Homeland Security Insider

Now, It's Getting Personal

Security has changed over the years in more ways than we can count. From one perspective, security used to be about keeping information secret by restricting its access. Now, the focus is on verifying the identity of the person accessing that information. It's one thing to have valid credentials and another to be the person the credentials validate.

The federal government is leading the way toward better identity security through standards development. Not only is more cooperation mandated by government for other government agencies, but companies wanting to conduct business with the government have to improve security systems through recognized standards, as well. The future is now?agencies and corporations can look forward to improved security across the enterprise. For now, however, the very complexity of the security challenge makes management difficult.

Recognizing the shift towards personal identify verification during the summer of 2004, as the third anniversary of the terrorist attacks of Sept. 11, 2001, approached, the president issued Homeland Security Presidential Directive 12 (HSPD-12) entitled, "Policy for a Common Identification Standard for Federal Employees and Contractors." HSPD-12 requires the development and implementation of a government-wide standard for secure and reliable forms of identification for both physical and logical access control, and other applications as determined by the individual agencies. The goals are to increase security, reduce identity fraud and to increase efficiencies within the federal government. To achieve these goals, the directive sets guidelines and timelines for a federal standard to establish secure and reliable identification for federal employees and contractors. HSPD-12 specifically states that credentials issued must be:

  • Based on sound criteria for verifying an individual's identity.
  • Strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation.
  • Rapidly authenticated electronically.
  • Issued only by providers whose reliability has been established by an official process.

The Department of Commerce's National Institute of Standards and Technology (NIST) was tasked with producing a standard for a secure and reliable form of identification. In response, NIST issued Federal Information Processing Standard 201 (FIPS 201). FIPS 201 is comprised of two parts, Personal Identity Verification (PIV)-I, which describes the minimum requirements for a system that meets control and security objectives, and PIV-II that provides detailed technical specifications to support the control and security objectives, and the details for technical interoperability for authentication, access control and management systems across the federal government.

Subsequently, NIST issued several special publications in support of FIPS 201 to enable interoperable implementations. Additionally, NIST created a conformance test suite for personal identity verification card applications and middleware to ensure interoperability. Currently, NIST is putting together a proof of concept demonstration to show the interoperability of commercially available products that support FIPS 201.

FIPS 201 incorporates three technical publications specifying several aspects of the required administrative procedures and technical specifications that may change as the standard is implemented and used. NIST Special Publication 800-73, "Interfaces for Personal Identity Verification," specifies the interface and data elements of the PIV card; NIST Special Publication 800-76, "Biometric Data Specification for Personal Identity Verification," specifies the technical acquisition and formatting requirements for biometric data of the PIV system; and NIST Special Publication 800-78, "Cryptographic Algorithms and Key Sizes for Personal Identity Verification," specifies the acceptable cryptographic algorithms and key sizes to be implemented and used for the PIV system.

In addition, a number of guidelines, reference implementations and conformance tests have been identified as being needed to implement and use the PIV system; protect the personal privacy of all subscribers of the PIV system; authenticate identity source documents to obtain the correct legal name of the person applying for a PIV card; electronically obtain and store required biometric data (e.g. fingerprints, facial images) from the PIV system subscriber; create a PIV card that is personalized with data needed by the PIV system to later grant access to the subscriber to federal facilities and information systems; ensure appropriate levels of security for all applicable federal applications; and provide interoperability among federal organizations using the standards.

When issued, HSPD-12 contained a very aggressive timeline that has not been difficult to meet. In late December 2005, the General Services Administration (GSA) took an important step towards getting the blanket purchase agreement (BPA) in place by the target date of May 2006, when the current BPA expires. In a request for information (RFI), GSA asked commercial vendors whether they can provide systems and solutions that will meet HSPD-12's implementation requirements. Specifically, GSA asked for information on the capability of commercial vendors to deploy, operate and maintain system solutions that provide one or more of the core components detailed in FIPS 201 and NIST 800-73: registration system/services; identity management system/services; card management system/services; public key infrastructure (PKI) certification authority services; and card printing system/services.

While GSA said the RFI guarantees no request for proposals (RFP) will be issued, if this RFI follows a logical pattern, it will lead to technology demonstrations for down-selected companies/technologies that can lead to substantial long-term contracts for the successful competitors.

Some experts estimate that it will take up to a year for NIST and GSA to make sure products and services conform to technical and interoperability standards, or to the as-yet-not issued biometric standard. NIST plans to update FIPS-201 by Feb. 25.

Vendors were asked to give GSA five-year cost estimates for agencies with 100,000 to more than 1 million cardholders, and comment on the practicality of certain performance metrics, such as notification of suspension or revocation to physical or logical access control systems within 20 minutes, and whether registration per applicant can be done in 15 minutes.

In the meantime, security remains an evolutionary process. In the past, the biometric industry was populated by proprietary devices, but HSPD-12 and FIPS-201 are forcing more open standards in biometrics. That is good for both the industry and for government.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3