Putting PIV Cards to Practical Use

• By Mark Steffler
• Nov 01, 2013

The government recognizes the need to increase security for cyber and physical assets so counter measures to reduce, mitigate and eliminate external and internal terrorist threats have been, and remain, paramount.

In 2004, the White House issued the Homeland Security Presidential Directive 12 (HSPD-12), which set the entire government on a path toward establishing protocols for security access of federal workers and contractors. The first step was the creation of the Personal Identity Verification smart card (PIV card), which resulted from the NIST FIPS-201 specification, published in 2005. The next step is to actually use the PIV card for everyday access.

Due to wide variations in how federal departments conduct business and what their risk profile is to the United States, there is no onesize- fits-all security policy. In response to this complexity, the Federal CIO Council established the Identity, Credential and Access Management Subcommittee in 2008 to guide departments in how to use the PIV card for all access appropriate to their mission. This group published the Federal Identity Credential and Access Management (FICAM) Roadmap and Implementation Guidance document (FICAM Roadmap), now in its final version. The Office of Management and Budget (OMB) issued Memorandum M-11-11 in early 2011, which stated that all federal agencies must align with the FICAM Roadmap. Today, virtually every government employee and contractor requiring access for six months or longer is required to carry and use a PIV card.

To obtain this card, each individual must undergo a stringent background check. Any incidents or affiliations that occur after a card is issued may trigger revocation of authority and access privileges.

Program Implementation

In order for this system to fully and correctly function, the cards must be used with physical readers; otherwise an individual could flash a counterfeit PIV card at a guard and gain easy access to a government facility. It also is crucial that each PIV card work across every PACS across the entire government, including all agencies and locations.

While FICAM provided a roadmap for government agencies to plan and execute identity, credential and access management programs that address these needs, it did not provide the concrete details of how the programming should be implemented. As a result, numerous concerns and issues have arisen in the issuance and utilization of PIV cards.

Currently, agencies have the individual responsibility to issue PIV cards to employees and contractors. Often, if an employee or contractor needs access to a different agency, a new card is issued. This increases costs, though, as each PIV card ranges between $200 to $300.

The OMB M-11-11 instructs all agencies to embrace the PIV credentials federated by other agencies; however, to achieve success, all PACS systems across all government agencies must be interoperable and PIV-enabled.

Card Authentication

All PIV cards must be authenticated by government agencies for visitor or contractor management before they are used, which is a software function. The smart card contact reader must read the card, authenticate it against the issuing certificate authority and be enrolled in the system for actual use. Each time the card is used, it must be validated in near real time to ensure the user’s privileges have not been revoked. This “cashing status proxy” continuous validation is extremely important and referenced specifically in the FICAM initiative.

This affects employees, vendors, visitors and partners with different access credentials who may be present at various times on government property. Complicating matters further, these privileges are constantly changing: new employees are hired, employees gain or lose certifications and vendors are added or released.

Beyond the authentication and validation of the PIV, there is also the important issue of authorized access to a given door or building. Each time an individual presents their PIV card, the data on that card and in the authorization database must be accurate and up-to-date – otherwise a person may gain access to an unauthorized area. This goes well beyond unauthorized access compliance issues and presents critical safety concerns.

Overcoming Challenges with Technology

Challenges presented by PIV standard compliances have delayed the full adoption of this protocol by many government agencies. However, existing technology can alleviate the challenges by sustaining valid identities 24/7 and creating a virtual firewall.

Using an enterprise-based, Physical Identity and Access Management (PIAM) solution, government agencies may prevent prohibited, internal access to unauthorized employees, contractors and other individuals enrolled in the system. In alignment with FICAM guidelines, this software can be implemented across multiple facilities and buildings across a campus or even the globe. And, since this software enables existing physical access control systems to fully recognize and validate PIV cards, there is no need to rip and replace existing PACS infrastructure. This is something that visitor management systems cannot do.

New regulations and the advent of PIV cards have created many challenges; the good news is that technology can help solve the challenges existing today.

Solution Benefits

A robust and technologically-advanced, software solution will provide a policy-based approach to managing and enrolling PIV cardholders into diverse PACS. This enables flexible enrollments with validation and processing of individuals needing temporary or longterm access to a given facility. In addition, this technology guards against fraud and fosters real-time audit and compliance, without changing the user’s existing physical security infrastructure.

PIAM software also includes automatic enrollment of newly-issued, PIV credentials, including biometric/biographical data capture from the PIV card in all PACS across every government agency. This software will further enable interoperability between PACS systems and logical authoritative identity systems across all agencies, including LDAP/IdM/HR systems or other third-party PIV database applications. It will establish a single reference point for all cardholders, whether PIV or non-PIV, across agencies and across diverse PACS and Logical Access Systems (LACS). A single, centralized, rules-based process for access privilege provisioning and ongoing access management is available while the lifecycle of PIV cards, including PIV card activation, status inquiry, lost or stolen cards, provisioning and revocation, and card expiration policies can be managed in the physical access control system. Finally, the solution will encompass web-based visitor enrollment and management for PIV and non-PIV cardholders.

Ultimately, implementing this type of software solution will help government agencies:

• Preserve existing investments in technology;
• Simplify complex procedures; and
• Reduce future costs, including security improvements, installations, deployments and maintenance.

If this sounds like a tall order, it is. The software is extremely technologically advanced, but the deployment of the software, however, is not. For government agencies, it is the end of many headaches, and the beginning of more convenient and compliant identity and access management.

This article originally appeared in the November 2013 issue of Security Today.