public-private partnerships

Card Overload

Government directives can help private sector determine which access control cards best fit their needs

  • By Mas Kosaka
  • Mar 02, 2010

Government directives were designed to help enhance security, increase government efficiency, reduce identity fraud and protect personal privacy by establishing a government-wide standard for secure and reliable forms of identification issued by the federal government to its personnel.

You can use these directives to help those in the private sector to be better informed. With computer hackers stealing millions of electronic records every year, many Fortune 1,000 companies are trying to secure their networks through the use of public key infrastructure. As such, many are turning to HSPD-12.

The Federal Government

As a result of Sept. 11, 2001, in August 2004, President George W. Bush issued HSPD-12, which established the policy for common identification standards for all federal employees and contractors who require routine or regular scheduled access to federal facilities.

The directive developed a common identification standard that ensures people are who they say they are, so government facilities and sensitive information stored in networks and within physical facilities remain protected. To achieve a higher protection level, HSPD-12 requires agencies to issue smart-card technologies to all federal employees and contractors for access to buildings, facilities and computer networks. In addition, HSPD-12 directed the development of federal information processing standards to define systems to achieve a common identification credential. In accordance with HSPD-12, the FIPS 201 standard, the personal identity verification of federal employees and contractors, establishes the technical requirements for the identity credential that is issued based on sound criteria for verifying a person's identity. It ensures the credential is strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation and can be rapidly authenticated electronically.

Following this presidential directive, standards have arisen to drive major changes in card technologies. For example, FIPS 201 defines the PIV and platform interoperability. FIPS 140 defines the requirements and standards for cryptographic modules, which include both hardware and software components for security. Finally, NIST 800-116 defines the use of PIV cards within a physical access control system. From these standards have come other programs, like TWIC, CAC (Department of Defense), FRAC (first responders) and PIV-I (interoperable) for government subcontractors and PIV-C (PIV compatible) for private companies that want to use the card as an employee badge.

A new type of card was developed to support both contactless physical access and contact logical access, commonly referred to as a dual interface card. Both interfaces, contact and contactless, are connected to the same processor chip, providing common security and cost efficiency. For physical access control, the cards can support MIFARE or DESFire emulation and, with the addition of a Prox inlay, also can support legacy proximity technologies.

While MIFARE and DESFire are not used within a PIV deployment, the open and interoperable architecture of the technologies aligns perfectly with the non-proprietary strategy behind HSPD-12.

Public key infrastructure is a set of policies, processes, server platforms, software and workstations used for the purpose of administering certificates and public-private key pairs, including the ability to issue, maintain and revoke public key certificates As a result of HSPD-12, the government has launched major PIV programs to comply with this directive, including TWIC, Department of Veterans Affairs Personal Identity Verification system and GSA USAccess. It also includes two forms of ID: physical access and computer access using the PIN within the card.

The General Services Administration's Office of Governmentwide Policy has been appointed as the Federal PKI Management Authority to manage the design and development, and implement and operate the Production FPKIA.

Homeland Security-trusted Traveler Program

The purpose of the card is to verify your identity by matching the information stored in the card with the information you provided during your enrollment process.

The National Institute of Standards and Technology has issued specific guidance on the implementation and application of physical access control with PIV cards. This guidance is known as SP800-116 and requires the specific use of the strong authentication and other features of the PIV credential for every access control system. The requirements of SP800-116 represent the use of advanced credential and individual identity authentication that is outside of the scope of most existing access control readers and require PKI processing that transcends the operational capabilities of most PACS infrastructure.

A few companies have developed products specifically to meet and exceed the requirements of FIPS201 and SP800-116 and now offer a complete solution in compliance with these standards and directives.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

Most   Popular

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.