CyberTrust builds PKI solutions package

GTE CyberTrust this week announced its Secure Extranets solution for agencies that are beginning to move past the pilot stage in bringing critical services securely to the Internet.

Agencies over the past few years have been moving their services to the World Wide Web in response to legislation and regulation from Congress and the Office of Management and Budget. But many government services include private and sensitive information, and handling this information requires a high level of security to authenticate it and protect the transaction.

So several agencies have been conducting public-key infrastructure pilots as a method for conducting business over the Internet. PKI solutions use digital signature, certificate and encryption technologies to authenticate a user's identity and to ensure that data is not tampered with during transmission.

The Secure Extranets solution brings together all the products and services from CyberTrust and its partners that are needed to ensure secure transactions between agencies and their external constituents. Through those integrated solutions, CyberTrust plans to help agencies move into the implementation phase, said Paul Paget, vice president of marketing for the company.

Now that work on the Year 2000 computer problem is winding down, agencies' focus and funding are shifting toward how to securely deliver services to citizens via the Web, said Patricia Edfors, director of government operations for CyberTrust.

"A lot of agencies have said that when Y2K is done, this is what they are going to focus on," she said.

"The real goal of this is to take PKI beyond pilots," Paget said. "We feel it is time to step up to the plate and lead that."

Building on products and services - including certificate authority, certificate validation, access control, and directory and firewall solutions - from CyberTrust and its partners, the company will create solutions that best fit an agency's needs. The products have been tested together so that agencies know the products will work in an integrated fashion, Paget said.

A big part of the solution will involve helping agencies figure out what they need, Edfors said. "[Agencies] all know that they have to get there, but they don't know how," Edfors said. CyberTrust's professional services group and consulting partners such as Booz-Allen & Hamilton Inc. and Science Applications International Corp. will assist agencies with services, including needs assessment, policy and procedure design, and implementation.

"It's really not a matter of technology. It's how you use technology...to meet your business needs," she said.

By putting together the pieces from its own security offerings and those of its partners, CyberTrust can offer a solution that can fit the information technology architecture in place at an agency, Edfors said.

An agency also can make the initial decision to control the security system completely itself or to rely on CyberTrust to host the service. That arrangement can change to mirror the agency's evolving needs.

This flexibility and end-to-end set of offerings for the particular area of security the company has chosen to focus on - secure transactions with known individuals over an extranet - are key, analysts said. "They're not just out there saying 'We can provide this,' they are out there saying 'We can provide a complete solution,' " said Eric Hemmendinger, senior information security analyst at Aberdeen Group, Boston.

No single vendor can say it has every security technology or service needed, so CyberTrust's main advantage is to position itself as almost an integrator, Hemmendinger said. "The question is, even if you don't originate all the technology, can you be a single point of contact for putting it all together? The answer for GTE is yes," he said.