South African Post Office (SAPO) is making substantial investments in extending its current security focus to include its IT systems, with a sophisticated Digital Certification infrastructure being implemented which will provide the safety and confidentiality of electronic messaging and business transactions.
A substantial budget has been set aside for this project, which will see SAPO set up as its own Certificate Authority (CA), issuing Digital IDs to clients and business associates under the auspices of the South African Certification Agency (SACA).
Commenting on the rationale for the investment, Information Security Analyst George Tsafandakis says it comes in tandem with SAPO`s recent initiatives in electronic commerce, and its current upgrade to its third party payment systems:
"We are moving into areas of electronic business communications where proof of identity is vital," Tsafandakis explains.
"In the `real world`, physical contact with your business partners helps establish trust and accountability. In the `virtual world`, however, that direct contact is not always available and one needs a mechanism that will allow you to trust the origins and authenticity of any electronic communications you receive.
"The digital certification process provides that trust."
What it does, is help to establish proof of identity in cyberspace in much the same way as passports, identity books or drivers` licenses provide proof of identity in the physical world.
The digital certificates (or Digital IDs) rely on state-of-the-art Public Key cryptography to bind each users` identity to a pair of electronic keys that can be used to sign and encrypt digital information.
By binding a public key with its owner`s identity, the digital ID provides assurance that key holders are who they say they are, making it difficult to impersonate a legitimate key holder or to intercept or compromise in any way the integrity of their data transfers.
IT experts are now widely punting the technology as an effective means of ensuring truly private communications over what is, after all, an extremely open public network.
"We certainly regard it as an essential component of our electronic commerce and communications infrastructure," Tsafandakis agrees. "It is important to remember that security is a managed process, and digital certification technology helps to facilitate that process," he adds.
Possibly one of the most important applications for SAPO`s new digital certificates will be in its third party payment systems.
The Post Office currently collects money on behalf of third party clients at branch counters and transactions are consolidated centrally and downloaded electronically to clients.
Certain components of this electronic process are expensive and clients occasionally experience periods of system unavailability. By using digital certificates, SAPO will be able to provide an alternative means of file download using secure encrypted channels over the Internet.
"It is also already possible to book our Speed Services collections via the Internet and we would like to extend the certification service to regular users to give us the benefit of non-repudiation of collection requests," says Tsafandakis.
"Additionally, certification will permit secure e-mail communications between ourselves and our business partners, suppliers, colleagues and support organisations."
As a Local Registration Authority in its own domain, SAPO will be able to instruct SACA which of its business partners and clients may receive Post Office certificates: It gives the instruction to issue, and SACA `witnesses` the certificates as a reliable, independent third party.
"We chose SACA because of the exceptional level of security its digital solutions provide and because, as an internationally recognised CA, it is subject to international public scrutiny and is audited by the likes of VISA and MasterCard," says Tsafandakis.
"We did investigate alternatives as this is not an area in which you want to make mistakes. However, we believe that for our requirements we now have the best possible security solution in place.
"We also feel that, by implementing a system that is now incorporated as a standard feature on industry standard products like Internet Explorer and Netscape Navigator, we will reduce the total cost of using our proprietary equipment and also the line costs to subscribers, who will only have to pay for a local call to their Internet Service Provider.
"This is in line not only with SAPO`s commitment to better security, but also to improved customer services."
@EditorNote = SACA:
SACA has established a world class facility in South Africa for issuing and managing public digital ID services for organisations, individuals and software houses, and can provide specially tailored solutions where needed.
The company, is the exclusive Southern African licensee of VeriSign Inc., the leading provider of digital authentication products and services for Internet access and electronic commerce in the world.
SAPO Electronic Business Unit
The Electronic Business Unit forms part of the Post Office`s Technology Division. Amongst the projects that the unit drives is the Web Shop Courier and the Public Information Terminals (PiT`s, recently documented on SABC2).
The Web Shop Courier is an endeavour that allows customers to purchase items from a virtual store on the Internet and then have them delivered to their door. Speed Services Couriers is the delivery mechanism in this process. Web Shop Courier is a value added delivery service specifically made for the fulfilment of transactions conducted on the net and was designed by the Electronic Business Unit of the Post Office to enhance the delivery service provided by Speed Services Couriers (http://www.speedservices.co.za or http://www.sapo.co.za).
PiT`s are information kiosks that will stand in post offices and they will offer the public at large a fully integrated one-stop-shopping and information centre, as well as easy and direct access to a wide range of business and government institutions, Internet browsing and e-mail facilities. PiT`s will also offer on-line Post Office services such as Track-and Trace monitoring and postcode information. The PiT`s are currently being piloted in the Pretoria areas of Laudium, Lyttleton, Eersterust and Shoshanguwe.
Share