Federal Identity

Federal Identity

Achieve compliance without a rip-and-replace investment

When the Homeland Security Presidential Directive-12 (HSPD-12) was enacted in August 2004, government agencies embarked on the challenging task of complying with an evolving set of standards designed to ensure that all federal employees and contractors have secure and reliable forms of identification.

Agencies were given more specific deadline information in February 2011. The Department of Homeland Security and the Office of Management and Budget issued a memorandum stating that, beginning in the government’s fiscal 2012—that is, Oct. 1, 2011—all existing physical and logical access control systems must be upgraded to implement Personal Identification Verification (PIV) credentials before federal agencies can use development and technology refresh funds to complete other activities. These access control systems must use smart card and biometric technology and support identification credentials in compliance with National Institute of Standards and Technology (NIST) guidelines, which are embodied in Federal Information Processing Standards Publication 201 (FIPS-201).

Complying with these guidelines has generally been a costly and complex process that has required agencies to gather, organize and deploy a variety of technologies. Agencies have also frequently needed to hire experts and third-party suppliers to assist with their upgrades and to establish a migration path from existing credentials. Too often, agencies have been required to completely replace their physical access control head-end servers, panels and door control hardware. With proper planning and a modular, turnkey approach, however, FIPS-201 compliance can be accomplished at a significantly lower cost while preserving investments in the existing access control infrastructure.

Compliance Requirements and Deadlines

HSPD-12 is intended to enhance security, increase government efficiency, reduce identity fraud and protect personal privacy. It requires agencies to follow specific technical standards and business processes for the issuing and routine use of secure and reliable forms of identification in compliance with FIPS-201.

The FIPS-201 document, titled “Personal Identity Verification (PIV) of Federal Employees and Contractors,” defines the multi-factor authentication, digital signature and encryption capabilities required for standardized PIV smart card credentials. Federal employees and contractors must use these cards to gain access to all government facilities and disaster response sites. FIPS- 201 compliance is expected to create a standardized infrastructure of interoperable access control products across a wide range of facilities belonging to disparate agencies and partners. This will lead to reduced overall costs while improving the government’s ability to leverage its buying power. All new systems under development will need to support PIV credentials and physical building access modifications according to NIST guidelines.

One of the most important documents issued by the government is SP800- 116, which introduces the concept of controlled, limited and exclusion areas, to which agencies must tailor risk-based PIV authentication mechanisms. The document also proposes a PIV Implementation Maturity Model (PIMM) to measure the progress of facility and agency implementations. Finally, it recommends to federal agencies an overall strategy for the implementation of PIV authentication mechanisms within a facility’s physical access control system (PACS).

Compliance Best Practices

Using fully interoperable, simple-to-deploy and cost-effective products and technologies that have been tested and validated as part of a complete, turnkey solution is the best way to streamline FIPS- 201 compliance. The most successful upgrade programs also provide agencies with a single point of deployment responsibility, and they ensure that compliance is achieved quickly, effectively and with all necessary audit support, on an incremental, pay-as-you-go basis, so agencies can retain much of their existing infrastructure. Compliance programs should:

  • Enable the authentication of credentials across the full range of assurance levels;
  • Deliver compliance without requiring a wholesale rip-andreplacement of existing equipment;
  • Offer the option of implementing a converged physical and logical security solution as envisioned by HSPD-12;
  • Provide a single solution for both FIPS-201 and SP 800-116 compliance; and
  • Meet all security, compliance and ROI objectives by enabling the full range of PIV, PIV-I and CAC card access.

Achieving these objectives requires a modular approach using a new generation of more flexible and secure reader platforms combined with modular compliance hardware.

Leveraging Reader Advances for FIPS-201 Compliance

The latest reader technology reduces the complexity of the compliance process significantly by employing better-protected architectures that significantly enhance access-control security and deployment flexibility. These reader platforms employ EAL5+ secure element hardware that ensures tamper-proof protection of keys and cryptographic operations. They also use the industry-standard open supervised device protocol (OSDP) communications standard to establish a seamless and secure, bidirectional link between the reader and today’s easy-to-deploy FIPS-201 compliance hardware modules.

Next-generation reader technology also enhances security by using a new, portable credential methodology on a standardsbased, technology-independent and flexible identity data structure. This data structure uses a device-independent data object that HID Global calls a secure identity object, which can exist on any number of identity devices. These data objects work with companion SIO interpreters on the reader side that, together, behave as traditional cards and readers do while using a significantly more secure, flexible and extensible data structure.

Device-independent data objects offer three key benefits for FIPS-201-compliant solutions and other access control system implementations. First, because they’re portable, these data objects can reside on traditional contactless credentials and many different mobile device formats, ensuring interoperability and easy migration.

Second, their device independence enhances trusted security by enabling them to act as a data wrapper to provide additional key diversification, authentication and encryption while guarding against security penetration.

Third, because they use open standards, these deviceindependent identity objects improve flexibility and can grow in security capabilities while traditional architectures remain stuck in a fixed definition. Each of these benefits is critically important for next-generation, secure identity portability and for enhanced protection in a FIPS-201-compliant environment.

Implementing a Modular Compliance Upgrade

With a modular upgrade, the only hardware that needs to be added is new readers, compliance hardware modules and a compliance manager. Installed between the readers and the existing PACS panel, the compliance hardware modules are used to validate FIPS-201 cards, extract the badge ID and pass it along to the PACS panel for an access decision. The compliance manager provides centralized control of assurance level settings and distribution of validation data. The most recent offerings add a new service application programming interface (API) that integrates PACS enrollment capability directly into the validation service.

Today’s modular compliance systems perform all of the steps required for PIV authentication. At the time of enrollment, the trusted card issuers—also known as the trust anchors—are set in the system. The status of enrolled PIV cards is checked on a periodic basis to prohibit access by revoked cards. This is done by retrieving the card revocation status from the issuing certificate authority (OCSP/ CRL/MiniCRL) and the TWIC Hotlist. When a PIV, PIV-I, CAC or TWIC card with the appropriate assurance level is presented to a corresponding reader, the compliance hardware module validates the card according to the assurance level setting, extracts the badge ID from data on the card, and then passes the badge ID to the PACS panel for an access decision and logging.

The compliance hardware module also validates PIV cards from visitors by using the Server-based Certificate Validation Protocol (SCVP) to implement the path discovery process and establish a chain of trust through the federal bridge. This enables interoperability across government agencies and with non-government members of the federal bridge.

For invalid cards, the compliance hardware module is configurable to send a preset badge ID to the PACS panel and/or close an output relay. In case of communication interruption, the compliance hardware module maintains an updated validation data cache—such as issuer trust status and revocation status—so it can function offline, while strong authentication continues at the door.

Additionally, cardholder data can be captured automatically the first time a card is presented for validation to any reader connected to a compliance hardware module. The data also can then be stored and distributed to all other compliance hardware modules by a compliance management station. This feature delivers several benefits. It allows traditional cardholder enrollment using existing PACS enrollment functionality. It also allows integration with an identity management system or card management system.

Finally, it enables the use of third-party enrollment packages. Federal agencies face challenges in upgrading their PACS infrastructure to meet the latest government mandates. Until now, the compliance process has required multiple vendors, and agencies have often had to replace their entire systems. A new, modular hardware approach makes it significantly easier and less costly for agencies to respond to regulatory changes, while giving them the flexibility to modify security levels in selected areas, as required, and take advantage of ongoing advances in access control technology.

This article originally appeared in the October 2011 issue of Security Today.

Featured

  • Security Today Announces The Govies Government Security Award Winners for 2025

    Security Today is pleased to announce the 2025 winners in The Govies Government Security Awards. The awards honor outstanding government security products in a variety of categories. Read Now

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.