April 2017 Digital Edition

Click Here

March 2017 Digital Edition

Click Here

Feb. 2017 Digital Edition

Click Here

January 2017 Digital Edition

Click Here

Nov/Dec 2016 Digital Edition

Click Here

Oct 2016 Digital Edition

Click Here

Technology Sectors

Market Sectors

OPINION / Security convergence: federal government is leading the way with PIV credentials

Chris Broderick

By Chris Broderick
 
Homeland Security Presidential Directive 12 (HSPD-12), is a “policy for a common identification standard for federal employees and contractors,” and was issued on August 24, 2004.  Under the HSPD-12 mandate, all federal employees and contractors must be issued a Personal Identity Verification (PIV) card, a smart card with contact and contactless interfaces to be used as their identity credential.
 
Today more than 3.5 million cards, or over 60 percent of the required total, have been issued.  Notwithstanding some initial delays due to the need to define and set-up processes, such as the ones for vetting card recipients and for card issuance, critical mass has now definitely been reached.
 
Furthermore, earlier this year, the Federal CIO Council released a document on “Personal Identity Verification Interoperability for Non-Federal Issuers.” The document details how non-federal organizations can issue identity cards which are not only technically interoperable with the federal government PIV system, but which can also be issued in a manner that provides federal government relying parties the option to trust the cards.
 
As FIPS 201, the PIV card standard, is limited in scope to the federal government, the guidelines in the above mentioned document are welcome to ensure credentials such as the First Responder Authentication Credential (FRAC), the Transportation Worker Identification Credential (TWIC), or the ones issued by government contractors to achieve interoperability.
 
Although common access card usage used to be considered for logical access to information systems, it is important to note that the HSPD-12 directive also mandates their use for physical access to federal government facilities.
 
However, using the new PIV smart cards with many of the older, installed Physical Access Control Systems (PACS) is not an easy task. Indeed, most of the installed PACS systems are not equipped to function with the certificate infrastructure underlying the PIV system.
 
During 2009, CoreStreet experienced a substantial spike in interest for our FIPS-201 enabling technology, with many PACS manufacturers taking the steps required to make their systems compatible with the new federal access requirements in the long term.  In the meantime, agencies are taking steps to implement solutions to PIV-enable their existing PACS systems with technology which requires some minor changes, but without the need for wholesale rip and replace of the installed base.
 
In fact, in parallel with the Smart Cards in Government conference, the Interagency Advisory Board (IAB) organized a visit to the offices of CertiPath to demonstrate the viability and effectiveness of a single-credential system that can provide secure access for both physical and logical assets, and provide interoperability for employees, customers and partners.  The demo’d federated PACS system, funded in part by the General Services Administration (GSA), which operates the U.S. Federal Bridge, showcased an architecture conforming to the principles of NIST SP 800-116.
 
In summary, 2010 promises to be the year when an initial set of federal employees will enjoy the benefits of security convergence, both at a lower cost and with better overall security, and be able to use a single strong credential (their PIV smart card) not only for logical access to their information systems, but also for practical day-to-day physical access to their facilities.
 
 
Chris Broderick is the CEO of CoreStreet, an ActivIdentity company. He can be reached at: [email protected]

 

Recent Videos

HID Global is opening the door to a new era of security and convenience.  Powered by Seos technology, the HID Mobile Access solution delivers a more secure and convenient way to open doors and gates, access networks and services, and make cashless payments using phones and other mobile devices. ...
Mobile device forensics can make a difference in many investigations, but you need training that teaches you how to get the most out of your mobile forensics hardware and software, and certifies you to testify in court. Read this white paper to learn how to evaluate mobile forensics training...
PureTech Systems is a software company that develops and markets PureActiv, its geospatial analytics solution designed to protect critical perimeters and infrastructure.  Its patented video analytics leverage thermal cameras, radars and other perimeter sensors to detect, geo-locate, classify, and...
PureTech Systems is a technology leader in the use of geospatial video, focusing on perimeter security.  When combining geospatial capabilities with video analytics and PTZ camera control, managers of critical facilities can benefit by allowing the video management system to aid them in the process...