The Future of Federal Identity Management

1. www.idmanagement.gov The Future of Federal Identity Management Judith Spencer Agency Expert - IDM Office of Governmentwide Policy GSA Judith.Spencer@GSA.Gov

2. What is ICAM? ICAM represents the intersection of digital identities, credentials, and access control into one comprehensive approach. Key ICAM Service Areas Include: Digital Identity Credentialing Privilege Management Authentication Authorization & Access Cryptography Auditing and Reporting

3. ICAM Drivers • Increasing Cybersecurity threats • There is no National, International, Industry “standard” approach to individual identity on the network. (CyberSecurity Policy Review) • Security weaknesses found across agencies included the areas of user identification and authentication, encryption of sensitive data, logging and auditing, and physical access (GAO-09-701T) • Need for improved physical security • Lag in providing government services electronically • Vulnerability of Personally Identifiable Information (PII) • Lack of interoperability • “The ICAM segment architecture will serve as an important tool for providing awareness to external mission partners and drive the development and implementation of interoperable solutions.” (President’s FY2010 Budget) • High costs for duplicative processes and data management

4. ICAM Scope Persons Non-Persons Logical Access Physical Access

5. FICAM Development Process • The development process involves coordination and collaboration with Federal Agencies, industry partners, and cross-government working groups. • The Roadmap team identified the key outputs of the Federal Segment Architecture Methodology (FSAM) needed for an ICAM segment architecture and coordinated these groups to develop workable approaches to enable cross-government solutions. • Interagency Security Committee (ISC) • Information Sharing Environment (ISE) • White House National Science and Technology Council (NSTC) • Committee for National Security Systems (CNSS) • Office of Management and Budget • National Institute of Standards and Technology (NIST) • Office of National Coordinator (ONC) for Health IT • Multiple agencies represented within the CIO council subcommittees and working groups

6. Components of the ICAM Segment Architecture

7. ICAM Goals and Objectives The Federal ICAM Roadmap addresses unclassified federal identity, credential, and access management programsand demonstrates the importance of implementing the ICAM segment architecture in support five overarching strategic goals and their related objectives.

8. Eleven Use Cases Covering:

9. Measuring Success

10. On-Going Activities PIV Interoperability: Defining the parameters for an industry smart card that emulates the PIV credential FIPS 201 is limited to the Federal community External interoperability/trust is achievable Trust Framework Providers and Scheme Adoption Non-cryptographic solutions at lower levels of assurance Industry self-regulation with government recognition Working with Open Solutions to enable open government Federal PIV deployment exceeds 70% LACS deployment beginning PACS demonstration system operational

11. Increasing the Trusted Credential Community Back to Basics – M-04-04 and NIST 800-63 are still the foundational policy/technical guidance for identity management in the Federal government. Establish unified architecture for Identity Management Expand our use of Assertion-based solutions (Levels 1&2) Stronger industry alignment for trust and technology standards Federal Bridge interoperability will continue to play a role at Levels 3 & 4 Outreach to communities of interest Explore natural affinities

12. Assurance Levels Level 1 Level 2 Level 3 Level 4 Little or no confidence in asserted identity Some confidence in asserted identity High confidence in asserted identity Very high confidence in the asserted identity M-04-04:E-Authentication Guidance for Federal Agencies OMB Guidance establishes 4 authentication assurance levels On-line with out-of-band verification for qualification Cryptographic solution Self-assertion minimum records In person proofing Record a biometric Cryptographic Solution Hardware Token On-line, instant qualification – out-of-band follow-up Assertion-based Crypto-based

13. Maximum Potential Impacts

14. Goals Leverage Industry credentials for Government use Make Government more transparent to the Public Make it easier for American Public to access government information Avoid issuance of application-specific credentials Leverage Web 2.0 technologies Demonstrate feasibility with application(s) assessed at Assurance Level 1 Support applications at higher assurance levels as appropriate

15. Enabling e-Government Business Process Redesign will result in standardized interfaces for logical access Streamlined access control/provisioning Well-understood Federated trust at multiple levels of assurance Level 4 will require PIV-I Levels 1-3 will recognize multiple solutions/identity schemes • Greater trust in external credential validity • Repeatable process

16. Identity and Access Management Are Foundational to Information Sharing and Collaboration First release of Trust Framework Provider Approval Process and Identity Scheme Adoption Process available for public review www.idmanagement.gov Industry Partners are Fielding Identity Credentials as well as Creating Federations for Sharing & Collaboration Open ID Foundation infoCard Foundation InCommon Federation Progress Depends on Public-Private Partnering Summary 16