OWASP - User contributions [en]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-12-04T16:48:29Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** In a Mobile Context, Public Safety
** What role does Uncertainty play? The GUM?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-12-04T16:46:02Z

AnnElizabeth Racuya-Robbins: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** In a Mobile Context, Public Safety
** What role does Uncertainty play? The GUM?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-12-04T16:44:38Z

AnnElizabeth Racuya-Robbins:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** In a Mobile Context, Public Safety
** What role does Uncertainty play? The GUM?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-12-04T16:43:06Z

AnnElizabeth Racuya-Robbins: /* Project Leaders */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** In a Mobile Context, Public Safety
** What role does Uncertainty play? The GUM?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-08-31T15:01:39Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** In a Mobile Context, Public Safety
** What role does Uncertainty play? The GUM?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-08-31T14:59:17Z

AnnElizabeth Racuya-Robbins: /* Monday August 3, 2015 at 11:00 AM - 12:30 PM US Eastern Time */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 31, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-08-02T23:17:47Z

AnnElizabeth Racuya-Robbins: /* AGENDA */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 3, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** KBA Performance Metrics v7 Luis
** Followup on Remote First Use KBA. Is this wanted and needed?
** Follow on Questions for Healthcare Providers who use KBA
** How do we make individuals or entities take risks? Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-27T17:48:32Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday August 3, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions and Processes Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-24T15:14:27Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 27, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions and Processes Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-19T20:45:55Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 20, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions and Processes Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-07T21:16:45Z

AnnElizabeth Racuya-Robbins: /* AGENDA */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 13, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions and Processes Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-07T21:15:30Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 13, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions for Conversation with Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-05T21:24:26Z

AnnElizabeth Racuya-Robbins: /* AGENDA */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 6 29, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Questions for Conversation with Healthcare Providers who use KBA)
** Ways Forward for KBA-PMP
** Its time to ask for resources to support our project. Lets discuss.
** KBA-PMP Data Collection if ready.

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-07-05T19:43:06Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday July 6 29, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-22T17:09:56Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 29, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-08T15:00:16Z

AnnElizabeth Racuya-Robbins: /* http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.



=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 15, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-07T14:29:03Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 15, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:28:34Z

AnnElizabeth Racuya-Robbins: /* Related Projects */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:27:32Z

AnnElizabeth Racuya-Robbins: /* Related Projects */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet]]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:25:37Z

AnnElizabeth Racuya-Robbins: /* Related Projects */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:23:34Z

AnnElizabeth Racuya-Robbins: /* Related Projects */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


ASVS

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:22:32Z

AnnElizabeth Racuya-Robbins:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-06-02T15:19:28Z

AnnElizabeth Racuya-Robbins:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:43:15Z

AnnElizabeth Racuya-Robbins: /* http://www.kba-pmp.org/dir /Visit Our Website kba-pmp.org */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir Visit Our Website KBA-PMP.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:41:45Z

AnnElizabeth Racuya-Robbins: /* Visit Our Website */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''[[http://www.kba-pmp.org/dir /Visit Our Website kba-pmp.org]]'''==

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:37:49Z

AnnElizabeth Racuya-Robbins: /* Visit Our Website */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Visit Our Website'''==
[http://kba-pmp.org/dir]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:37:12Z

AnnElizabeth Racuya-Robbins: /* Our Website */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Visit Our Website'''==
[http://kba-pmp.org]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:35:04Z

AnnElizabeth Racuya-Robbins: /* Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:33:25Z

AnnElizabeth Racuya-Robbins: /* Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:27:40Z

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:22:15Z

AnnElizabeth Racuya-Robbins: /* News */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, the Netherlands. ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:18:16Z

AnnElizabeth Racuya-Robbins: /* May 21, 2015 */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, the Netherlands. ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:14:50Z

AnnElizabeth Racuya-Robbins: /* Talks */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features to KBA Performance Metrics. ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:14:13Z

AnnElizabeth Racuya-Robbins: /* News */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T19:08:01Z

AnnElizabeth Racuya-Robbins: /* News */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19- 20, 2015 Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, The Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:56:35Z

AnnElizabeth Racuya-Robbins: /* News */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =
Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit at https://2015.appsec.eu/conference-program/ KBA-PMP

= Talks =

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:49:16Z

AnnElizabeth Racuya-Robbins:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:43:19Z

AnnElizabeth Racuya-Robbins: /* AGENDA */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome and Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** KBA-PMP Standard Structure #3 - All

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)

*'''Ongoing:'''
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:40:23Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community

** ''If time allows''
*** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues

** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>

== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:35:46Z

AnnElizabeth Racuya-Robbins: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:33:18Z

AnnElizabeth Racuya-Robbins: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:31:19Z

AnnElizabeth Racuya-Robbins: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:27:43Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday June 1, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-28T18:26:32Z

AnnElizabeth Racuya-Robbins: KBA-PMP News

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday May 25, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

= Talks =

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-04T20:19:21Z

AnnElizabeth Racuya-Robbins: /* Our Next Meeting */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday May 25, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-05-02T18:03:00Z

AnnElizabeth Racuya-Robbins: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday May 4, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** OWASP KBA Structure - Pilots KBA request All
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-04-29T20:19:14Z

AnnElizabeth Racuya-Robbins: /* P */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday April 27, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** Harmonizing the name of our work KBA-PMP or KBA-PM and Infrastructure Update
*** Framework and Structure ALL
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2
*** Perspectives and Filters ALL

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-04-29T20:18:26Z

AnnElizabeth Racuya-Robbins: /* S */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday April 27, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** Harmonizing the name of our work KBA-PMP or KBA-PM and Infrastructure Update
*** Framework and Structure ALL
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2
*** Perspectives and Filters ALL

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-04-29T20:12:08Z

AnnElizabeth Racuya-Robbins: /* KBA-PMP Best Practices */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA-PMP Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday April 27, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** Harmonizing the name of our work KBA-PMP or KBA-PM and Infrastructure Update
*** Framework and Structure ALL
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2
*** Perspectives and Filters ALL

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-04-29T19:40:03Z

AnnElizabeth Racuya-Robbins: /* KBA-PMP Project Metrics */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''Collaborate'''==
[[http://kba-pmp.org/dir/ Collaborate]]

=='''KBA Best Practices'''==







====KBA-PMP Project Supports the NSTIC Guiding Principles ====
KBA-PMP Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBA-PMP Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager Scrum Leader ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday April 27, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====
All Meetings are Open and All are Welcome

* Welcome
** Introductions
** Discussion on: (We can decide/confirm the order of discussion at the top of meeting)
*** Harmonizing the name of our work KBA-PMP or KBA-PM and Infrastructure Update
*** Framework and Structure ALL
**** Integrating where appropriate OWASP ASVS and SAMM and engaging the larger OWASP community
*** NIST SP 800-63-2
*** Perspectives and Filters ALL

** ''If time allows''
**** Identity Proofing Contextual Article/NIST SP 800-63-2 Eauthentication
**** New approaches to KBA metrics
**** Feedback from US National Science Foundation's (NSF) Bahvani (from NIST Big Data Public Working Group - NBDPWG) on challenges to Multi-Factor Authentication (MFA)
****Update on Project Infrastructure

*'''Ongoing:'''
* International Participants
* Outreach to KBA Providers and other Stakeholders Continues
* Application to Conference in Amsterdam Update
** https://2015.appsec.eu/call-for-papers/
** https://2015.appsec.eu/call-for-research/
** Distributing Recorded Meetings?

*Next Steps: Tasks
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

Ann Racuya-Robbins Project Co-Leader

Luis Enriquez Project Co-Leader

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]