The challenge of identity and access management

Today, 64 percent of U.S. federal government IT leaders view identity management solutions as critical to addressing agencies’ increased cybersecurity threats, according to a Unisys-sponsored survey. As identity and access management becomes increasingly important to protect against outsider cyber threats and ensure that the right users have access to the right information, it is clear that effective IAM faces several challenges.

Proper IAM is necessary for ensuring that federal employees have access pertinent data, systems and facilities and that agencies are not compromised by external actors. As traditional identifiers like Social Security numbers become outdated and easily compromised, personal, business and government data is increasingly at risk. Here’s a look at some of the more significant IAM challenges in the government sector:

1. Prevalence of and easy access to personal data. Many personal profiles on social media leave little to be revealed; email addresses and phone numbers are accessible with the click of a button. The same can be said for previously secured forms of ID, such as Social Security numbers and date of birth, which are sometimes sent carelessly via email. Cybercriminals not only easily steal this kind of information but also set up businesses on the black market where personal information is offered for sale, for as little as a dollar.

2. Password reuse. Due to the prevalence of outside threats, passwords have become essential to holding and managing any account online. Private, public and federal institutions continue to rely on online accounts to complete critical business functions, requiring users to create numerous passwords. However, as users tend to use the same password for different accounts, if one account is compromised, others can be easily compromised as well.

3, Multifactor authentication. While multifactor authentication can be effective, it is far from user friendly. Government employees or contractors who require access to multiple networks and systems often are required to carry a separate access card or RSA token, which can be burdensome and difficult to manage – to the point that some users opt to aim a webcam at their RSA tokens. Multifactor authentication is also not foolproof and is often used for high-value applications, making them a target for sophisticated hackers who are well aware of the potential benefits to be reaped.

4. Cloud applications. The use of cloud-based applications has grown substantially, enabling a global, interconnected workforce powered by cloud technology. However, when several different cloud systems are used, it becomes challenging to determine whether the correct people have access to information. This can leave valuable, classified information up for grabs and agencies vulnerable to hacks.

5. Lack of a centralized, authoritative IAM repository. Every enterprise needs visibility into all aspects of IAM, yet many lack a centralized database to effectively manage and secure user identities and data infrastructures. Conversely, as centralized IAM databases are extremely high-value targets to attackers, management must calculate the potential risks of centralizing critical data so appropriate countermeasures can be implemented. A security system that ensures automated activity monitoring and audit reporting could close the loop on potential security issues. An enterprisewide centralized database security system -- with its inherently protective, detective and corrective controls -- can be part of defense-in-depth security system.

What’s the solution?

Good IAM means seamlessly controlling access and rights for every user on the network. While many agencies may have IAM best practices in place, they are only effective if they are strictly followed across the organization. Unchecked or mismanaged exceptions and exemptions to IAM policies and rules are most common reasons for compromised data. While multifactor authentication will eventually become ubiquitous, those who implement it will constantly have to balance security compliance and operational flexibility.

We can hope that as technologies such as biometric access, blockchain, tokenization and automated real-time alerts and notifications continue to evolve, government agencies will leverage these new capabilities to more effectively balance the challenge of security and convenience. On the one hand, users are demanding more control of their identities, and a decentralized digital ledger like blockchain can grant that control by requiring minimal information for every transaction that requires authorization. On the other hand, a biometric-based solution such as the Department of Homeland Security’s Homeland Advanced Recognition Technology centralizes a wealth of sensitive data, but it also becomes a significant target for malicious actors. Additionally, a multimodal biometric solution also calls into question the constitutionality of such a capability with respect to privacy.   

There have been many attempts in recent years to develop a truly secure IAM solution, both in terms of technical solutions as well as policies and regulation – from the European Union's General Data Protection Regulation to the National Institute of Standards and Technology Special Publications 800 series. While there have been rapid advances in technology, some of those same breakthroughs are the reason that IAM solutions have failed in the past and must continue to evolve. Agencies must incorporate IAM into their overall modernization roadmap -- ensuring that today’s secure solution is still secure tomorrow. With additional advances within reach, such as quantum computing, it’s critical that agencies start planning for those advances and adjusting their IAM strategy now.