IPMA News -- May 2001

Edited By Bob Monn and Shelagh Taylor

Technology Careers for Dislocated Workers

DSHS Implements Tumbleweed e-Mail Encryption

Other News | April 5-6, 2001 IPMA Board Annual Planning Meeting


Technology Careers for Dislocated Workers

--by Shelagh Taylor, Information Services Director, Department of Labor and Industries

Bates Technical College in Tacoma is in its final year of a program funded by a U.S. Department of Labor grant to develop model programs to train dislocated workers for jobs in computer occupations. The program was initially funded for two years to train and place dislocated workers into three facets of the computer industry: programming, PC maintenance, and network hardware and software support. Last July, Bates was one of three programs to receive a grant to fund a third year extension. The grant money is used to train dislocated workers in such areas as Visual Basic and JAVA programming, PC maintenance and network support with certifications in A+, N+, MCP (2000), and CCNA options, and web and internet certifications.

The U.S. Department of Labor is looking for model programs to help fill the skills gap of our current job market," said project manager Lori Banaszak. "Bates has always tried to listen to employers’ needs and quickly start training programs to get workers into those new jobs. Years ago those jobs were heavy industry and manufacturing. Today, we need workers in computer fields, with specialties in programming, web site and application development, networking and PC maintenance and support."

As the program enters its final phase, the emphasis is now on finding internships and/or placements as the dislocated workers complete their training requirements. If you are interested in sponsoring an internship or in discussing a placement opportunity, please contact Karla Lenfesty, the project coordinator at klenfesty@bates.ctc.edu.

Return to Top


DSHS Implements Tumbleweed e-Mail Encryption

--by Lynda Vintilo and Scott Ayers, Information Technical Specialists, Information Systems Services Division, Department of Social and Health Services

More than 10,000 Department of Social and Health Services (DSHS) messages per day pass over the Internet generated by any of 18,000 staff in nearly 300 offices across the State of Washington. DSHS staff often send data, files, and/or confidential information to business partners, subcontractors, and clients as a daily, routine part of business.

Business today is fully engulfed in the world of digital communication, E-business, and of course, E-mail. E-mail is quick, inexpensive, and easy to use; so much so that it is challenging the telephone as the primary means of business communication. With E-mail’s popularity, comes new business challenges, especially around security and confidentiality of documents transported over the Internet, beyond the reach of corporate firewalls.

The discussion around security of these sensitive documents has long since been on the table; many have searched for solutions to meet new and pending agency guidelines, laws, and our own Governor’s Executive Order to secure these important documents.

DSHS’s solution was to purchase and implement Tumbleweed’s Integrated Messaging Exchange (IME) and Messaging Management System (MMS). The product also offers digital signatures and virus scanning features along with message encryption.

The 1999 Computer Security Association’s Virus Prevalence Report reports viruses have increased 200 percent in each of the past four years, with no downtrend on the horizon.

Tumbleweed was chosen by DSHS for its low start-up and maintenance cost, ease of management, as well as no impact to email performance.  There is no software required at the user’s desktop, no training is needed for the user, and management will be performed by the Enterprise Email Team centrally with existing staff. All that is required for use, is an E-Mail address and a standard web browser.

The process of a typical e-mail message:

  1. A user sends an email message. Messages destined for recipients outside of the customer site are converted to SMTP format for transmission via the Internet. MMS routinely scans all such messages and enforces customer-defined security policies.

  2. If the message fails to meet any of the predefined policy criteria requiring it to be redirected, it is routed to the recipient via SMTP as normal (unless other policies dictate special handling).

  3. If the message triggers a redirection policy, the message is converted into an IME Package and submitted to the IME server.

  4. Optionally, MMS returns a package description to notify the sender of the redirection. This message includes the IME package ID, service options, and access information for the sender’s IME account.

  5. The IME server sends an SMTP message notifying the recipient(s) of the IME package, including a URL via which the package may be retrieved.

  6. The recipient retrieves the package using a Web browser. For additional security, the recipient may be required to authenticate with the IME server and use a secure (SSL) connection in order to retrieve the package.

  7. The IME server optionally generates receipt confirmation messages to notify the sender when each recipient retrieves the package.

A key advantage of this architecture is that deployment of the IME service can be made essentially invisible to end users within a customer site, without changing existing end-user behavior.

Security and Recipient Authentication

One of the key features of the IME service is security—its ability to ensure that only the intended recipient can read a document. This is typically accomplished by requiring recipients to authenticate themselves, using a password, before the document can be retrieved. In addition, senders might specify that a document must be stored in encrypted format and require the use of a secure link (SSL) for download. This prevents the document from being visible to an administrator at the IME server or from being intercepted during the retrieval operation.

When redirecting an email message from MMS to IME, there are three basic models for package security. These models correspond to the options that are available when submitting packages via the Web-based IME client interface.

  1. Standard Security – no passwords, data encrypted on the server, secure link required. In this model, anyone with knowledge of the existence of the package (and its URL) may retrieve it without further authentication.  This method is not as secure as the models that require a password, but it still offers the ability for the sender to track a package and request confirmation when each recipient receives it. Only the URL of the package is transmitted via email.  The secure link requirement ensures that the package contents are never directly visible at intermediate nodes on the Internet.

  2. Package-Based Security – password required, data encrypted on the server, secure link required. In this model, a password is required to retrieve the package. Each recipient must know the password, either by prior agreement or by some out-of-band communication mechanism. There are two ways that the package password can be specified for email messages redirected by MMS.
  3. Account-Based Security – IME account login required, data encrypted on the server, secure link required. In this model, the package is stored so that only someone with the ability to log into the IME server using that recipient’s account can retrieve it. This approach relies on recipients automatically authenticated when they log in. The recipient does not need to specify any additional password to retrieve the package.

If account-based security is desired, MMS provides three alternatives to handle the situation when a recipient does not have an existing account on the IME server.

Auto-Enrollment of Recipients

Auto-enrollment provides a way to create IME accounts, on the fly, for recipients of a package who are not currently IME account holders. The IME account type for accounts created by auto-enrollment (enrollee account type) is configured on the IME server. Any IME account type is allowed including single use, billable, or free accounts. The initial temporary password and hint phrase for the enrollee accounts are specified in the package profile.

The URL in the package notification will take the enrollee to an IME account login page that will present the hint phrase and prompt for the temporary password. After successful log in, the enrollee will be presented with a one-time validation page to enter the following information: first name, last name, new password, and new hint phrase. After entering this information the new IME account will be active. The enrollee can then retrieve the package and begin using the account.

The Tumbleweed product is viewed as a mature and proven solution by industry experts. Companies currently using Tumbleweed include:  American Express, Chase Manhattan Bank, Chevron, Datek Online, Food and Drug Administration, Dept. of Energy, Dept. of Defense (the Army), John Deere, Merrill Lynch, Nike, Salomon Smith Barney, Pitney Bowes, Travelers Property Casualty, The Regency Group (BlueShield, BlueCross, etc. more than 3 million subscribers), United Parcel Service, and seven of the world’s largest postal services. Tumbleweed’s IME meets the Securities Exchange Commission's guidelines for delivery of electronic trade confirmations.

Tumbleweed Communications is headquartered in Redwood City, California, and was founded in 1993.

Return to Top


Other News

--Compiled by Bob Monn

Governor Locke Signs Electronic Forgery Bill

On April 23 DIS published a story on the enactment of a new state law establishing a class C felony for the fraudulent use of digital signatures or certificates. See the complete story (Link no longer available).

Return to Top


April 5-6, 2001 IPMA Board Annual Planning Meeting

The meeting began at about 1:30 p.m. Thursday, April 5. Board members present were Jim Albert, Mary Ellen Bradley, Thomas Bynum, Phil Grigg, Sheryl Hall, Dennis Jones, Dennis Laine, Bob Monn, Darrel Riffe, Doug Tanabe and Shelagh Taylor. Phil Coates was there as Chief Financial Officer.

Review IPMA Mission, Goals, and By-Laws

Review IPMA Mission and Goals

No Changes.

Review IPMA by-laws and discuss any changes to the by-laws

Article VI: Section 4. - change the words "using a mail-in ballot" to "using a ballot". There was some discussion regarding changes to Article V which states "when membership fees are paid" but it was decided to leave it alone since dues are set by the board and it has set them to $0.

Revew Committee Structure and Key Responsibilities

Each board officer and committee chair described their key responsibilities.

Board Chair:

Board Vice Chair:

Secretary/Treasurer:

Forum Chair:

Communications Chair:

Executive Seminar Chair:

Professional Development Chair:

Election of Board Officers

Mary Ellen Bradley, Chair
Doug Tanabe, Vice Chair
Thomas Bynum and Jim Albert, Secretary/Treasurer

Committee Assignments

Forum Co-Chairs, Dennis Laine and Mike McVicker
Communications Co-Chairs, Bob Monn and Shelagh Taylor
Executive Seminar Co-Chairs, Darrel Riffe and Phil Grigg
Professional Development Co-Chairs, Dennis Jones and Sheryl Hall

Business Planning:

Tax exempt status update- Mary Ellen reported that the application to the IRS for designation as a tax exempt entity was approved March 16, 2001, and is retroactive to May 1989. We have yet to determine what impact this may have on the organization's B&O tax liability.

Review financial status and future "gifting" commitments - Mary Ellen Bradley reported that we had pledged $25,000 each to South Puget Sound Community College and St. Martin’s College in 1998 payable in increments of $5,000 per year to each organization. These pledges will be satisfied in 2002. The board agreed that this is a logical function for the IPMA to pursue when this commitment is satisfied. Other organizations in the area that would be likely beneficiaries would be Evergreen State College and the New Market Skills Center.

Changes to the Annual Report - The CFO will add notes to the financial page of the annual report that identify how the apparent $19,000 profit for the year 2000 is earmarked for commitments in 2001, such as the pledges to SPSCC and St. Martin’s.

Review/adjust investment strategy - The board decided to stay the course with the investments at the present time. Jim Albert will touch base with Keith Cameron, the Merrill Lynch representative handling the IPMA account to see what recommendations he might have. Any suggestions he might offer will be brought before the board at the regular May meeting for further consideration.

Outsourcing opportunities - There was a discussion of the possibility of outsourcing more Corporate Sponsor liaison responsibilities, but it was determined that this function should remain with a member of the board. Additional outsourcing in support of marketing newly developed Professional Development activities was also considered. It was felt that expanded use of the IPMA listserv would provide a new level of marketing that was not available when past offerings were presented. It was determined that the subject may be revisited after the new Professional Development committee has put together their plans for the year.

2001 Forum:

Review plans - Jim Albert reported that only eight vendor booths are left to be sold. That is well ahead of past years. The issue of identifying keynote speakers has now been resolved. Sixteen of eighteen breakout sessions have been determined.

Executive Seminar:

Review plans - Phil Grigg reported that the theme for the 2001 seminar will be "Networking for Success" and the plans are falling into place. The target is for about 65 attendees from state government and 23 Corporate Sponsors. The registration fee will be $595. The budget for the 2001 event is $61,000.

Discuss and resolve any issues - The 2002 Executive Seminar will be held at the Ocean Shores Shilo if logistics can be worked out. At next year’s Corporate Sponsor’s lunch the possibility of an increase in the Corporate Sponsorship fee should be raised. The ongoing issue of getting quality speakers was discussed but short of increasing the fees significantly, high quality purchased speakers are not an option. The committee was directed to work with the resources at their disposal to get the best quality speakers possible.

Communications:

Review Internet web-site development - Bob Monn reported that the web site usage is running between 30 and 85 unique visitors per day. That number peaks around IPMA events. The low has been between 20 and 40 visitors and the high has been between 350 and 675 before Forum 2000. The listserv had 202 subscribers as of March 31, 2001. The primary use of the listserv has been the distribution of the monthly newsletter. Regarding membership, as of March 31, 2001, there were 232 members with 26 new members signing up over the past six months.

Discuss communications challenges/opportunities - Bob also reported that the ongoing challenge for the Communications committee has been to get good articles for the newsletter. Dennis Jones pointed out that Bob is the only board member who knows anything about the "care and feeding" of the IPMA web site and the process of developing a backup needs to be considered.

There was a discussion of how the Communications Committee could support the other committees. The Forum, Executive Seminar and Professional Development committees all expressed a desire for assistance.

Professional Development:

How do we re-invigorate this committee? - There was a wide-ranging discussion that resulted in the following guidelines for the new committee:

Treasurer’s Report

Doug Tanabe presented the financial reports for the months of February and March. The board approved the reports as submitted.

The 2001 annual planning meeting was adjourned April 6 at 1:05 p.m.

Return to Top


IPMA, P.O. Box 1943, Olympia, WA 98507-1943