Putting PIV Cards to Practical Use
- By Mark Steffler
- Nov 01, 2013
The government recognizes the need to increase security
for cyber and physical assets so counter measures to reduce,
mitigate and eliminate external and internal terrorist
threats have been, and remain, paramount.
In 2004, the White House issued the Homeland Security Presidential
Directive 12 (HSPD-12), which set the entire government
on a path toward establishing protocols for security access of federal
workers and contractors. The first step was the creation of the Personal
Identity Verification smart card (PIV card), which resulted from
the NIST FIPS-201 specification, published in 2005. The next step is
to actually use the PIV card for everyday access.
Due to wide variations in how federal departments conduct business
and what their risk profile is to the United States, there is no onesize-
fits-all security policy. In response to this complexity, the Federal
CIO Council established the Identity, Credential and Access Management
Subcommittee in 2008 to guide departments in how to use the
PIV card for all access appropriate to their mission. This group published
the Federal Identity Credential and Access Management (FICAM)
Roadmap and Implementation Guidance document (FICAM
Roadmap), now in its final version. The Office of Management and
Budget (OMB) issued Memorandum M-11-11 in early 2011, which
stated that all federal agencies must align with the FICAM Roadmap.
Today, virtually every government employee and contractor requiring
access for six months or longer is required to carry and use a PIV card.
To obtain this card, each individual must undergo a stringent
background check. Any incidents or affiliations that occur after a card
is issued may trigger revocation of authority and access privileges.
Program Implementation
In order for this system to fully and correctly function, the cards must
be used with physical readers; otherwise an individual could flash a
counterfeit PIV card at a guard and gain easy access to a government
facility. It also is crucial that each PIV card work across every PACS
across the entire government, including all agencies and locations.
While FICAM provided a roadmap for government agencies to
plan and execute identity, credential and access management programs
that address these needs, it did not provide the concrete details
of how the programming should be implemented. As a result, numerous
concerns and issues have arisen in the issuance and utilization of
PIV cards.
Currently, agencies have the individual responsibility to issue PIV
cards to employees and contractors. Often, if an employee or contractor
needs access to a different agency, a new card is issued. This increases
costs, though, as each PIV card ranges between $200 to $300.
The OMB M-11-11 instructs all agencies to embrace the PIV credentials
federated by other agencies; however, to achieve success, all
PACS systems across all government agencies must be interoperable
and PIV-enabled.
Card Authentication
All PIV cards must be authenticated by government agencies for visitor
or contractor management before they are used, which is a software
function. The smart card contact reader must read the card, authenticate
it against the issuing certificate authority and be enrolled in the
system for actual use. Each time the card is used, it must be validated
in near real time to ensure the user’s privileges have not been revoked.
This “cashing status proxy” continuous validation is extremely important
and referenced specifically in the FICAM initiative.
This affects employees, vendors, visitors and partners with different
access credentials who may be present at various times on government
property. Complicating matters further, these privileges are
constantly changing: new employees are hired, employees gain or lose
certifications and vendors are added or released.
Beyond the authentication and validation of the PIV, there is also
the important issue of authorized access to a given door or building.
Each time an individual presents their PIV card, the data on that card
and in the authorization database must be accurate and up-to-date
– otherwise a person may gain access to an unauthorized area. This
goes well beyond unauthorized access compliance issues and presents
critical safety concerns.
Overcoming Challenges with Technology
Challenges presented by PIV standard compliances have delayed the
full adoption of this protocol by many government agencies. However,
existing technology can alleviate the challenges by sustaining
valid identities 24/7 and creating a virtual firewall.
Using an enterprise-based, Physical Identity and Access Management
(PIAM) solution, government agencies may prevent prohibited,
internal access to unauthorized employees, contractors and other individuals
enrolled in the system. In alignment with FICAM guidelines,
this software can be implemented across multiple facilities and buildings
across a campus or even the globe. And, since this software enables
existing physical access control systems to fully recognize and validate
PIV cards, there is no need to rip and replace existing PACS infrastructure.
This is something that visitor management systems cannot do.
New regulations and the advent of PIV cards have created many
challenges; the good news is that technology can help solve the challenges
existing today.
Solution Benefits
A robust and technologically-advanced, software solution will provide
a policy-based approach to managing and enrolling PIV cardholders
into diverse PACS. This enables flexible enrollments with
validation and processing of individuals needing temporary or longterm
access to a given facility. In addition, this technology guards
against fraud and fosters real-time audit and compliance, without
changing the user’s existing physical security infrastructure.
PIAM software also includes automatic enrollment of newly-issued,
PIV credentials, including biometric/biographical data capture
from the PIV card in all PACS across every government agency. This
software will further enable interoperability between PACS systems
and logical authoritative identity systems across all agencies, including
LDAP/IdM/HR systems or other third-party PIV database applications.
It will establish a single reference point for all cardholders,
whether PIV or non-PIV, across agencies and across diverse PACS and
Logical Access Systems (LACS). A single, centralized, rules-based process
for access privilege provisioning and ongoing access management
is available while the lifecycle of PIV cards, including PIV card activation,
status inquiry, lost or stolen cards, provisioning and revocation,
and card expiration policies can be managed in the physical access
control system. Finally, the solution will encompass web-based visitor
enrollment and management for PIV and non-PIV cardholders.
Ultimately, implementing this type of software solution will help
government agencies:
- Preserve existing investments in technology;
- Simplify complex procedures; and
- Reduce future costs, including security improvements, installations,
deployments and maintenance.
If this sounds like a tall order, it is. The software is extremely technologically
advanced, but the deployment of the software, however, is
not. For government agencies, it is the end of many headaches, and
the beginning of more convenient and compliant identity and access
management.
This article originally appeared in the November 2013 issue of Security Today.