5 reasons federal agencies are so challenged by identity and access management

The problems surrounding IAM are not specific to the public sector, but they have a critical impact on government.

two-factor authentication (Sentavio/Shutterstock.com)

Today, about 64 percent of U.S. federal government IT leaders view identity management solutions as critical to addressing the increased cybersecurity threats to agencies, according to a recent survey. As identity and access management becomes increasingly important to protect against outsider cyber threats and ensure that the right users have access to the right information, it is clear that effective IAM faces several challenges.

While the problems surrounding IAM are not specific to the public sector, they have a critical impact on government. Proper IAM is necessary for federal employees to access pertinent data, systems, and facilities and ensure that agencies are not compromised by external actors. As traditional identifiers like Social Security numbers become outdated and easily compromised, personal, business and federal data becomes increasingly at risk. Here's a look at some of the specific IAM challenges in the federal sector:

1. Prevalence of and easy access to personal data

Many personal profiles on social media leave little hidden; email addresses, phone numbers, and date of birth are accessible with the click of a button. The same can be said for previously secured forms of ID, such as Social Security numbers and date of birth, which are sometimes sent carelessly via email. Personal data can be easily compromised by hackers and used to gain access to confidential systems. Cybercriminals not only steal this kind of information but also set up businesses on the black market where personal information is offered for sale, for as little as a dollar per SSN.

2. Volume of applications and resources that require users to remember a username and password -- which leads to using the same password

Due to the prevalence of outside threats, passwords have become essential to holding and managing any account online. Organizations, companies and the federal government all continue to rely on online accounts to complete critical functions like human resources, finance, and contract management. This puts individuals in the position of creating numerous passwords. According to a 2017 study by Digital Guardian, 70 percent of respondents reported having more than 10 password-protected online accounts, resulting in password overload. Users often tire of remembering various passwords for different accounts and instead choose the same password for multiple accounts; if one account is compromised, others can be easily compromised as well.

3. Multi-factor authentication -- often effective, but not user friendly

This creative form of identity proofing can be effective, but it is far from user friendly and is often viewed by users as unnecessarily time consuming. For federal employees or contractors who require access to multiple networks and systems, they are often required to carry a separate access card or RSA token, which can be burdensome and difficult to manage -- to the point that some users opt to aim a webcam at all of their RSA tokens. Multi-factor authentication is also not foolproof, as it can still be compromised by sophisticated efforts from hackers. And multifactor authentication is often used by high-value applications, making them a target for hackers who are well aware of the potential benefits to be reaped.

4. Challenges introduced via cloud

The use of cloud applications has grown substantially by organizations and the federal section alike, as employees streamline their work, and organizations can improve efficiency and reduce costs. Workforces can now be spread all over the world due to the interconnectivity enabled by cloud technology and programming; however, this makes it increasingly difficult to maintain security, and when several different cloud systems are used, it becomes challenging to determine whether the correct people have access to information. This can leave valuable, classified information up for grabs and companies unprotected from hacks. Additionally, inadequate security by a vendor or third-party network can put data at risk.

5. Common lack of a centralized, authoritative IAM repository

Every enterprise needs visibility into all aspects of IAM, yet many lack a centralized database for effective management and security of user identities and data infrastructures. Conversely, any centralized IAM database containing data secrets (e.g. confidential customer contact database, private keys, passwords, etc.) is an extremely high-value target for attackers. So it's critical that as part of standing up a centralized repository, management analyze risks to calculate the potential impact of centralizing critical data so appropriate countermeasures can be implemented. A security system that ensures automated activity monitoring and audit reporting needs could close the loop on potential security issues. An enterprise-wide centralized database security system is part of defense in-depth security system, using inherently protective, detective and corrective controls.

What's the solution?

In our increasingly sophisticated digital world; AI technologies such as machine learning, natural language processing, big data and analytics, data mining, automation and the internet of things are delivering significant results. It is critical that the right people have access to the right information, and good IAM means seamlessly controlling access and rights for every user on the network regardless of time, space, or place.

While many organizations may have IAM best practices in place, those practices and procedures are only effective if they are adhered to across the organization. Unchecked or mismanaged exceptions and exemptions to IAM policies and rules are most commonly the reasons for compromised data. While multi-factor authentication will eventually become ubiquitous in federal and commercial organizations alike, those who implement the requirements will constantly have to balance between security compliance and operational flexibility.

What we can hope is that as technologies such as token-based biometric access, blockchain, tokenization, and automation through real-time alerts and notifications will continue to evolve and take root, federal agencies will leverage new capabilities to more effectively balance the challenge of security and convenience. On the one hand, users are demanding more control of their identities -- and as a decentralized digital ledger, blockchain can grant that control by requiring minimal information for every transaction that requires authorization. On the other hand, a biometric-based solution such as DHS's Homeland Advanced Recognition Technology (HART), centralizes a wealth of sensitive data, but also makes it a significant target for malicious actors. Biometric info might be more difficult to use if stolen, it's still plausible, and a biometric solution also calls into question the constitutionality of such a capability with respect to privacy.

While there's plenty of new tech evolving that can help with IAM, it's important not to just leverage the benefits of those advances, but also keep up with best practices and employ some of the less expensive, yet often effective best practices. Automation, for example, can be used to de-provision user accounts across all enterprise applications when a user departs the organization. An effective IAM solution requires balance -- making the process and procedures manageable for those responsible, and making it reliable, secure and easy for the end users.

There have been many attempts in recent years to develop a truly secure IAM solution, both in terms of technical solutions as well as policies and regulation -- from European Union's General Data Protection Regulation to the NIST Special Publications 800 series. While there have been rapid advances in technology, some of those same breakthroughs are the reason that IAM solutions have failed in the past and must continue to evolve. Federal agencies need to incorporate IAM into their overall modernization roadmap -- ensuring that today's secure solution is still secure tomorrow. With additional advances, such as quantum computing, within reach, it's critical that agencies start planning for those advances and adjusting their IAM strategy now.

NEXT STORY: Quick hits: Aug. 31

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.