PIV encryption: The solution to federal email insecurity

Sixteen years after Homeland Security Presidential Directive 12 (HSPD-12) called for the creation of a common, interoperable identification credential for both physical and logical access that would work governmentwide, much has been achieved.

After many years of investment, personal identity verification credentials are now indeed governmentwide, but there is one area where the existing PIV infrastructure is not fully utilized: securing cross-agency email communication.

At a recent webinar, a group of experts in deploying PIV identity and encryption technologies in the federal space, including myself, evaluated the state of email encryption, why it is not being used as it should across agencies and what can be done to make better use of PIV credentials and encryption.

Panelist Jeff Nigriny, president and founder of CertiPath, summed up the group’s consensus opinion on the high return on investment this opportunity offers, stating “If you are a federal security practitioner that has deployed email and high assurance PIV or PIV-I credentials [for non-federal entities that require government-trusted credentials], you are going to see a much higher rate of return from getting these platforms able to do email encryption securely across agencies than time spent almost anywhere else.”

He correctly pointed out that email deserves the focus because it is the No. 1 collaboration tool and the No. 1 tool used to encrypt data, based simply on the sheer volume. Yet it is “a black hole” when it comes to trust across organizations.

While most agencies use PIV credentials and encryption, they generally do not deploy it between agencies and with PIV-I contractors, stated Kyle Neuman, a PKI and cryptography expert and managing director of SAFE Identity, an industry consortium and certification body supporting identity assurance in healthcare.

“And why should they encrypt emails, other than [the Office of Management and Budget] says so?” Neuman asked rhetorically, referring to the 2019 OMB M-19-17 directive advising the use of HSPD-12 PIV encryption.

Neuman supported the email encryption imperative with some impressive stats: 95% of data in email servers consist of file attachments, and 87% of that data comes from senior managers. Perhaps most compelling, 70% of breaches are associated with state or state-affiliated actors involve phishing, and login credentials are often the target for these attacks, he said.

The good news is that PIV can solve these problems. PIV credentials and encryption enable strong identity verification and end-to-end encryption. They ensure that only the intended recipient can read encrypted emails and attachments. And they are endorsed by OMB and the National Institute of Standards and Technology, among others, as one of the most effective ways to protect data.

So, with the federal government's high prioritization of data protection and highly effective PIV credentials and infrastructure already bought, paid for and deployed, why is it not being used extensively to encrypt email communications between agencies?

At a high level, the main challenge is usability. Until now, our industry has not provided a simple solution for certificate discovery -- the matching of PIV identities and digital certificates to people and email addresses -- between federal organizations.

To put this more simply, say John wants to send Alice an encrypted email. If Alice is in the same organization, this is very straightforward. The discovery of Alice's certificate, the assessment of its assurance level and security policy enforcement all basically happen automatically and the emails and attachments are easily encrypted.

Where this breaks down is if Alice is in another agency. John must follow a complex and generally manual process to find the correct certificate for Alice. Even then he may not know if he can trust the assurance level of Alice’s certificate. After all, he is encrypting sensitive information to send to her, so he must ensure that Alice’s certificate accurately represents Alice’s identity.

As a result, most agencies do not use PIV identities and encryption for communications with other entities. They either use less secure options or elect just not to encrypt.

The root of the problem is that the federal PKI fabric consists of many separate certificate authorities. Each certificate authority publishes its encryption certificates in its organization’s own isolated directory. And while the federal PKI fabric provides a way to create a trust relationship between them, it does not provide any way to do certificate discovery.

To solve this problem, the first step is a cross reference, a global encryption directory. Think of this as “white pages” with only two fields, email address and the associated encryption certificates.

While this solves perhaps 80% of the problem, there are also other requirements to make cross-agency email encryption useable and still ensure the right level of protection. We must make trust across multiple agencies’ certificates simple, and that means removing this responsibility from end users. Instead, configuring trust for each agency should be centralized and managed by the agencies administrative staff so that all end users do is click a button if they want to encrypt.

So, with these in place, let us go back to our prior example. In this new scenario, if John wants to send Alice encrypted email, even if Alice is in a different agency, all John needs to do is click the encrypt button in his email app and send. The new system leverages Alice’s PIV identity and encryption can now take place automatically.

Implementing PKI and end-to-end encryption is complex. But with the approach presented here, supported by the latest technologies, it can be made simple.

For the first time, our industry can now solve these challenges and enable federal agencies to use PIV PKI email encryption the way it was intended between agencies and with contractors, further extending the ROI on their PIV and PKI infrastructure investments.

For more details on how to solve the problem of cross-agency PIV credential discovery and encryption, listen to the entire webinar. It also provides information about the risks involved with alternate approaches to email security and encryption that bypass PIV encryption along with recommendations on dealing with the business and law enforcement issues associated with encryption.