NS-TIC

NSTIC finalists notified: SecureIDNews

On 4/10, SecureIDNews reported that the National Institute of Standards and Technology (NIST) has notified 27 finalists of "grants that would pilot portions of the identity ecosystem for the [NSTIC]."  The article said that the finalists must decide whether to announce their status.  I'll keep my eyes open for any such announcements.  The finalists are likely made up of state and local government agencies, major companies, business start ups, and universities. 

From here, the finalists must submit full proposals to NIST by May 10th.  After that, NIST will choose 5 to 8 proposals that will receive a total of $10 million. 

A bit of background on NSTIC.

A new theory of digital identity - Risk - SC Magazine Australia

The March 14, 2012, edition of SC Magazine, Australian Edition, includes Part B of a two part series on “A New Theory of Digital Identity.”  Part A was entitled “Federated Identity: Easier said than done.”  Part B is entitled, “The Ecology and Natural History of Digital Identity,” and includes this view of the U.S. National Strategy for Trusted Identities in Cyberspace:

Truthfully, the ecosystem anticipated by The Laws of Identity and the National Strategy for Trusted Identities in Cyberspace (NSTIC; see http://www.nist.gov/nstic) is an elaborate IT architecture with predefined and often novel roles for all players. At the time of writing, NSTIC is far from complete, with many anticipating that special new legislation will be needed to allocate liability when using privately issued identities. Nobody yet knows if the system is sustainable by the private sector. The prefix “eco” is optimistic.

I think that is correct.

The entire article can be read at: A new theory of digital identity - Risk - SC Magazine Australia - Secure Business Intelligence .

NSTIC commits $2.5 million to build governance body | ZDNet

ZDNet reports on March 14, 2012, that the National Institute of Standards of Technology is offering grant money “to establish an independent steering committee led by the private sector that works in conjunction with the federal government to support” the National Strategy for Trusted Identities in Cyberspace, quoting  Jeremy Grant, senior executive adviser for identity management at NIST and the head of NSTIC Program Office.  According to the ZDNet:

The government’s national identity strategy is committing up to $2.5 million over the next two years to fund an organization that will establish and oversee a steering committee that is the linchpin to securing private- sector participation in its plan.

The full article from ZDNet can be found at: NSTIC commits $2.5 million to build governance body | ZDNet . The NIST’s “RECOMMENDATIONS FOR ESTABLISHING AN IDENTITY ECOSYSTEM  GOVERNANCE STRUCTURE,” dated February of 2012, are available in PDF format at http://www.nist.gov/nstic/2012-nstic-governance-recs.pdf . 

NSTIC Lives To Fight Another Day: FierceGovernmentIT

On November 20th, 2011, David Perera wrote for FierceGovernmentIT on the status of NSTIC.  Again, NSTIC is a nifty idea for an "online identity ecosystem" that would allow for the transition away from passwords and towards better cybersecurity.  Thankfully, President Obama decided to fund NSTIC to the tune of $16.5 million dollars.  There was some worry about NSTIC's demise.  Perera noted that the program had requested $24.5 million.

Hopefully we'll hear a bit more about NSTIC now...

NSTIC Planning Proceeding Despite Uncertain Funding: FierceGovernment

On October 24th, 2011, David Perara wrote for FierceGovernment on how NSTIC should still move forward with pilot programs in the current fiscal year despite uncertain funding.  This was according to Jeremy Grant, the senior executive advisor of the National Institute of Standards and Technology (NIST).  The House of Representative's 2012 NIST appropriations bill would give the agency no money for NSTIC pilots, while the Senate version of the bill would fund the program with $24 million.  Grant assumed that the money for the NSTIC pilot program would still come through despite the funding concerns. 

The pilot program refers to an NIST program that will seek to experiment with the identity ecosystem in certain government and private sectors.  Grant intends to set up multiple pilot programs that span multiple sectors including banking, online commerce, and state government.  Grant hopes that various industrial sectors will bid on the NSTIC pilot programs, allowing those companies to demonstrate that the identity ecoystem, in miniature, is indeed feasible. 

The source article can be found here.

NSTIC Lays Out a Compelling Identity Ecosystem Vision: WindowsITPro

On October 13th, 2011, Sean Deuby wrote for WindowsITPro on how NSTIC works, the concept of the identity ecosystem, and possible issues that need to be addressed in order to make NSTIC a reality.  Noting that even though our use of the web for sensitive transactions has grown dramatically, there's still many online transactions we can't perform because of the question of identity.  Phishing malware attacks and news stories about hacking always leaves the question "Is this person who he says he is?"  Unfortunately, passwords just aren't cutting it anymore.  As Jeremy Grant, manager of the NSTIC program office, likes to say, “We think the password is fundamentally insecure and needs to be shot.”

This is where NSTIC and the Identity Ecosystem comes in.  The Identity Ecosystem is a user-centric online environment made up of a set of agreed upon standards, policies, and technologies that support transactions ranging from fully authenticated to anonymous and high or low value.  NSTIC isn't necessarily a national ID system, but more of an acknowledgment that secure transactions on the Internet need a common framework that both identity providers and service providers agree to work within.  Moreover, NSTIC isn't inventing any new technology, but rather, using existing technology like smart cards and digital certificates to create a network supporting trust IDs that can be used by all parties.  The identity ecosystem could allow the consumer to make secure online transactions by using a smartphone.

Of course, the successful implementation of NSTIC would be a boon for businesses; with more online security, consumers would be more likely to do their business online, and new areas of online business like online healthcare could open up.  Further, Mr. Deuby notes that NSTIC would also have to be voluntary: "consumers must have choices for who they want as an identity provider, and consumer demand will encourage more identity providers and service providers to join the ecosystem."  However, NSTIC comes with its drawbacks.  First,  an identity ecosystem is far from deployment.  Second, the concept of creating identities warehouses raises both privacy concerns and the prospect of "hyper-identity theft" if someone were able to break into an identity provider.  Even so, Mr. Deuby finds that NSTIC is a vision of how things should be; the private sector just has to step it up and figure out how to make it a reality.

The source article can be found here.

Your Online Driver’s License: NYT

On September 17th, 2011, Natasha Singer wrote for the New York Times about the National Strategy for Trusted Identities in Cyberspace (NSTIC).  Comparing NSTIC to a digital driver's license, Singer explained how NSTIC would make it so people have a simpler, safer way to prove who they are online with more than a flimsy password.  To do so, consumers would choose among trusted third parties — such as banks, technology companies or cellphone service providers — that verify certain personal information about them and issue them secure credentials to use in online transactions.  The system would allow Internet users to use the same secure credential on many Web sites; people could have their identity authenticator automatically confirm that they are old enough to sign up for Pandora without having to share their birthdate with Pandora.

However, authentication proponents and privacy advocates disagree about whether Internet IDs like NSTIC would actually heighten consumer protection.  Privacy advocates argue that identity verification online could make consumers more vulnerable because authentication companies would become "honey pots for hackers."  Lillie Coney, the associate director of the Electronic Privacy Information Center, noted that “You can have one key that opens every lock for everything you might need online in your daily life, or, would you rather have a key ring that would allow you to open some things but not others?”

However, Jeremy Grant (senior executive adviser for identity management at the National Institute of Standards and Technology) noted that no system is invulnerable.  Privacy concerns aside, better online identity authentication would improve the current situation where people use the same passwords for their e-mail, banking, and social network accounts.  Mr. Grant went on to compare weak security to flimsly locks on bathroom doors: “If we can get everyone to use a strong deadbolt instead of a flimsy bathroom door lock, you significantly improve the kind of security we have.”

The source article can be found here.

US could learn from Canadian identity management initiative: Network World

On September 2, 2011, Dave Keams wrote for Network World that the United States could learn a great deal from Canada's identity management initiative.  Mr. Keams argues that the Canadian initiative is smaller and more focused than the U.S. NSTIC initiative because it concentrates on government and citizen interactions. The US and Canadian ideas are generally the same, but differ in scale. 

The Canadian Treasury Board of Canada Secretariat recently released the final version of a document called "Federating Identity Management in the Government of Canada: A Backgrounder." It notes, "How identity information is collected, used, managed, and secured is of critical interest to leaders in the public sector charged with protecting the rights of citizens, ensuring privacy, and ensuring national security and public safety."

The study also sets out what it calls "Guiding principles for federating identity management":

• Achieve consensus through accepted, mutually respected assurances (of credential or identity), risk levels, and accountabilities.

• Respect program accountability.

• Let the citizen decide.

• Enable interoperability.

• Promote a fair and competitive marketplace.

Mr. Keams argues that  NSTIC should abide by these principles.

The Network World article can be found here.

***

 

NSTIC Identity Commandments handed down

The Jericho Forum, an IT security association dedicated to advancing secure business in a global open-network environment, recently handed down their "Identity Commandments" for the planning of an identity eco-system.   

In a Jericho Forum press release, Lord Eroll commented that “Jericho Forum builds on the work of NSTIC by providing an effective direction going forward.   The creation of a large centralized database containing key identifiers and information is far too dangerous. The private sector must avoid the Big Brother approach proposed in the now abandoned UK national ID card scheme. In the Jericho Forum Identity Commandments, ownership of essential personal data stays with the individual and cannot be compromised or exploited by any powerful player.”

The new Commandments "encompass all the “entities” – both human and digital – and promotes a comprehensive and complete view of identity entitlement and access management."    They are:

1. All core identities must be protected to ensure their secrecy and integrity.

2. Identifiers must be able to be trusted.

3. The authoritative source of identity will be the unique identifier or credentials offered by the persona representing that entity.

4. An Entity can have multiple, separate Persona (Identities) and related unique identifiers.

5. Persona must, in specific use cases, be able to be seen as the same.

6. The attribute owner is responsible for the protection and appropriate disclosure of the attribute.

7. Connecting attributes to persona must be simple and verifiable.

8. The source of the attribute should be as close to the authoritative source as possible.

9. A resource owner must define Entitlement (Resource Access Rules).

10. Access decisions must be relevant, valid and bi-directional.

11. Users of an entity’s attributes are accountable for protecting the attributes.

12. Principals can delegate authority to another to act on behalf of a persona.

13. Authorised Principals may acquire access to (seize) another entity’s persona.

14. A persona may represent, or be represented by, more than one entity.

The report concludes that a new identity eco-system holds the triple promise of "lower cost, higher security/trust, and increased flexibility" and will positively impact how the world innovates and trades.  However, the Jericho Forum believes that there is a major infastructure investment required to create the identity eco-system. 

***

See the bottom of the Commandments for a glossary/defined terms; the definitions can be a bit tricky.

 

CNET News on NSTIC and "Fixing the Web's trust issues"

While addressing larger issues of trust on the Internet, CNET's Dennis O'Reilly has this to say about the National Strategy for Trusted Identities in Cyberspace (NSTIC):

NSTIC is a noble effort that calls for creation of private trusted authorities to serve as go-betweens when consumers interact with Web services. The theory is that consumers will trust a third party with their private data, and the third party will assure the online vendor of the customer's authenticity.

The obvious question is who will pay to establish and maintain this proposed Identity Ecosystem?

via news.cnet.com

He examines pending federal legislation, but ultimately concludes that users are on their own for data protection, concluding: "After all, it's unlikely online vendors will voluntarily adopt privacy-protection practices, and we certainly can't wait for the cavalry to arrive."  To read his full article, follow this link.

The final NSTIC has a ten year expectation for full implementation.  That seems very long to me, given the rate of change in cyberspace.  I suspect that whatever means users ultimately adopt to establish identity will have been here and gone in that length of time.  The article by O'Reilly mentions expense, general government inefficiency, and privacy rights as obstacles to implementation. I agree that all of those are factors, and I believe that there are more.