Risk
10/15/2013
12:16 PM
Connect Directly
RSS
E-Mail
50%
50%

Verizon Enhances Cloud-Based Identity Platform

Universal Identity Services 2.0 comes with an updated mobile app, QR code-enabled access, and a simplified end-user interface.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Verizon has added new capabilities to its cloud-based identity platform, offering government users a more secure system that goes beyond a username and password.

The platform, Universal Identity Services, combines a person's username and password with a one-time password or biometric scan, such as fingerprint recognition. Authenticated users can get access to online content and corporate resources -- and depending on the level of assurance, electronic medical records -- on computers, smartphones or tablets. Universal Identity Services runs in three secure data centers, and meets standards through the Health Insurance Portability and Accountability Act (HIPAA).

When it comes to government users, the benefits of cloud-based identity and access management are twofold, Tracy Hulver, senior identity strategist of Verizon Enterprise Solutions, said in a phone interview. "First, agencies want to make it easier and less expensive to validate employees and contractors. We can provide that two-factor authentication," said Hulver. "Second, what the government is really wrestling with is how to authenticate citizens. How can the government cut down on the number of credentials that citizens have, while keeping the costs down? The Affordable Care Act (ACA) online portal, for instance, is having problems getting people on and signed up with a username and password."

[ Want more on government security efforts? Read Energy Dept. Invests $30 Million In Utility Security. ]

One solution, Hulver said, is providing citizens with a single identity that they can use government-wide. Last December, Verizon teamed with Criterion Systems to develop a more secure online identity system. The National Institute of Standards and Technology (NIST) awarded $9 million to five pilot programs lead by teams of online-identity and technology providers in support of the National Strategy for Trusted Identities in Cyberspace (NSTIC). Verizon is one of two providers of high-assurance identity credentials on a pilot program.

NSTIC, a public-private initiative launched by the White House in 2011, aims to create cost-effective and easy-to-use "trust elevation," or validation efforts, for online credentials. With trust elevation, individuals would be able to use one set of credentials to access any site, including online banking and medical records. The system would use additional information to electronically validate a user, such as a fingerprint or a mobile phone number.

According to Hulver, Verizon, as a third-party identity provider, can scale to tens of thousands of users for a considerably smaller price point. The new features included in Verizon's Universal Identity Services are appealing to federal agencies looking for added security, he said. One such feature is Quick Response (QR) code-enabled access. Users can access a website using a unique QR code generated on a login screen, or scan a QR code as second-factor authentication on a smartphone.

The enhanced Universal Identity Services platform also includes an updated mobile app for the iOS, Android, Windows, and Blackberry operating systems; legally binding digital signature capabilities required for electronic prescriptions, online tax filing and license renewals; and a simplified end-user interface that provides administrators with an enhanced dashboard and operations reporting.

In addition to the new capabilities, Verizon has expanded the platform -- which was previously only offered in the U.S. -- to Europe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

Best of the Web
Dark Reading Radio