National strategy for identity management nearly done

Strong authentication the 'missing element' in a secure online environment

The administration’s national strategy for identity management is undergoing a final vetting by the agencies that will be implementing it and is expected to be finalized within few months, Ari Schwartz, senior Internet policy advisor for the National Institute of Standards and Technology said Thursday.

“We expect the strategy to be signed by the president sometime this winter,” Schwartz said at an identity management conference hosted in Washington by TechAmerica.

The National Strategy for Trusted Identities in Cyberspace, released in draft form in June, calls for an interoperable, voluntary scheme for identity verification that enhances both security and privacy of online transactions and is easy to use. The draft has been revised to highlight and strengthen the role of industry in developing the tools and technologies enabling the strategy, Schwartz said.

Related coverage:

A more perfect union of ID management schemes

“The importance of the private sector cannot overstated,” he said. “The private sector will ultimately determine the success or failure of the strategy.”

The private sector already is at work on the development of technical standards to support wide scale, interoperable identity verification with high assurance.

“We have already agreed” that the standards will be compatible with existing government standards for identity management, said Dan Combs, CEO of the eCitizen Foundation. Those standards include Homeland Security Presidential Directive 12, which mandated the governmentwide Personal Identity Verification Card, and NIST’s Electronic Authentication Guideline, Special Publication 800-63, which is being updated.

Combs is chairing a drafting committee established by the North American Security Products Organization, a certified standards development organization of the American National Standards Institute. The committee will hold its first meeting in January.

The national strategy is one of the recommendations resulting from the Cyberspace Policy Review ordered by the president upon taking office. The draft strategy noted that “a secure cyberspace is critical to the health of our economy” and that improving the level of trust in online ID authentication is a “key step in reducing online fraud and identity theft.” The goal of the strategy is to provide a secure, efficient, easy-to-use and interoperable solution for accessing online services.

Schwartz said that although wide adoption of such a scheme is needed, the government will not mandate that citizens obtain the digital credentials or that companies require their use by consumers. He described the government’s role as a convener that will support private-sector efforts in developing and fielding the needed technologies.

Schwartz said details of a program management office will be announced with or shortly after the release of the strategy. An implementation roadmap for the strategy also will be released. The president will designate a lead agency for the program, which will work with the White House Office of the Cybersecurity Coordinator in interagency policy development specified in the plan.

Phil Reitenger, deputy undersecretary for the Homeland Security Department’s National Protection and Programs Directorate, called strong authentication for devices, software and people the missing element needed for a secure online environment.

"The current ecosystem was not designed to support the dependency we have and respond to the threats we face,” he said. “Nothing is more important” than the trusted identities program in correcting this.

One non-technical area in which work is needed to ensure a workable ID management scheme across organizations is a legal framework, said Thomas Smedinghoff, a partner at Harold, Allen & Dixon.

“The legal status quo is a major barrier to identity management,” he said. The current legal framework was not developed for a digital environment, and is ambiguous and inconsistent, he said. That does not necessarily mean that Congress will have to become involved in implementing the strategy, however; at least in the near term.

“It is easier if you just have a law or a regulation,” to clarify issues, Smedinghoff said. But getting legislative agreement on a set of rules is difficult, and it inhibits flexibility down the road. He said he that questions initially would probably be settled through the development of contractual language and court decisions.

About the Author

William Jackson is a Maryland-based freelance writer.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Sat, Nov 6, 2010 Jeffrey A. Williams Frisco Texas

I would say that it is not strong authentication that is the main missing element here, but rather that strong encryption is missing. NIST's standard of 256k key size is too weak as 1024k has already been broken at the University of Michigan. Ergo this refrenced document is more about well worded positive marketing jargon than about fact.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group