Putting PIV Cards to Practical Use

Putting PIV Cards to Practical Use

Putting PIV Cards to Practical UseThe government recognizes the need to increase security for cyber and physical assets so counter measures to reduce, mitigate and eliminate external and internal terrorist threats have been, and remain, paramount.

In 2004, the White House issued the Homeland Security Presidential Directive 12 (HSPD-12), which set the entire government on a path toward establishing protocols for security access of federal workers and contractors. The first step was the creation of the Personal Identity Verification smart card (PIV card), which resulted from the NIST FIPS-201 specification, published in 2005. The next step is to actually use the PIV card for everyday access.

Due to wide variations in how federal departments conduct business and what their risk profile is to the United States, there is no onesize- fits-all security policy. In response to this complexity, the Federal CIO Council established the Identity, Credential and Access Management Subcommittee in 2008 to guide departments in how to use the PIV card for all access appropriate to their mission. This group published the Federal Identity Credential and Access Management (FICAM) Roadmap and Implementation Guidance document (FICAM Roadmap), now in its final version. The Office of Management and Budget (OMB) issued Memorandum M-11-11 in early 2011, which stated that all federal agencies must align with the FICAM Roadmap. Today, virtually every government employee and contractor requiring access for six months or longer is required to carry and use a PIV card.

To obtain this card, each individual must undergo a stringent background check. Any incidents or affiliations that occur after a card is issued may trigger revocation of authority and access privileges.

Program Implementation

In order for this system to fully and correctly function, the cards must be used with physical readers; otherwise an individual could flash a counterfeit PIV card at a guard and gain easy access to a government facility. It also is crucial that each PIV card work across every PACS across the entire government, including all agencies and locations.

While FICAM provided a roadmap for government agencies to plan and execute identity, credential and access management programs that address these needs, it did not provide the concrete details of how the programming should be implemented. As a result, numerous concerns and issues have arisen in the issuance and utilization of PIV cards.

Currently, agencies have the individual responsibility to issue PIV cards to employees and contractors. Often, if an employee or contractor needs access to a different agency, a new card is issued. This increases costs, though, as each PIV card ranges between $200 to $300.

The OMB M-11-11 instructs all agencies to embrace the PIV credentials federated by other agencies; however, to achieve success, all PACS systems across all government agencies must be interoperable and PIV-enabled.

Card Authentication

All PIV cards must be authenticated by government agencies for visitor or contractor management before they are used, which is a software function. The smart card contact reader must read the card, authenticate it against the issuing certificate authority and be enrolled in the system for actual use. Each time the card is used, it must be validated in near real time to ensure the user’s privileges have not been revoked. This “cashing status proxy” continuous validation is extremely important and referenced specifically in the FICAM initiative.

This affects employees, vendors, visitors and partners with different access credentials who may be present at various times on government property. Complicating matters further, these privileges are constantly changing: new employees are hired, employees gain or lose certifications and vendors are added or released.

Beyond the authentication and validation of the PIV, there is also the important issue of authorized access to a given door or building. Each time an individual presents their PIV card, the data on that card and in the authorization database must be accurate and up-to-date – otherwise a person may gain access to an unauthorized area. This goes well beyond unauthorized access compliance issues and presents critical safety concerns.

Overcoming Challenges with Technology

Challenges presented by PIV standard compliances have delayed the full adoption of this protocol by many government agencies. However, existing technology can alleviate the challenges by sustaining valid identities 24/7 and creating a virtual firewall.

Using an enterprise-based, Physical Identity and Access Management (PIAM) solution, government agencies may prevent prohibited, internal access to unauthorized employees, contractors and other individuals enrolled in the system. In alignment with FICAM guidelines, this software can be implemented across multiple facilities and buildings across a campus or even the globe. And, since this software enables existing physical access control systems to fully recognize and validate PIV cards, there is no need to rip and replace existing PACS infrastructure. This is something that visitor management systems cannot do.

New regulations and the advent of PIV cards have created many challenges; the good news is that technology can help solve the challenges existing today.

Solution Benefits

A robust and technologically-advanced, software solution will provide a policy-based approach to managing and enrolling PIV cardholders into diverse PACS. This enables flexible enrollments with validation and processing of individuals needing temporary or longterm access to a given facility. In addition, this technology guards against fraud and fosters real-time audit and compliance, without changing the user’s existing physical security infrastructure.

PIAM software also includes automatic enrollment of newly-issued, PIV credentials, including biometric/biographical data capture from the PIV card in all PACS across every government agency. This software will further enable interoperability between PACS systems and logical authoritative identity systems across all agencies, including LDAP/IdM/HR systems or other third-party PIV database applications. It will establish a single reference point for all cardholders, whether PIV or non-PIV, across agencies and across diverse PACS and Logical Access Systems (LACS). A single, centralized, rules-based process for access privilege provisioning and ongoing access management is available while the lifecycle of PIV cards, including PIV card activation, status inquiry, lost or stolen cards, provisioning and revocation, and card expiration policies can be managed in the physical access control system. Finally, the solution will encompass web-based visitor enrollment and management for PIV and non-PIV cardholders.

Ultimately, implementing this type of software solution will help government agencies:

  • Preserve existing investments in technology;
  • Simplify complex procedures; and
  • Reduce future costs, including security improvements, installations, deployments and maintenance.

If this sounds like a tall order, it is. The software is extremely technologically advanced, but the deployment of the software, however, is not. For government agencies, it is the end of many headaches, and the beginning of more convenient and compliant identity and access management.

This article originally appeared in the November 2013 issue of Security Today.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3