RE: [pki-lowercosts] Action items

["Skyberg, David" <dskyberg@rsasecurity.com>]

The purpose of this SC is to explore ways to lower costs.  With that,
here's the text of the action item from our implantation plan:
---
Encourage the software development community (including the open source
community) to provide options for organizations to conduct small pilots
and tests of PKI functionality at reasonable costs-in effect reducing
cost as a barrier to the use of PKI. Of course, operating a production
PKI involves many costs other than software acquisition so an effort
will be undertaken to gather and disseminate best practices for cost
reduction in PKI deployments around the world.
---

This survey is merely a tool to begin this action.  The real work of the
sc starts when we have those results.  Once completed, the analysis of
the survey should begin to uncover ways in which PKI cost might be
positively impacted.  The next function of the sc is to draft proposals
to do so and communicate those proposals back to the original
respondants of the survey that led to the PKI Action Plan, and
coordinate responses back from the respondants.  This should all lead,
eventually, to our recommending cost reduction measures to the industry.

Given that, is our proposal for a contractor short sighted?  Should we
consider extending the items to cover some of the above things?

=david

> -----Original Message-----
> From: Steve Hanna [mailto:shanna@funk.com]
> Sent: Friday, August 06, 2004 12:49 PM
> To: Terwilliger, Ann
> Cc: Skyberg, David; PKI Lower Costs
> Subject: Re: [pki-lowercosts] Action items
> 
> Ann,
> 
> Good question. Here are several reasons I think
> we want to understand the cost model better:
> 
> 1) To inform deployers what to expect. However,
>     I don't think this is a very good reason,
>     since the costs of deploying PKI have been
>     changing fast and probably will continue
>     to do so. This suggests we should ask on the
>     survey *when* someone deployed PKI (as well
>     as what parts of the deployment were outsourced).
> 
> 2) To understand which areas we (the Lower Costs SC)
>     should focus on in trying to reduce costs.
>     After all, that's our SC's charter.
> 
> 3) Maybe to identify certain organizations that have
>     found ways to "beat the odds", keeping certain
>     costs lower than average. Ask them how.
> 
> Those are my ideas, anyway. Actually, I guess they're
> also yours (at least, 1 and 2) since you cited them.
> But I agree. I'd like to hear from others. And I agree
> this is an important question.
> 
> Thanks,
> 
> Steve
> 
> Terwilliger, Ann wrote:
> 
> >
> >
------------------------------------------------------------------------
> >
> > David,
> > It looks good.
> >
> > Something to consider is what do we plan to do with this model?  Do
we
> > plan to publish it (suitably sanitized) to make current or
prospective
> > PKI implementers aware of the things that must be accounted for in a
PKI
> > (policies, support staffing, maintenance, etc.) and associated
potential
> > costs?  Are we trying to identify areas where we might be able to
> > provide some sort of guidance, etc. to enable PKI implementers to do
> > some functions in a more cost-effective manner?  Or if there
something
> > else that we have in mind?  The answers to these questions might
help us
> > know what kind of guidance to give to the consultants developing the
> > survey (as in how to structure the questions).
> >
> > my two cents.....
> >
> >  -----Original Message-----
> > From: Skyberg, David [mailto:dskyberg@rsasecurity.com]
> > Sent: Friday, August 06, 2004 9:51 AM
> > To: PKI Lower Costs
> > Subject: [pki-lowercosts] Action items
> >
> >
> >
> > Hi all,
> >
> > Here's the first cut at the action items for the contractor.  Feel
free
> > to comment prolifically. :-)
> >
> >
> >
> > The current action item of the sub committee is to develop a cost
model
> > for PKI.  The principal mechanism to accomplish this is a survey
which
> > will be administered within the TC first and then taken to a larger
> > audience outside of OASIS.  Following a list of activities to be
> > contracted out in support of this effort:
> >
> > *        Draft the survey
> >
> > Work with the sub committee members to draft a survey.  The sub
> > committee will approve the survey before the survey is conducted.
> >
> > *        Survey Phase 1
> >
> > TC members will be the target of the first phase.  The contractor
will
> > conduct the survey with all willing TC members.
> >
> > *        Phase 1 analysis
> >
> > The contractor will provide analysis of the survey results and
> > coordinate feedback from the TC on the survey itself.
> >
> > *        Refine the Survey
> >
> > The contractor will edit and refine the survey based on the feedback
> > from the TC, the analysis of the phase 1 results, and guidance from
the
> > sub committee.
> >
> > *        Identify second phase targets
> >
> > The contractor will coordinate input from the TC as to likely
candidates
> > for the second phase survey.  The subcommittee will approve the
final
> list.
> >
> > *        Survey Phase 2
> >
> > The contractor will conduct the survey with the
> >
> > *        Report analysis of results
> >
> > The contractor will report analysis of the results to the sub
committee
> > in a format suitable for reporting to the TC.
> >
> >
> >