federalcto.com The Blog of a Federal CTO


Breach Directory Doc – First draft

I just posted an incomplete, and rough document here:

Going forward, this link will always have the latest, published version of the doc. For more information about the overall project, have a look here:

Filed under: Uncategorized No Comments

Your Directory Has Been Breached – landing page


(2012-05-30 - 13:00 ET)
First up, here is Bob's initial post on the topic:

(2012-05-30 - 16:15 ET)

(2012-06-05 - 18:00 ET)



Think there’s no cold war?



Meant to mention




US Government Smartcards; CAC, PIV and PIV-I

Recently, I had the pleasure of trying to get some government certified smart cards for some of the technical people at Quest, and I can't believe how much of a headache and hassle it was. I actually don't work for Quest Software, but a subsidiary (Quest Software Public Sector) which is focused on the public sector space. And while most Quest employees don't have a need for government-issued or government approved smart cards, our company does. And while I knew that non-government employees can get a relatively new (a little over a year old) flavor of the PIV card called PIV-I, I was amazed at how difficult the process was to navigate. Thankfully, we have some pretty good and persistent purchasing folks, but the process is still pretty arduous for an organization that has been working with the government for years.

I won't get into all the details, but if you're interested, feel free to contact me offline.

In any case, I find myself constantly having to explain what the different is between a smart card, a CAC, a PIV card, and now a PIV-I card. A smart card is pretty straight forward - it's a generic term, and all the other cards fall into this category. You can find a lot more details on them here at Wikipedia. In any case, the thing that makes a smart card a CAC (which means Common Access Card, so please don't say, "CAC Card" as it is redundant) is that it is used by the US DoD (Department of Defense). If you want to do any work on government systems in the military, you will most likely need one of these.

Like their military counterparts, employees within civilian agencies also need smart cards. Of course, they opted for a similar, but not the same, standard. That standard is a PIV card (Personal Identification Verification). The cards are slightly different from CACs, and have varying information printed on them, depending on the issuing agency. Plus, they use a different set of CA (Certificate Authority) servers than the ones that CACs use, as the DoD have their own servers.

Finally, and this is the confusing thing, there are PIV-I cards. PIV-I stands for PIV-Interoperable. There are some great docs about PIV and PIV-I at www.idmanagment.gov which is a site run by GSA but I'll save you the trouble of wadding through a lot of documentation. The PIV-I FAQ here states:

2.2    What is the difference between a PIV-I Card and a PIV Card?
The term “PIV Card” may only be used to describe an identity card that is fully conformant with Federal PIV standards (i.e., FIPS 201 and related documentation). Only a Federal entity is capable of fully meeting these standards and issuing a PIV Card. A PIV-I Card meets the PIV technical specifications of NIST SP 800-73 and is issued in a manner that may be trusted by Federal Government Relying Parties, but does not meet all of the requirements of FIPS 201.

What does this mean? A Federal entity (aka employee) uses a PIV card, and a trusted, non-government entity has to use a PIV-I card.

So there you go. In summary:

  • CAC is for Department of Defense users
  • PIV is for civilian users working for the Federal government
  • PIV-I is for non-Federal entities that need to access government systems






  1. A card is inserted into the reader
  4. The user enters the PIN tied to the card
  7. The user is allowed to log in





sudo /opt/quest/bin/vastool smartcard configure \

sudo /opt/quest/bin/vastool smartcard test \

sudo /opt/quest/bin/vastool smartcard configure macos









require-smartcard = true








Here is the chat session:

Graeme: Welcome to Gogo. My name is Graeme.
Graeme: Hi, Dmitry!
Dmitry Kagansky: hi
Dmitry Kagansky: please cancel the monthly charge
Dmitry Kagansky: you could point that out in your FAQ
Dmitry Kagansky: this is a real nuisance
Dmitry Kagansky: or chat with one of you guys every time
Dmitry Kagansky: that's just lovely
Graeme: What other questions can I answer for you?
Dmitry Kagansky: no others
Dmitry Kagansky: thank you
Graeme: Thank you for choosing Gogo. Fly classy.
Graeme has disconnected.



VDI – nothing like watching the lightbulb go on!

I was a conference for a Federal agency this week, and had a fantastic experience with a (prospective) customer. We were talking about this and that, but the conversation worked it's way around to mobile computing. And while agencies are announcing "mobile initiatives" left and right, the reality is that everyone is still really concerned about what BYOD (Bring Your Own Device) means.

My friend, Joe Baguley, has been going on about "the consumerisation of IT" for a while (and he's English, so it's an "s" and not a "z" in consumerisation) as have others, but the Feds work differently. It's not purely about savings, and things are a bit more measured. And that's one of the reasons that the Blackberry continues to hold on, and the iPad has made no movement yet. When the OS cannot be locked down through a central server, and policies cannot be set on applications and data, the device has a slim chance of making it in the Federal space.

But Quest have an interesting solution to the problem; one that took 5 minutes to demonstrate, and turn on the lightbulb for a senior-level manager at this agency. It was vWorkspace. He had his iPad with him (running a beta of iOS 5, in fact - good to know it looks like it works there, too!), and we started talking about how he can control data and access. Thankfully, I had a demo account on a set of servers that a colleague had up  and running (Rob Mallicoat - many thanks!), and he had a network connection on the iPad. Within 5 minutes, I was able to download the vWorkspace iPad app, configure the settings, and voila! I was showing him Visio running on an iPad in no time.

And the thing is, I tell people about it time and again, but until you actually see it working, you don't realize how cool it is. Even the sales guy in the booth lit up when he saw how easy it was, and what it did. That got this manager interested, and proved one of the core problems with VDI; users need to touch it and see it for themselves. It's not enough to give them docs and white papers, and even web demos don't cut it.

But that's not enough; what's unique is how Quest does it. We don't care if you have some apps and desktops on VMware, and others on Hyper-V. You could even be running Terminal Services! We combine all of that, and give you a single interface. As a user, you don't know (and shouldn't care) how an app or a desktop is delivered. We even have a slick, "local VDI" option, thanks to MokaFive.

That's what got the manager really excited - he realized he didn't have to be tied to a single VDI option or vendor, and he can even provide multiple environments all through 1 app, delivered to his users' desktops. Plus, add the fact that it can all be remote means he could even give out iPads, but keep all the data in his data centers.

So if you have an iPad or Android device, ping a Quest person, and see if they can get you access to a demo system. Or ping me if you're with a Federal agency. Because this is something you simply need to try, and not just watch or read about.





You are now chatting with NFL Game Pass

NFL Game Pass: Hello, how may I help you?
Dmitry Kagansky: xxxxxxxxxx
Dmitry Kagansky: ok - then 2 questions
Dmitry Kagansky: you, or one of your colleagues
Dmitry Kagansky: terrific - when will the manager contact me
Dmitry Kagansky: who will contact me?
Dmitry Kagansky: how will I be contacted?
Dmitry Kagansky: and by whom?
NFL Game Pass: The first contact is typically via email.
Dmitry Kagansky: fantastic
Dmitry Kagansky: now, i didn't get contacted last time
Dmitry Kagansky: or ms anonymous employee
Dmitry Kagansky: i look forward to the email
Dmitry Kagansky: cheers







You are now chatting with NFL Audio Pass

NFL Audio Pass: Hello, how may we help you?
NFL Audio Pass: can we have your user name
Dmitry Kagansky: Please cancel this subscription.
NFL Audio Pass: can we have your user name please
Dmitry Kagansky: xxxxxxxx
Dmitry Kagansky: or yyyyyyyy
NFL Audio Pass: one moment
Dmitry Kagansky: and I moved back in sept of 2009
Dmitry Kagansky: you should not have charged it
NFL Audio Pass: it expired on 5/2010
Dmitry Kagansky: right
NFL Audio Pass: Ufortunately i do not have that information
Dmitry Kagansky: exactly
Dmitry Kagansky: as it was unauthorized
Dmitry Kagansky: last i checked, may came before august
Dmitry Kagansky: please do
Dmitry Kagansky: you have it
Dmitry Kagansky: xxxxxxxx@gmail.com
Dmitry Kagansky: what is your contact information?
Dmitry Kagansky: and the reference or case number?
Dmitry Kagansky: what is the reference or case number, please
NFL Audio Pass: one moment please
NFL Audio Pass: Your account will be noted also
NFL Audio Pass: Thank you for contacting NFL support

NFL Audio Pass has left the chat conversation
Click Here to Leave a Message

