Putting PIV Cards to Practical Use

Putting PIV Cards to Practical Use

Putting PIV Cards to Practical UseThe government recognizes the need to increase security for cyber and physical assets so counter measures to reduce, mitigate and eliminate external and internal terrorist threats have been, and remain, paramount.

In 2004, the White House issued the Homeland Security Presidential Directive 12 (HSPD-12), which set the entire government on a path toward establishing protocols for security access of federal workers and contractors. The first step was the creation of the Personal Identity Verification smart card (PIV card), which resulted from the NIST FIPS-201 specification, published in 2005. The next step is to actually use the PIV card for everyday access.

Due to wide variations in how federal departments conduct business and what their risk profile is to the United States, there is no onesize- fits-all security policy. In response to this complexity, the Federal CIO Council established the Identity, Credential and Access Management Subcommittee in 2008 to guide departments in how to use the PIV card for all access appropriate to their mission. This group published the Federal Identity Credential and Access Management (FICAM) Roadmap and Implementation Guidance document (FICAM Roadmap), now in its final version. The Office of Management and Budget (OMB) issued Memorandum M-11-11 in early 2011, which stated that all federal agencies must align with the FICAM Roadmap. Today, virtually every government employee and contractor requiring access for six months or longer is required to carry and use a PIV card.

To obtain this card, each individual must undergo a stringent background check. Any incidents or affiliations that occur after a card is issued may trigger revocation of authority and access privileges.

Program Implementation

In order for this system to fully and correctly function, the cards must be used with physical readers; otherwise an individual could flash a counterfeit PIV card at a guard and gain easy access to a government facility. It also is crucial that each PIV card work across every PACS across the entire government, including all agencies and locations.

While FICAM provided a roadmap for government agencies to plan and execute identity, credential and access management programs that address these needs, it did not provide the concrete details of how the programming should be implemented. As a result, numerous concerns and issues have arisen in the issuance and utilization of PIV cards.

Currently, agencies have the individual responsibility to issue PIV cards to employees and contractors. Often, if an employee or contractor needs access to a different agency, a new card is issued. This increases costs, though, as each PIV card ranges between $200 to $300.

The OMB M-11-11 instructs all agencies to embrace the PIV credentials federated by other agencies; however, to achieve success, all PACS systems across all government agencies must be interoperable and PIV-enabled.

Card Authentication

All PIV cards must be authenticated by government agencies for visitor or contractor management before they are used, which is a software function. The smart card contact reader must read the card, authenticate it against the issuing certificate authority and be enrolled in the system for actual use. Each time the card is used, it must be validated in near real time to ensure the user’s privileges have not been revoked. This “cashing status proxy” continuous validation is extremely important and referenced specifically in the FICAM initiative.

This affects employees, vendors, visitors and partners with different access credentials who may be present at various times on government property. Complicating matters further, these privileges are constantly changing: new employees are hired, employees gain or lose certifications and vendors are added or released.

Beyond the authentication and validation of the PIV, there is also the important issue of authorized access to a given door or building. Each time an individual presents their PIV card, the data on that card and in the authorization database must be accurate and up-to-date – otherwise a person may gain access to an unauthorized area. This goes well beyond unauthorized access compliance issues and presents critical safety concerns.

Overcoming Challenges with Technology

Challenges presented by PIV standard compliances have delayed the full adoption of this protocol by many government agencies. However, existing technology can alleviate the challenges by sustaining valid identities 24/7 and creating a virtual firewall.

Using an enterprise-based, Physical Identity and Access Management (PIAM) solution, government agencies may prevent prohibited, internal access to unauthorized employees, contractors and other individuals enrolled in the system. In alignment with FICAM guidelines, this software can be implemented across multiple facilities and buildings across a campus or even the globe. And, since this software enables existing physical access control systems to fully recognize and validate PIV cards, there is no need to rip and replace existing PACS infrastructure. This is something that visitor management systems cannot do.

New regulations and the advent of PIV cards have created many challenges; the good news is that technology can help solve the challenges existing today.

Solution Benefits

A robust and technologically-advanced, software solution will provide a policy-based approach to managing and enrolling PIV cardholders into diverse PACS. This enables flexible enrollments with validation and processing of individuals needing temporary or longterm access to a given facility. In addition, this technology guards against fraud and fosters real-time audit and compliance, without changing the user’s existing physical security infrastructure.

PIAM software also includes automatic enrollment of newly-issued, PIV credentials, including biometric/biographical data capture from the PIV card in all PACS across every government agency. This software will further enable interoperability between PACS systems and logical authoritative identity systems across all agencies, including LDAP/IdM/HR systems or other third-party PIV database applications. It will establish a single reference point for all cardholders, whether PIV or non-PIV, across agencies and across diverse PACS and Logical Access Systems (LACS). A single, centralized, rules-based process for access privilege provisioning and ongoing access management is available while the lifecycle of PIV cards, including PIV card activation, status inquiry, lost or stolen cards, provisioning and revocation, and card expiration policies can be managed in the physical access control system. Finally, the solution will encompass web-based visitor enrollment and management for PIV and non-PIV cardholders.

Ultimately, implementing this type of software solution will help government agencies:

  • Preserve existing investments in technology;
  • Simplify complex procedures; and
  • Reduce future costs, including security improvements, installations, deployments and maintenance.

If this sounds like a tall order, it is. The software is extremely technologically advanced, but the deployment of the software, however, is not. For government agencies, it is the end of many headaches, and the beginning of more convenient and compliant identity and access management.

This article originally appeared in the November 2013 issue of Security Today.


  • On My Way Out the Door

    To answer that one question I always get, at every booth visit, I have seen amazing product technology, solutions and above all else, the people that make it all work. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2 Recap

    If it’s even possible, Day 2 of ISC West in Las Vegas, Nevada, was even busier than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Venetian, because there’s more news coming out than anyone could be expected to keep track of. Our Live From sponsors—NAPCO Security, Alibi Security, Vistacom, RGB Spectrum, and DoorKing—kept the momentum from Day 1 going with packed booths, happy hours, giveaways, product demonstrations, and more. Read Now

    • Industry Events
    • ISC West
  • Visiting Sin City

    I’m a recovering alcoholic, ten years sober this June. I almost wrote “recovered alcoholic,” because it’s a problem I’ve long since put to bed in every practical sense. But anyone who’s dealt with addiction knows that that part of your brain never goes away. You just learn to tell the difference between that insidious voice in your head and your actual internal monologue, and you get better at telling the other guy to shut up. Read Now

  • Return to Form

    My first security trade show was in 2021. At the time, I was awed by the sheer magnitude of the event and the spectacle of products on display. But this was the first major trade show coming out of the pandemic, and the only commentary I heard was how low the attendance was. Two representatives from one booth even spent the last morning playing catch in the aisle with their giveaway stress balls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3

  • BriefCam v6.0

    BriefCam v6.0

    BriefCam has released BriefCam v6.0, which introduces the new deployment option of a multi-site architecture. This enables businesses with multiple, distributed locations to view aggregate data from all remote sites to uncover trends across locations, optimize operations and boost real-time alerting and response – all while continuing to reap the benefits of BriefCam's powerful analytics platform for making video searchable, actionable and quantifiable. 3

  • LenelS2 BlueDiamond™ mobile app

    enelS2 has introduced its Indoor Location subscription-based service for businesses and other organizations using LenelS2’s BlueDiamond™ mobile app version 2.1.8 for smartphones. 3