USAA was in the process of replacing their core Policy Administration System (PAS), had selected a prime contractor, and were anticipating a very large and lengthy development effort ($60M over 3 years). Lightship was the only consultant invited to participate in a Red Team review of the project prior to the green light for full-scale development. The Red Team was responsible for reviewing the overall requirements and high-level design. Due to the size of the project, the other Red Team members did not have the time to review the documents prior to the review meeting.

On behalf of the Red Team, Lightship provided a detailed review of all requirements and design documents and project plans. Lightship's approach was to:

• Review the technology requirements, in the form of Use Cases, for completeness against the current Policy Administration system, and several new business requirements.



• Ensure that the object models were compliant with IBM's Insurance Application Architecture (IAA). Product Agility (i.e., the ability of the PAS to rapidly administer new insurance products) was evaluated.



• Use Project Management Institute guidelines to evaluate the quality and completeness of the project plans.

Significant findings included:

• The level of detail of the Use Cases varied significantly. The prime contractor was instructed by the Red Team to provide more depth for several Use Cases.



• The object models did not conform to IAA. The prime was instructed to revise all designs to their models to become compliant.



• Many of the Project Plans were simply copies of other plans and did not address all PMI project plan components. The prime was instructed to provide complete plans specific to the project.

Guardian's agent community required a browser-based account management application. One of the core features required was the ability to view a consolidated statement for each of their client's portfolios. Being that many of the Guardian insurance and financial products were result of mergers and acquisitions, the data required for the consolidated statement resided on dissimilar systems in geographically dispersed locations.

This project required both new application development and large-scale system integration. Guardian data architects had created a design featuring operational data stores (i.e., relational databases providing interactive access to data) for each of the batch account administration systems (whole life insurance, brokerage, term life, etc). Lightship developed a Web application framework capable of extracting data from each of these systems to develop the consolidated view of each portfolio. In addition, account management features, such as adding, modifying and deleting client information was developed.

The Web application was rolled out to the agent/broker community with great success. Input on the User Interface was received from some of the heavy producers and rapidly incorporated into the application. The pilot program was eventually expanded and put into production. Now called My Guardian, it is Guardian's self-service portal being successfully used by consumers, producers, and benefit managers.

• IBM WebSphere
• IBM DB/2
• Together ControlCenter
• Visual Age
• StarBase StarTeam

A.G. Edwards decided to modernize the skills of their development staff and the implementation technologies to develop new applications. As a result, they required that their development staff begin to develop applications using object technology and Java.

Over a period of two months, Lightship provided Java training and object technology mentoring to their development staff.

• Together ControlCenter
• Symantac VisualCafe

EBS provides foreign currency broking services. They were in a state where they had a successful application that they had previously deployed on a Vax mini-computer. When they decided to develop a new product in the marketplace, they were forced to copy all the code of the working application and make changes to develop a second "product." Realizing how onerous it would be to repeat this process for each new product, they decided to build an entirely new, very flexible application.

Lightship collaboratively architected a new Java-based solution to their Trading Floor/Foreign Exchange Marketplace application. During the mentoring process, Lightship helped them expand their concepts so that, in the future, EBS had the ability to rapidly develop and deploy new products in the anticipation of entering new markets. This capability was achieved by defining new, highly agile objects or, to use a more familiar term, data-driven configurability.

• Together/J
• Borland JBuilder

A local school district had deployed a pilot wireless LAN in parts of their high school for proof of concept and testing. The success and acceptance of this pilot program prompted a desire to deploy a complete enterprise-class secure wireless network. Because of the weaknesses uncovered in the last year with the use of 802.11b static encryption keys, they were concerned about students connecting to the wireless network with personal laptops outside school hours. These students could potentially crack static encryption keys with publicly available hacking tools, and then proceed to attack or try to gain access to sensitive systems and resources. As a result of this very real threat, their goal was to make the wireless network as secure as possible thereby reducing the risk that those attacks could be successfully executed. The customer had a basic understanding of wireless technologies and requested that their solution to be based on the Cisco wireless product line. They also conveyed the need for their solution to meet the following technical and security requirements:

1. Wireless coverage of classrooms and offices on the second floor.
2. The network must support seamless roaming throughout the coverage area.
3. Wireless workstations and laptops allowed on the network must be restricted to an approved list and must be enforced by all access points. Centralized management of these lists is desired.
4. Once valid workstations associate to the wireless LAN, users must authenticate on the wireless network before being allowed to transmit any data.
5. User accounts exist in multiple databases. As a result, authentication of users must be supported against Windows domain accounts, a SecurId server, and a stand-alone user database. The access points require a single, unified authentication interface, so a single authentication server must provide seamless integration to these databases.
6. Because of the vulnerability of the static encryption keys defined in the wireless 802.11b standard to cracking techniques, the dynamic key capabilities of some implementation of EAP should be implemented for user sessions wherever possible. These keys should be different for each connected user and automatically change every 30 minutes to provide resistance to cracking attempts.
7. All workstation and user connections to the wireless network must be audited and centrally logged.
8. Wireless connection traffic statistics should be collected and centrally logged for each wireless session.

With the feature-rich requirements of the desired solution, Lightship met with the client and performed an on-site wireless site survey. This survey provided the necessary real-world information about environment in which the wireless LAN would operate. Any issues that would affect wireless performance were noted and used to accurately select the correct number of access points, antenna types, and mounting locations. Wireless cells were designed to overlap and provide coverage for classrooms and offices on the desired floor. Properly varying frequencies and overlapping cells provided the means to support continuous coverage and seamless roaming throughout the required area.

In order to support the extensive security requirements of the wireless network, a Cisco Secure Access Control Server (ACS) was selected to provide the necessary centralized authentication and logging functionality. All of the wireless access points were configured to communicate with the ACS to validate wireless card MAC addresses before allowing association to an access point. With this enabled, an invalid or unknown wireless card (identified by its MAC address) would be denied access to the wireless network. Using the ACS server to manage valid MAC addresses centrally locates the valid MAC address list. Without this capability, an independent list would be required on each access point. This would have been much more difficult to deploy and manage.

In order to support user authentication and dynamic per user-session encryption keys, the access points were configured to use the Lightweight Extensible Authentication Protocol (LEAP). With this enabled on the access points, users authenticate via username and password before being allowed to use the wireless network. Failure to authenticate results in denied access to the wireless network.

The Cisco ACS also provided a single unified authentication server for the wireless access points to speak to irrespective of where the user accounts are stored. The ACS was configured to use its internal user database as well as speak to a Windows domain and a SecurId server. The result of this unification is a simplified configuration on the wireless access points and a more seamless login process for the wireless users. A user simply needs to have a username and password or a SecurId account name, pass code, and key fob token to gain access. The ACS then correctly validates the account against the correct account database.

The ACS uses groups to organize properties for user accounts, again irrespective of the user account location. These groups were configured to require that WEP keys expire and be automatically regenerated every 30 minutes. These groups were also configured to allow for control of time-of-day schedules and restrictions for certain workstations.

In order to address the logging and accountability aspects of the design, the wireless access points were configured to log authentication information and connection statistics to the ACS. The ACS therefore is responsible for consolidating all logging information and statistics into a single location for review and analysis. This allows administrators to know who is connected on what machine, and how much data was transmitted and received. This information would be used for both security auditing and network capacity planning.

• 802.11b Wireless LAN
• Cisco Aironet access points
• Cisco Access Control Server
• LEAP authentication
• Windows NT/2000
• RSA Security SecurId