Market Trends

[return to top of this report]

PIV Interoperability for Non-Federal Card Issuers

As PIV initiatives progress, they are garnering a great deal of interest from parties
external to the Federal Government. These non-Federal organizations want to
issue identity cards that are:

• Technically interoperable with Federal Government PIV systems.
• Issued in a manner that allows Federal Government-relying parties to trust the cards.

Unfortunately, the Federal PIV card standard (FIPS 201) is limited in scope to the
Federal Government and has several requirements
that can be addressed only by the Federal Government community.

To assist non-Federal issuers of identity cards in achieving
interoperability with Federal Government PIV systems, in May 2009, the Federal
CIO Council issued guidance to non-Federal card issuers via a document entitled
"Personal Identity Verification Interoperability For Non-Federal Issuers."

Version 1.1 of the guide was issued in July 2010.

FIPS 201-2

A new version of the FIPS 201 document (FIPS 201-2) was issued in August
2013 by the US National Institute of Standards and Technology (NIST).¹ This
new standard mandates the implementation of some PIV Card features that were
optional in FIPS 201-1.

Among other new features, the FIPS 201-2 standard:

• Makes the facial image data element on the PIV Card mandatory, allowing
  a FIPS 201-2 PIV Card to be used for identification at guard checkpoints, and for automatic
  comparison when reissuing an individual’s credentials.²
• Adds
  an option to collect and store iris biometric data on the PIV Card.
• Introduces the concept of a
  "chain-of-trust", which is optionally maintained by a PIV Card issuer.
  The chain-of-trust allows the holder of a PIV Card to obtain a replacement for a compromised, lost, stolen, or
  damaged PIV Card through biometric authentication.
• Changes the maximum life of
  a PIV Card from 5 years to 6 years.
• Adds an optional on-card biometric comparison as a means of performing card activation, and as a PIV authentication mechanism.

Strategic Planning Implications

[return to top of this report]

Smart
cards provide a convenient, affordable, and robust means to protect
public- and private-sector
data and facilities. Smart cards offer:

• Secure
  Logon – Protecting access to computer systems and data within facilities
  typically relies on user passwords, group membership and a complex
  hierarchy of administrator permissions. Passwords are the weak link, and
  in large organizations can never be assumed to be completely
  uncompromised. Two factor or biometric identification at logon defeats
  password hackers.
• Remote
  Authentication – Remote users can compromise the most meticulously structured
  data security by logging on over networks (e.g. the web, public wireless
  hotspots, etc.) that allow their passwords to be transmitted as clear
  text. Remote smart card logon allows users’ ID, password, and
  certificates to be stored in encrypted format on the card, and never
  transmitted.
• Offline
  Functionality – High end cards feature embedded functionality that allows them to
  participate in computing applications without live network connection.
  The cards can store results, data, and logs of their activity for later
  download.
• Strong
  Encryption – High security cards support RSA and PKI encryption standards. This makes
  them very difficult to hack and prevents card holders from
  surreptitiously downloading enterprise data to unauthorized systems.
• Auditability – Biometric enabled smart
  card access control systems create unimpeachable records of access to
  physical and logical enterprise assets by specific individuals. The certainty
  of detection is the best possible deterrent to unauthorized access.
• Protection Against Loss, Theft and Fraud – Because smart cards contain embedded intelligence,
  they can be programmed to lock down or wipe themselves of data if used improperly
  or reported missing.

Looking Ahead

Unlike many breakthrough
technologies, initiating small scale, incremental, enterprise
proof-of-concept programs for smart card applications can be both low cost
and low risk. If you are an enterprise IT decision maker, you should at the
very least consider pilot projects involving the following smart card
applications:

• Biometric
  access control and monitoring for computer rooms, network facilities and
  offline data storage areas.
• Biometric
  authentication before users are allowed to log in as system
  administrators, network administrators or database administrators.
• Use of
  encrypted smart cards to store data on all mobile computing devices.
• Development
  or use of smart card applications which lock down or wipe devices known
  to be lost, stolen or involved in fraudulent transactions.

NSTIC

The National Strategy for Trusted Identities in
Cyberspace (NSTIC) is a White House initiative to work collaboratively with the
private sector, advocacy groups, public sector agencies, and other organizations
to improve the privacy, security, and convenience of sensitive online
transactions. The Strategy calls for the development of interoperable
technology standards and policies – an

"Identity Ecosystem" – where individuals, organizations, and underlying
infrastructure can be authoritatively authenticated.

Establishment of an Identity Ecosystem would
allow individuals to validate their identities securely when they’re doing
sensitive transactions (like banking or viewing health records) and let them
stay anonymous when they’re not (like blogging or surfing the Web). The
Identity Ecosystem would protect the privacy of individuals by reducing the need
for individuals to share personally identifiable information (PII) in order to
identify themselves at multiple web sites and by establishing consistent
policies about how organizations use and manage PII in the Identity Ecosystem.
Smart cards – and smart card technology – should figure prominently in The
Identity Ecosystem.

References

• ¹ FIPS PUB 201-2: "Personal Identity Verification (PIV) of
  Federal Employees
  and Contractors." US National Institute of Standards and Technology. August
  2013:75-76.
• ² Zack Martin. "NIST releases FIPS 201-2." AVISIAN Publishing. September
  5, 2013.

Web Links

[return to top of this report]

• Gemalto: http://www.gemalto.com/
• Oberthur Technologies: http://www.oberthur.com/
• Smart Card Alliance: http://www.smartcardalliance.com/
• US National Institute of Standards and Technology: http://www.nist.gov/

About the Author

[return to top of this report]

James G. Barr is a leading business continuity analyst
and business writer with more than 30 years’ IT experience. A member of
"Who’s Who in Finance and Industry," Mr. Barr has designed,
developed, and deployed business continuity plans for a number of Fortune 500
firms. He is the author of several books, including How to Succeed in
Business BY Really Trying, a member of Faulkner’s Advisory Panel, and a
senior editor for Faulkner’s Security Management Practices. Mr.
Barr can be reached via e-mail at jgbarr@faulkner.com.

[return to top of this report]