Homeland Security Insider

Now, It's Getting Personal

Security has changed over the years in more ways than we can count. From one perspective, security used to be about keeping information secret by restricting its access. Now, the focus is on verifying the identity of the person accessing that information. It's one thing to have valid credentials and another to be the person the credentials validate.

The federal government is leading the way toward better identity security through standards development. Not only is more cooperation mandated by government for other government agencies, but companies wanting to conduct business with the government have to improve security systems through recognized standards, as well. The future is now?agencies and corporations can look forward to improved security across the enterprise. For now, however, the very complexity of the security challenge makes management difficult.

Recognizing the shift towards personal identify verification during the summer of 2004, as the third anniversary of the terrorist attacks of Sept. 11, 2001, approached, the president issued Homeland Security Presidential Directive 12 (HSPD-12) entitled, "Policy for a Common Identification Standard for Federal Employees and Contractors." HSPD-12 requires the development and implementation of a government-wide standard for secure and reliable forms of identification for both physical and logical access control, and other applications as determined by the individual agencies. The goals are to increase security, reduce identity fraud and to increase efficiencies within the federal government. To achieve these goals, the directive sets guidelines and timelines for a federal standard to establish secure and reliable identification for federal employees and contractors. HSPD-12 specifically states that credentials issued must be:

  • Based on sound criteria for verifying an individual's identity.
  • Strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation.
  • Rapidly authenticated electronically.
  • Issued only by providers whose reliability has been established by an official process.

The Department of Commerce's National Institute of Standards and Technology (NIST) was tasked with producing a standard for a secure and reliable form of identification. In response, NIST issued Federal Information Processing Standard 201 (FIPS 201). FIPS 201 is comprised of two parts, Personal Identity Verification (PIV)-I, which describes the minimum requirements for a system that meets control and security objectives, and PIV-II that provides detailed technical specifications to support the control and security objectives, and the details for technical interoperability for authentication, access control and management systems across the federal government.

Subsequently, NIST issued several special publications in support of FIPS 201 to enable interoperable implementations. Additionally, NIST created a conformance test suite for personal identity verification card applications and middleware to ensure interoperability. Currently, NIST is putting together a proof of concept demonstration to show the interoperability of commercially available products that support FIPS 201.

FIPS 201 incorporates three technical publications specifying several aspects of the required administrative procedures and technical specifications that may change as the standard is implemented and used. NIST Special Publication 800-73, "Interfaces for Personal Identity Verification," specifies the interface and data elements of the PIV card; NIST Special Publication 800-76, "Biometric Data Specification for Personal Identity Verification," specifies the technical acquisition and formatting requirements for biometric data of the PIV system; and NIST Special Publication 800-78, "Cryptographic Algorithms and Key Sizes for Personal Identity Verification," specifies the acceptable cryptographic algorithms and key sizes to be implemented and used for the PIV system.

In addition, a number of guidelines, reference implementations and conformance tests have been identified as being needed to implement and use the PIV system; protect the personal privacy of all subscribers of the PIV system; authenticate identity source documents to obtain the correct legal name of the person applying for a PIV card; electronically obtain and store required biometric data (e.g. fingerprints, facial images) from the PIV system subscriber; create a PIV card that is personalized with data needed by the PIV system to later grant access to the subscriber to federal facilities and information systems; ensure appropriate levels of security for all applicable federal applications; and provide interoperability among federal organizations using the standards.

When issued, HSPD-12 contained a very aggressive timeline that has not been difficult to meet. In late December 2005, the General Services Administration (GSA) took an important step towards getting the blanket purchase agreement (BPA) in place by the target date of May 2006, when the current BPA expires. In a request for information (RFI), GSA asked commercial vendors whether they can provide systems and solutions that will meet HSPD-12's implementation requirements. Specifically, GSA asked for information on the capability of commercial vendors to deploy, operate and maintain system solutions that provide one or more of the core components detailed in FIPS 201 and NIST 800-73: registration system/services; identity management system/services; card management system/services; public key infrastructure (PKI) certification authority services; and card printing system/services.

While GSA said the RFI guarantees no request for proposals (RFP) will be issued, if this RFI follows a logical pattern, it will lead to technology demonstrations for down-selected companies/technologies that can lead to substantial long-term contracts for the successful competitors.

Some experts estimate that it will take up to a year for NIST and GSA to make sure products and services conform to technical and interoperability standards, or to the as-yet-not issued biometric standard. NIST plans to update FIPS-201 by Feb. 25.

Vendors were asked to give GSA five-year cost estimates for agencies with 100,000 to more than 1 million cardholders, and comment on the practicality of certain performance metrics, such as notification of suspension or revocation to physical or logical access control systems within 20 minutes, and whether registration per applicant can be done in 15 minutes.

In the meantime, security remains an evolutionary process. In the past, the biometric industry was populated by proprietary devices, but HSPD-12 and FIPS-201 are forcing more open standards in biometrics. That is good for both the industry and for government.

Featured

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

  • 2025 Security LeadHER Conference Program Announced

    ASIS International and the Security Industry Association (SIA) – the leading membership associations for the security industry – have announced details for the 2025 Security LeadHER conference, a special event dedicated to advancing, connecting and empowering women in the security profession. The third annual Security LeadHER conference will be held Monday, June 9 – Tuesday, June 10, 2025, at the Detroit Marriott Renaissance Center in Detroit, Michigan. This carefully crafted program represents a comprehensive professional development opportunity for women in security this year. To view the full lineup at this year’s event, please visit securityleadher.org. Read Now

    • Industry Events

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.