about the calling, the drive they felt to get into health care and contribute to their communities, their desire in many cases to be able to take what they're learning here and return to their communities to deliver health care to the families and neighbours that they grew up with. But also we talked a lot about the mental health pressures on our frontline health care workers and how governments of all stripes need to do a better job of supporting them and not just supporting them when they're facing their most acute challenges, but supporting them in a proactive way so people can stay resilient and healthy longer, even in the critically important and sometimes very, very emotionally difficult jobs that they are doing. So I want to thank every doctor, social worker, paramedic, orderly therapist, OT, the list goes on and on and on of professionals who step up to serve their communities, to serve their fellow Canadians. You are there for us and today we're here to tell you that we will be there for you. You keep us healthy, you keep Canada strong, you continue to make Canada the very best country in the world and we're going to keep working hard to make sure it becomes even better.


Aloha, I'm Kili Akeena, President of the Grassroot Institute of Hawaii, and I have some good news for you. The good news is that Hawaii legislators are eager to solve our pension crisis. The better news is that we have the solutions they need. This week, the Grassroot Institute was able to sit in on the Legislative Fiscal Academy. The event was sponsored by the National Conference of State Legislatures, and it featured national experts on economic issues. Its purpose was to provide Hawaii legislators with insight on a number of fiscal issues, as well as to review best practices and what's happening in other states. Now, because we spent most of our time reviewing and reporting on this information, there wasn't much to surprise Grassroot staff at the conference. However, the session on unfunded pension liability and reforms was both interesting and gratifying. No one was surprised that Hawaii's unfunded pension liability and funding ratio consistently ranked near the bottom among all states. The director of S&P Global's US Public Finance, State and Local Government Pensions Division hammered the lessons home with the presentation on how OPEB liabilities affect our S&P rating. He made it clear that without reform results in meaningful funding progress or benefit reductions, those liabilities are likely to grow even larger than they are now. The response from Hawaii's policymakers was encouraging. They wanted to know what they could do to address the issue. Now, that's where things got interesting. The presentation on successful reforms tested in other states closely followed Grassroot Institute's own recommendations in our recent report called, How to Resolve Hawaii's Pension Debt Crisis. And you can get that at www.grassrootinstitute.org. It was all there. True hybrid plans as opposed to the current hybrid and name only plan available in Hawaii, switching to defined contribution plans, cash balance plans, choice plans, changes to contributions, age and service requirements, all the solutions that will work. The one question the NCSL experts couldn't answer, whether the Constitution allows for these changes, was also covered in the Grassroot report. Aware that this will be a point of debate as we move forward, Grassroot conferred with experts and looked to the example of other states for guidance. Now, based on that research, we believe the state Constitution protects accrued benefits, but it still allows for changes to current employees' benefits moving forward. Now the session helped Hawaii legislators see that the state is falling behind when it comes to addressing pension liabilities. In the past decade, 10 states, plus Puerto Rico, moved away from defined benefit plans. In 2018 alone, 210 pension reform bills were enacted in 42 different states. This is no longer a third rail in state politics, it is the necessary focus of real and effective change. During the session, Representative Sylvia Luke asked the presenters, what kind of things can we improve upon? The experts diplomatically avoided giving specific recommendations, but Grassroot is already on record with the solutions and lawmakers need. We urge Hawaii legislators to make use of our recent pension report and consider the solutions we offer. Reform does not have to be a zero-sum game that pits unions and workers against government number crunchers. It's possible to enact reforms that are welcomed by state employees because they offer more flexibility and choice. What's more, we can start with measures that prevent abuses like pension spiking. It's good to see that Hawaii's legislators are contemplating real and lasting pension reform. Grassroot is ready and willing to help by providing research and solutions that will benefit taxpayers, state workers, and our state's fiscal outlook. I'm Keena President of the Grassroot Institute. Until next time, Allah.