FW: [pki-lowercosts] Subcommittee Meeting scheduled for Thursday July 28 at noon PT

["Terwilliger, Ann" <aterwil@visa.com>]

A meeting to discuss the status of the survey -- hopefully I will have
status from the PKI Sc meeting on the previous day.....

Date/Time: 		JUL, 28 2005 at 12:00 PM America/Los_Angeles
Length:		60
Meeting ID:		3661
Phone Number:	877-847-2001 (USA & Canada) or 650-432-0111

--- Begin Message ---

• From: "Sabo, John T" <John.T.Sabo@ca.com>
• To: "Terwilliger, Ann" <aterwil@visa.com>,<PKI-SC@lists.oasis-open.org>
• Date: Wed, 29 Jun 2005 07:20:31 -0700

Ann,

I support the survey, but in reviewing this subject, I believe we would
get more value from the survey and more participation if we expanded the
survey to include - in some manner- benefits, or ROI, or some component
of value when assessing costs.  I think focusing on "free" or "lower
costs" out of context is not very interesting and doesn't address real
issues for companies or agencies.  On the other hand, costs (whether the
software, management overhead, maintenance, time and trouble for users)
may affect a decision on deployment of PKI versus some other form of
authentication and/or electronic signature.   Stephen addresses this to
some degree in his section on objectives:  "Of course, operating a
production PKI involves many costs other than software acquisition so an
effort will be undertaken to gather and disseminate best practices for
cost reduction in PKI deployments around the world" (emphasis added). 

For example, using PKI for digital signatures will require certain
investments and costs, but they would be considered acceptable where
benefits of digital signatures outweigh the costs of deploying PKI for
this purpose in a particular environment. So the "best practices"
component and providing a secure and trusted solution in the most cost
effective manner would seem to me a better than simply looking at cost
issues in the Question section.  

I may not be clearly communicating my suggestion, so I'd be happy to
discuss this in more detail. 

John

------------------------------------------------------------------
John T. Sabo, CISSP
Director, Security and Privacy Initiatives
Computer Associates International
2291 Wood Oak Drive
Herndon, Virginia, 20171
USA
Phone: +1 703-708-3037
Mobile: +1 443-629-6198
------------------------------------
This e-mail message is for the sole use of the intended recipient(s) and
may contain confidential and/or privileged information. Any unauthorized
review, use, disclosure or distribution is prohibited. If you are not
the intended recipient, please contact the sender by reply e-mail and
destroy all copies of the original message.



-----Original Message-----
From: Terwilliger, Ann [mailto:aterwil@visa.com] 
Sent: Tuesday, June 28, 2005 5:18 PM
To: PKI-SC@lists.oasis-open.org
Subject: [pki-sc] Oasis LowerCostsSC survey estimate

 <<Lockstep Oasis LowerCostsSC survey estimate (0.1).doc>> I
<<LowerCosts Survey Estimate (0.1).xls>> am attaching a cost estimate
for a Lower Costs survey for you consideration and (hopefully)
approvalat the July 2005 steering committee meeting.  This estimate was
provided by Stephen Wilson and appears to be reasonable based upon my
prior experience with engaging consultants for this kind of work.  The
work would be carried out over the next 6 - 12 months (depending upon
the timing of the conferences most likely to yield good interview
subjects).

In addition to retaining Stephen Wilson for the survey, I would also
like to pursue using OASIS resources to help us publicize/promote the
survey on the OASIS website, etc.

I will try to be available during the steering committee meeting time in
July in case you have questions or comments on the submitted material,
but it may be somewhat problematic since I will be attending a
conference in San Diego on that day (July 13).  Let me know the time and
call-in information if you wish me to be available and I will do my
best.  Thank you.    
 

--- End Message ---