Risk
9/21/2012
02:26 PM
50%
50%

NIST Funds Trusted Identity Pilot Programs

National Institute of Standards and Technology programs are intended to create a trustworthy online environment for consumers and businesses, and for institutional transactions.

The National Institute of Standards and Technology has announced plans to award $9 million to five pilot programs as part of its National Strategy for Trusted Identities in Cyberspace.

NSTIC seeks to create a secure "identity ecosystem" for online transactions. The newly funded programs aim to improve consumer confidence in online transactions, prevent identity theft, and give people more control over their personal information.

The investments "will help protect our citizens from identity theft and other types of fraud, while helping our businesses, especially small businesses, reduce their costs," said NIST director Patrick Gallagher in statement on the grants.

The American Association of Motor Vehicle Administrators will implement a program, called the Cross Sector Digital Identity Initiative, to establish a secure online identity ecosystem. Its partners include AT&T, Biometric Signature ID, CA Technologies, Microsoft, and the Virginia Department of Motor Vehicles.

[ Federal intelligence agencies' venture investment firm In-Q-Tel looks to 10gen for data analysis. Read more at Intelligence Agency Invests In Big Data Management. ]

A team of companies led by Criterion Systems will let consumers share shopping and other online preferences and information. The pilot will pull together Web services from identity service providers, online auction services, financial services from Broadridge, supply chain management capabilities from General Electric, and first-response management at government agencies and health care service providers.

Grant recipient Daon will develop an identity ecosystem for senior citizens and other consumers that supports trusted interactions among multiple parties online. The pilot will include "user-friendly" identity technologies for smartphones and tablets. AARP is a partner in the program.

Resilient Network Systems plans to show how an encrypted "trust network" can be used for health and education transactions. On the education side, the pilot will demonstrate secure access to online learning for children that is compliant with the Family Educational Rights and Privacy Act and the Children's Online Privacy Protection Act.

Another grant recipient, the University Corporation for Advanced Internet Development, known as Internet2, will spearhead a program to build a privacy infrastructure that can serve communities. Brown University, Carnegie Mellon, Massachusetts Institute of Technology, University of Texas, and University of Utah are participating.

Cybersecurity, continuity planning, and data records management top the list in our latest Federal IT Priorities Survey. Also in the new, all-digital Focus On The Foundation issue of InformationWeek Government: The FBI's next-gen digital case management system, Sentinel, is finally up and running. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.