How to protect data for the always connected employee
Connecting state and local government leaders
The key to enhancing mobile security is combining a secure digital identity with a second authentication factor such as a PIN or fingerprint to let employees use their devices to authenticate themselves for physical and digital access.
Once thought of primarily as a concern for the defense and intelligence communities, cybersecurity is now seen as a critical priority for every single government entity. In the wake of recent data breaches of both major corporations and federal agencies, government officials are now starting to fully address their own data vulnerabilities to ensure that their agencies do not suffer the same fate. In order to fight back against hackers and protect sensitive data from falling into the hands of organizations or opportunistic hackers, agencies must deploy more robust security technology to mobile devices – both agency issued and employee-owned – to enhance data security.
The advent of smartphones and tablets has killed the 9-5 mentality and transformed the federal workforce into a 24-7 culture. However, with increased access comes an increased number of digital end points for sending and receiving sensitive data. For federal employees, the rise of mobility has opened the doors to more flexible working, but has also increased the possibility for employees to access government data and networks beyond the secure networks of government buildings.
When sensitive federal data can be accessed remotely from employees’ mobile devices, it is vital for agencies to take the appropriate steps to protect digital assets and sensitive data. Failure to do so could lead to the theft of such data, causing disruption not just for the agency, but also for the data security of the entire federal government. The nature of federal data means that any damage done could have a detrimental impact on national security.
Since the government implemented measures to standardize identity and credentials across all federal agencies nearly 10 years ago, almost 5 million smartcard-based Personal Identity Verification (PIV) credentials have been issued to government employees and contractors for secure access to buildings and IT systems. The standards have been widened for non-federal and commercial use to include millions more through Personal Identity Verification Interoperable (PIV-I) and Commercial Identity Verification (CIV) cards.
The same technology can now be extended to mobile devices through derived PIV credentials – a process of taking the secure and verified PIV standard and applying it to mobile devices. This standard helps alleviate many of the vulnerabilities that are especially prevalent in the mobile environment and that are often poorly protected by users who recycle the same passwords across many personal and professional accounts.
One of the best methods for protecting these devices is to use a secure keystore. As the ‘black box’ of security certificates and verifications for mobile devices, the secure keystore holds cryptographic keys that are tamper resistant and unique to each device. This is the same principle as the smartcard holding identity credentials, but in this case it is embedded in an individual’s mobile device – a smartphone, tablet or laptop – and is derived from the same stringent criteria that was used to issue the employee’s smartcard.
The key to enhancing mobile security is in combining a secure digital identity with a second authentication factor, such as a PIN or fingerprint, to let people use their devices to authenticate themselves for physical and digital access. Two-factor authentication is now widely used in consumer banking and online services, and is becoming an increasingly familiar technology in the United States. Most of these schemes, however, require the user to manually transfer one-time passwords between devices, which is highly inconvenient and still not immune to subversion. However, by using a mobile credential that first authenticates the user (with PIN or biometric) to authorize a cryptographic signature, we now have a viable alternative to passwords that is highly secure as well as convenient and simple to use. This allows agencies to have far greater confidence and control over who is accessing their networks and sensitive data.
If we have learned anything from a multitude of recent high profile cyberattacks, it is that even the largest corporations and government agencies are not safe from hackers. Federal agencies’ old-line approach of keeping employees inside agency buildings and accessing sensitive information from designated terminals isn’t in keeping with today’s mobile society. It is neither practical nor desirable. Strong authentication enables federal agencies to reap security benefits while allowing for a more mobile and flexible federal workforce.