NS-TIC

A new theory of digital identity - Risk - SC Magazine Australia

The March 14, 2012, edition of SC Magazine, Australian Edition, includes Part B of a two part series on “A New Theory of Digital Identity.”  Part A was entitled “Federated Identity: Easier said than done.”  Part B is entitled, “The Ecology and Natural History of Digital Identity,” and includes this view of the U.S. National Strategy for Trusted Identities in Cyberspace:

Truthfully, the ecosystem anticipated by The Laws of Identity and the National Strategy for Trusted Identities in Cyberspace (NSTIC; see http://www.nist.gov/nstic) is an elaborate IT architecture with predefined and often novel roles for all players. At the time of writing, NSTIC is far from complete, with many anticipating that special new legislation will be needed to allocate liability when using privately issued identities. Nobody yet knows if the system is sustainable by the private sector. The prefix “eco” is optimistic.

I think that is correct.

The entire article can be read at: A new theory of digital identity - Risk - SC Magazine Australia - Secure Business Intelligence .

NSTIC commits $2.5 million to build governance body | ZDNet

ZDNet reports on March 14, 2012, that the National Institute of Standards of Technology is offering grant money “to establish an independent steering committee led by the private sector that works in conjunction with the federal government to support” the National Strategy for Trusted Identities in Cyberspace, quoting  Jeremy Grant, senior executive adviser for identity management at NIST and the head of NSTIC Program Office.  According to the ZDNet:

The government’s national identity strategy is committing up to $2.5 million over the next two years to fund an organization that will establish and oversee a steering committee that is the linchpin to securing private- sector participation in its plan.

The full article from ZDNet can be found at: NSTIC commits $2.5 million to build governance body | ZDNet . The NIST’s “RECOMMENDATIONS FOR ESTABLISHING AN IDENTITY ECOSYSTEM  GOVERNANCE STRUCTURE,” dated February of 2012, are available in PDF format at http://www.nist.gov/nstic/2012-nstic-governance-recs.pdf . 

Your Online Driver’s License: NYT

On September 17th, 2011, Natasha Singer wrote for the New York Times about the National Strategy for Trusted Identities in Cyberspace (NSTIC).  Comparing NSTIC to a digital driver's license, Singer explained how NSTIC would make it so people have a simpler, safer way to prove who they are online with more than a flimsy password.  To do so, consumers would choose among trusted third parties — such as banks, technology companies or cellphone service providers — that verify certain personal information about them and issue them secure credentials to use in online transactions.  The system would allow Internet users to use the same secure credential on many Web sites; people could have their identity authenticator automatically confirm that they are old enough to sign up for Pandora without having to share their birthdate with Pandora.

However, authentication proponents and privacy advocates disagree about whether Internet IDs like NSTIC would actually heighten consumer protection.  Privacy advocates argue that identity verification online could make consumers more vulnerable because authentication companies would become "honey pots for hackers."  Lillie Coney, the associate director of the Electronic Privacy Information Center, noted that “You can have one key that opens every lock for everything you might need online in your daily life, or, would you rather have a key ring that would allow you to open some things but not others?”

However, Jeremy Grant (senior executive adviser for identity management at the National Institute of Standards and Technology) noted that no system is invulnerable.  Privacy concerns aside, better online identity authentication would improve the current situation where people use the same passwords for their e-mail, banking, and social network accounts.  Mr. Grant went on to compare weak security to flimsly locks on bathroom doors: “If we can get everyone to use a strong deadbolt instead of a flimsy bathroom door lock, you significantly improve the kind of security we have.”

The source article can be found here.

US could learn from Canadian identity management initiative: Network World

On September 2, 2011, Dave Keams wrote for Network World that the United States could learn a great deal from Canada's identity management initiative.  Mr. Keams argues that the Canadian initiative is smaller and more focused than the U.S. NSTIC initiative because it concentrates on government and citizen interactions. The US and Canadian ideas are generally the same, but differ in scale. 

The Canadian Treasury Board of Canada Secretariat recently released the final version of a document called "Federating Identity Management in the Government of Canada: A Backgrounder." It notes, "How identity information is collected, used, managed, and secured is of critical interest to leaders in the public sector charged with protecting the rights of citizens, ensuring privacy, and ensuring national security and public safety."

The study also sets out what it calls "Guiding principles for federating identity management":

• Achieve consensus through accepted, mutually respected assurances (of credential or identity), risk levels, and accountabilities.

• Respect program accountability.

• Let the citizen decide.

• Enable interoperability.

• Promote a fair and competitive marketplace.

Mr. Keams argues that  NSTIC should abide by these principles.

The Network World article can be found here.

***

 

Naming Names on the Internet: New York Times

On September 4th, 2011, Eric Pfanner wrote for the New York Times on a new twist in the internet anonymity debate: real name policies.  Real name policies require web users to provide their real names in order to post on websites.  The article mentions how South Korea enacted a real name policy in response to the suicide of a popular actress who had been bullied via the internet.  However, the South Korean government decided to abandon the policy after hackers stole 35 million user's identification data (which they had been required to supply in order to verify their identities).

However, the article notes that there have been growing calls for restrictions on Internet anonymity.  Specifically, German Interior Minister Hans-Peter Friedrick cited the case of Norwegian terrorist suspect Anders Behrig Breivik who had blogged under the user name "Fjordman."  Furthermore, Google executive chairman Eric E. Schmidt told a media conference in Edinburgh that “The Internet would be better if we had an accurate notion that you were a real person as opposed to a dog, or a fake person, or a spammer.”

However, Mr. Pfanner goes on to argue that, all in all, real name policies are a lousy idea.  Online anonymity is essential for political dissidents and corporate whistle-blowers; real name policies would severely limit that anonymity.  Further, although cyberbullying and online death threats are an unwanted byproduct of internet anonymity, arrests made of members of the notorious hacking ring Anonymous demonstrates that authorities already have tools for rooting out anonymous trolls when they really want to.

In the end, Mr. Pfanner points out that "The real world is often messy, chaotic and anonymous. The Internet is mostly better that way, too."

The source article can be found here.

NSTIC Identity Commandments handed down

The Jericho Forum, an IT security association dedicated to advancing secure business in a global open-network environment, recently handed down their "Identity Commandments" for the planning of an identity eco-system.   

In a Jericho Forum press release, Lord Eroll commented that “Jericho Forum builds on the work of NSTIC by providing an effective direction going forward.   The creation of a large centralized database containing key identifiers and information is far too dangerous. The private sector must avoid the Big Brother approach proposed in the now abandoned UK national ID card scheme. In the Jericho Forum Identity Commandments, ownership of essential personal data stays with the individual and cannot be compromised or exploited by any powerful player.”

The new Commandments "encompass all the “entities” – both human and digital – and promotes a comprehensive and complete view of identity entitlement and access management."    They are:

1. All core identities must be protected to ensure their secrecy and integrity.

2. Identifiers must be able to be trusted.

3. The authoritative source of identity will be the unique identifier or credentials offered by the persona representing that entity.

4. An Entity can have multiple, separate Persona (Identities) and related unique identifiers.

5. Persona must, in specific use cases, be able to be seen as the same.

6. The attribute owner is responsible for the protection and appropriate disclosure of the attribute.

7. Connecting attributes to persona must be simple and verifiable.

8. The source of the attribute should be as close to the authoritative source as possible.

9. A resource owner must define Entitlement (Resource Access Rules).

10. Access decisions must be relevant, valid and bi-directional.

11. Users of an entity’s attributes are accountable for protecting the attributes.

12. Principals can delegate authority to another to act on behalf of a persona.

13. Authorised Principals may acquire access to (seize) another entity’s persona.

14. A persona may represent, or be represented by, more than one entity.

The report concludes that a new identity eco-system holds the triple promise of "lower cost, higher security/trust, and increased flexibility" and will positively impact how the world innovates and trades.  However, the Jericho Forum believes that there is a major infastructure investment required to create the identity eco-system. 

***

See the bottom of the Commandments for a glossary/defined terms; the definitions can be a bit tricky.

 

The Password is Dead. Time for Better Online Security.

Forbes reported on the recent release of the National Strategy for Trusted Identities in Cyberspace in an article by Kashmir Hill dated April 15, 2011.  The article provides a great understanding of what the NSTIC aims to accomplish and why it was necessary in the first place.

Essentially, the days of the username and password are dead, and, according to Commerce Secretary Gary Locke, the time has come to "'create a more secure online environment.'"  During a recent event at the U.S. Chamber of Commerce, Secretary Locke was trying to dispel conspiracy theorists' claims that the NSTIC is really a national online ID system.  Although government-sponsored, the NSTIC "is intended to be led by industry."  

In a nutshell, "the more places you keep a username and password, the more opportunities hackers have to break in and crack your system.  Of course, you want to make sure that your main identity authenticators are secure ones. . . . "  The rub with the NSTIC is that "industry" includes Facebook, Google, and JPMorgan Chase (i.e. several business with different missions and priorities).  As Leslie Harris, of the Center for Democracy and Technology recenlty put it, putting the NSTIC into practice will require a "'spray bottle of water and a lot of cat nip' as it will be like herding cats."  

***

 

Let's hope not.  

 

 

For the entire article from Forbes, follow the link above, or click here.   

 

When Do People Care Who You Are Online?

In an article dated April 1, 2011, Jessica Herrera-Flanigan, of nextgov, reports on the pitfalls of a "federated authentication" system, which were recently highlighted by Ross Anderson,  a professor of Security Engineering at Cambridge University.

Professor Anderson recenlty published a paper entitled "Can we Fix the Security Economic of Federated Authentication?" in which he brings to light two concerns associated with federated authentication.  Firstly, "not all authentications need the same level of assurance," and, to paraphrase the second, the liability associated with getting authentication wrong drives the level of investment made in order to get it right.  

To illustrate the first point, Ms. Herrera-Flanigan points out that "The New York Times online [is not] that concerned (relatively speaking) about me circumventing the newspaper's authentication system [by posing as a friend with an account in order to] post snarky comments about New Jersey in his name."  On the other hand, if Ms. Herrera-Flanigan had that same friend's bank account information, including his log-on identification and password, and used that information to transfer funds from his account, "then concerns about authentication are rightly elevated."  

With regard to the second point raised by Professor Anderson, Ms. Ferrera-Flanigan poses the following question:  ". . . in a federated identity framework, which identity provider makes [the necessary] investments?"  It makes sense for banks to invest heaily in identity authentication because, as illustrated above, the costs of getting authentication wrong could be devestating.  Does it follow then that Facebook should have to bear a portion of that expense when it doesn't require similar assurances of accuracy?  If not, is the banking industry likely to share their assurance technology with other industries for free?  The answer to both questions is, of course, no.

Thus, as the Obama Administration's National Strategy for Trusted Identities in Cyberspace (NS-TIC) notes:

"To date, the appropriate apportionment of liability has prevented the cross-sector issuance and acceptance of identity credentials. The federal government must address this barrier through liability reform in order to establish the multi-directional trust required by transaction participants. The identity ecosystem promotes models that mitigate liability to an acceptable level relative to the benefits associated with participation in the ecosystem."

According to Ms. Herrera-Flanigan, the NS-TIC has the right framework in mind.  The issue moving forward is "how do we implement operational solutions?"   Additionally, she poses this question, which gets at the heart of reform, "what threshold of liability will participants and users be able to bear before questioning any significant reform?"

 

Ms. Herrera-Flanigan's full article can be found at the link above, or here.  Additionally, Professor Anderson's paper, "Can we Fix the Security Economic of Federated Authentication?" is available at the link provided above, or here. 

 

Editorial: Obama and the Internet Pharaoh

In an editorial appearing in the Washington Times on February 4, 2011, the writer criticizes the Obama Administration's National Strategy for Trusted Identities in Cyberspace ("NS-TIC"), as well as the federal government overall for recent attempts to grant "a White House cyberczar [what the writer calls] Mubarak-like power to declare an emergency and issue directives to any private companies deemed . . . critical by government."

The writer points out that private companies are better suited to guard the Internet, as they "have more of an incentive to preserve their billion-dollar investments than '9 to 5' bureaucrats with guaranteed lifetime employment."  And, in reference to Egypt's temporary Internet shut-down, the writer notes that these "clumsy censorship attempts were bypassed with proxy severs and other simple workarounds."

With regard to the NS-TIC, the writer argues that despite assurances from administration officials that the NS-TIC will not operate as a national ID system, "any government involvement in identity management or security on the Internet is a bad idea.  Big-government types can't resist the urge to control things they feel are currently beyond thier grasp. . . . The temptation to squelch inconvenient speech is too great; no political should ever be given a button to silence the Internet."

 

****

 

The entire editorial piece can be found at the link provided above, or here.   

 

Negotiations Over New Zealand's IGovt Identity Plan

Tom Pullar-Strecker, of Stuff.Co.NZ, an online news agency, reports in an article published February 7, 2011, that the New Zealand Government is working with NZ Post (New Zealand's postal service) "to promote its $122 million iGovt identity system, which may now be mirrored in the United States by the Obama Administration."  Internal Affairs - the Government's go-to agency for iGovt - is currently negotiating with NZ Post to produce a final system "'that maintains the high level of public confidence and trust in the way people's information is managed by the Government.'" 

Under New Zealand's iGovt system, people enroll in the voluntary system by visiting a "post shop to be digitally photographed and have their credentials checked . . . and obtain a password and logon." According to the article, users will also either register their mobile phone so that "a code could be texted to them whenver they wanted to access a secure service online," or they would be issued a "hardware token" similar to those already used by many banks.  

In 2009, the New Zealand Government ordered Internal Affairs to reach out to the private sector for "energy and ideas."  At that same time, the Government forecasted that iGovt would produce benefits between $641 million and $1.37 billion over then next ten years. 

The news article draws the obvious parallel to the Obama Administration's National Strategy for Trusted Identities in Cyberspace, which was recently championed by U.S. Commerce Secretary Gary Locke as "'[a system] enhancing online security and privacy, and reducing and perhaps even eliminating the need to memorize a dozen passwords, through creation and use of more trusted digital identities.'"

In 2009, when New Zealand's Internal Affairs reached out to the private sector, of the issues and concerns raised by private businesses were "whether the Government would be liable if [the private sector] relied on iGovt to authenticate someone's identity and later found they had been defrauded."  According to the news article, "[o]fficials indicated that was unlikely."

 

****

 

The entire news article from Stuff.Co.NZ can be found at the link provided above, or here.  Here is a link to New Zealand's iGovt site for further details.