5 tools for improved identity management

Second of two parts. Read part one.

The use of identity-centric security to protect government IT systems has become increasingly urgent as high profile attacks continue to pierce government  systems.  In fact, besides traditional forms of perimeter-based security, identity management is seen by some as offering the best case for protection in expanding cloud and mobile environments.

While these challenges unfold, government agencies will have to rely on improving existing technology solutions – like those highlighted below – to help manage their ongoing and embryonic security threats.  The programs and products represent some of the more far-thinking attempts to address the pressing identity issues and the resulting security concerns associated with weak passwords, the proliferation of mobile devices connecting to networks and the dangers posed by employee data handling errors and theft.

Connect.gov

A government federated identity management hub, overseen by the General Services Administration, started life several years ago as the Federal Cloud Credential Exchange, but became Connect.gov in late 2014. It allows personnel verified through the hub's sign-in partners –  including Verizon, ID.me, Google, Paypal and Yahoo – to use one set of digital credentials for accessing a range of both commercial and public sector sites. The exchange itself doesn’t validate identities, leaving that up to its various partners.

Still classified as a pilot, it already has a number of federal agency participants, such as the Veterans Administration, the Postal Service, the Agriculture Department, NIST and others. High profile agencies such as the IRS have said they won’t use the site for now, but hub officials expect a slew of other agencies to sign up for the service over the next two years.

Any credential users now have to access government sites or bank accounts could be used with Connect.gov, once it’s been validated by one of the sign-in partners. Or users could create a new credential with a partner. That will help cut down on the “identity fatigue” users now suffer from handling numerous passwords, officials believe, which is fueling the bring-your-own-identity movement.

The end goal, according to Connect.gov Director Jennifer Kerber, is to have government agencies organize around one sign-in platform and move away from the siloed identity proofing they've relied on so far. The result will be government providing citizens and businesses with better data.

Unisys Stealth

The firm’s Stealth system is used to establish “secure communities of interest” within an enterprise, where only authorized users can access information. Its origin lies in the Defense Department, where multiple, physical networks were used to segregate information depending on it security classification.

However, that can be tough to manage when there can be 20 or more networks on a single ship or at one site. Having those logically rather than physically isolated makes them much easier to manage, plus it allows for faster support of operations when new physical networks don’t have to be deployed, or wires run to desktops.

In developing the platform, Unisys’s Cohn said the company was looking at the requirements of cloud computing and how to protect and isolate customers’ data in the cloud as needed.

The Stealth solution has a “light fingerprint” as it basically sits on top of existing IT infrastructure.

“It’s essentially a packet filter that sits between layers two and three of the Internet stack,” he said. “It examines the packet to see if it’s intended for a particular community of interest, and, if the person logged on is not a member of that, it ignores it so it’s not translated up the stack.”

Stealth provides a way to do things that are identity related, and that isolates and protects information without a lot of administrative headaches, he said.

Metalogix Replicator Cross Domain Edition

Metalogix developed the Replicator in concert with the Defense Information Systems Agency as a way of securely and automatically transferring content between SharePoint farms that sit on different networks and at different security levels. It can, for example, synchronize content between secret SIPRNet and sensitive but unclassified NIPRNet domains.

Replicator is aimed at stemming data leaks from insiders, much of which happens because of unintended or careless actions.

With deployed forces, whose commanders had to operate within their own organizations but also to cooperate with NATO and other forces, sharing information “was a hugely manual process,” involving removable media, said retired Maj. Gen. Steven Smith, a former Army chief information security officer and now advisor with Metalogix.

That level of complexity inevitably led to mistakes from people who didn’t follow procedures, he said, and that involved, “a lot of work” to clear the resulting data spill.

The Replicator tool works with existing data guards in place at organizations. Metadata tags in SharePoint indicate what other organizations and security levels it can be shared with. Sharing is also bidirectional so any changes are automatically pushed back to the originators of the information and others who have shared it.

Experian TRAP

Experian’s Tax Return Analysis Platform is aimed at helping federal and state organizations combat tax fraud, though the basic technology can be used in circumstances that require identity verification and device proofing.

It has three main components:

• A fraud and identity proofing platform that works with both public and private sources to authenticate a user remotely, in real time.
• Knowledge-based authentication, which asks questions only the particular person being asked will know the answers to.
• Fraudnet, a proofing tool that compares the device being used to file a tax return with a database of devices that are known to have been used in fraudulent activity.

Experian is using the same technology to service identity proofing systems for the Social Security Administration’s online statement system and for the Centers for Medicaid and Medicare Services for identity proofing involved with the Affordable Care Act.

Wave Virtual Smart Card

Wave Systems Corp.’s virtual smart card (VSC) is intended to replace the need for passwords or external tokens such as physical smart cards by using the Trusted Platform Module. The TPMs are security chips built into the motherboard of most current business-class computers with a full-featured Windows operating system.

The combination of a hardware-based root-of-trust provided by the VSC and the user’s personal identification number (PIN) delivers strong two-factor authentication. The fact that it’s a hardware solution both reduces much of the administrative overhead involved with software-based tokens as well as the cost of replacing lost physical tokens, according to the company.

“With around a fifth of physical tokens being lost each year, that’s just a massive burden on the support infrastructure,” said Greg Kazmierczak, Wave’s chief technology officer.

The VSC hasn’t been transitioned to other operating systems such as those for Android or Apple smartphones because a number of the specifications and capabilities are not yet mature enough, he said, unlike the market for Microsoft tablets, laptops and other devices. But they eventually will emerge, Kazmierczak said, helped along by NIST’s recently published SP 800-157 mobile PIV guidelines.

PREVIOUS:  Agencies navigate the identity-based security ecosystem