PRINCETON JUNCTION, N.J., June 12, 2018 (GLOBE NEWSWIRE) -- More than 300 government policy leaders, security experts and technology providers gathered at the Secure Technology Alliance’s Securing Federal Identity 2018 conference in Washington, D.C. last week to discuss the latest developments and innovations in federal identity credentialing and access security.
As the nation’s premier event for government-led cybersecurity policy and digital identity technology, more than half of registrations were federal executives looking to learn about identity management roadmap changes, progress for cloud and mobility initiatives, and updates from OMBi, GSAii, DHSiii and NISTiv on policy and standards initiatives.
An Insider Look at Technology and Policy Impacting Government Security
The impact of updates to policy and specifications for the expanded use of standards-based technologies on securing identity and access in government was a leading theme throughout the two-day event.
Keynote speaker Suzette Kent, federal CIO of OMB, kicked off the event by highlighting some of the challenges that need to be addressed through advances in policy and technology, including gaps in the use of multi-factor authentication, the division between logical and physical access, and the need for cross-agency interoperability.
More government policy and technology updates followed Kent’s remarks from two federal program leaders – Jim Sheire, director of FICAMv at GSA and Anil John, cyber security R&D program manager at DHS. Both provided valuable insights into progress the government is making in aligning identity policy and security standards with changing requirements for mobile authentication and modernizing identity management services.
Jordan Burris, senior cybersecurity advisor for the Executive Office of the President, shared an inside look at how and why the draft Federal Identity Policy document OMB M-18-XX was developed, stating that industry feedback deemed the previously-published policies too restrictive, and confined innovation. Burris said this feedback helped to direct the latest update, with the goal to consolidate and update existing requirements and promote innovation by improving ICAMvi governance, modernizing ICAM capabilities and improving adoption of shared services.
Hildegard Ferraiolo, computer scientist at NIST, gave an update on derived mobile credentials detailed in NIST publication SP-800-157 and an early look into the updates being made to SP 800-116, “A Recommendation for the Use of PIVvii Credentials in PACSviii,” being released this summer. She highlighted that the aim of the revision is to align with HSPD-12 to ensure electronic authentication for PACS is reliable, fast, secure and interoperable across agencies.
Alternatives for Authentication
In a panel focused on multifactor authentication choices, three authentication experts outlined innovative alternatives and current initiatives for multi-factor authentication for federal agencies:
- Paul Grassi, partner and SVP of cybersecurity and identity management at Easy Dynamic Corporation, pointed to FIDO authentication as a standards-based option that is being widely implemented across a variety of industries and platforms that provides high-assurance strong authentication. Grassi highlighted that FIDO authentication can be used in government to provide stronger, more usable and more affordable authentication than passwords and OTPs
- Joel Minton, executive director of Login.gov, detailed how the Login.gov initiative is mandating strong authentication to make managing federal benefits, services and applications across multiple government agencies easier and more secure. Today, more than 20 agencies are offering services through Login.gov
- Col. Tom Clancy, who serves as IDAM and PKI lead in the Office of the Secretary of Defense, looked at different authentication options, such as PKIix, FIDO Security Keys and on-device credentials, and discussed the need for finding a way to simplify implementation of these options
Expanding the Use of PIV to Mobile Devices
In a discussion on federal identity programs and standards, speakers gave updates on use cases where progress is being made in expanding the use of PIV credentials to mobile devices.
David Coley, senior solution architect for Intercede, showed how mobile derived credentials based on PIV have become increasingly standardized across a wider range of mobile devices and mobile management services.
Ben Andreas, director of sales for XTec Inc., shared the latest developments in the rollout of derived credentials in DHS, where 60,000+ credentials have been issued. He also shared lessons learned surrounding testing, policy and the need for collaboration with people across a variety of roles within DHS to make the implementation successful.
Brandon Iske, Purebred lead at DISAx, shared an update on their Purebred initiative, which aims to augment the CACxi card by moving credentials to mobile devices. Today, they have enabled credentials across approximately 35,000 devices on the iOS, Android, Microsoft and Blackberry mobile operating systems and are continuing to see growth.
Securing Federal Identity – a Forum for Education and Action
An educational panel led by the Secure Technology Alliance Access Control Council featured government and industry experts discussing lessons learned from their involvement in deployments of PIV-enabled PACS. Panelists shared their expertise in implementing PACS for government from the Alliance’s recent six-part webinar series on the topic, “How to Plan, Procure and Deploy a PIV-Enabled Physical Access Control System.” Panelists included Tony Damalas, VP of SigNet Technologies Convergint Federal Solutions; Michael Kelley, electronic security system technical specialist at Parsons; Stafford Mahfouz, manager of the government and DoDxii vertical at TYCO; and William Windsor, deputy director Enterprise Integration and Compliance Office at DHS.
In providing educational sessions on technologies and policies, the Securing Federal Identity event also saw strong participation from the audience, making it a forum for federal government and technology executives to openly discuss current challenges, identify possible solutions, and answer questions about procurement of technology, alignment with policy, use of standards and developments in for government identity management initiatives.
During the event, Secure Technology Alliance Executive Director Randy Vanderhoof called for cross-industry participation between the Alliance and federal agencies to keep discussion open and to encourage regular conversations between industry and government.
Vanderhoof also announced that the next Secure Technology Alliance event, Securing Digital ID 2018, will be held December 4-5 in Washington, D.C. The event will focus on today’s complex world of digital identities and how identity is a cross-industry problem that must be addressed for strong authentication and authorization of digital services such as payments, network security, home healthcare and the Internet of Things. More information about the event will be released this summer.
For more information on the Secure Technology Alliance and government identity resources, visit the Government Identity/Credentialing Resources on the Secure Technology Alliance website.
About the Secure Technology Alliance
The Secure Technology Alliance is a not-for-profit, multi-industry association working to stimulate the understanding, adoption and widespread application of secure solutions, including smart cards, embedded chip technology, and related hardware and software across a variety of markets including authentication, commerce and Internet of Things (IoT).
The Secure Technology Alliance, formerly known as the Smart Card Alliance, invests heavily in education on the appropriate uses of secure technologies to enable privacy and data protection. The Secure Technology Alliance delivers on its mission through training, research, publications, industry outreach and open forums for end users and industry stakeholders in payments, mobile, healthcare, identity and access, transportation, and the IoT in the U.S. and Latin America.
For more information, please visit www.securetechalliance.org.
CONTACT:
Adrian Loth
Montner Tech PR
203-226-9290
aloth@montner.com
i Office of Management and Budget
ii General Services Administration
iii Department of Homeland Security
iv National Institute of Standards and Technology
v Federal Identity, Credential, and Access Management
vi Identity, Credential, and Access Management
vii Personal Identity Verification
viii Physical Access Control Systems
ix Public Key Infrastructure
x Defense Information Systems Agency
xi Common Access Card
xii Department of Defense