Risk
10/15/2013
12:16 PM
50%
50%

Verizon Enhances Cloud-Based Identity Platform

Universal Identity Services 2.0 comes with an updated mobile app, QR code-enabled access, and a simplified end-user interface.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Verizon has added new capabilities to its cloud-based identity platform, offering government users a more secure system that goes beyond a username and password.

The platform, Universal Identity Services, combines a person's username and password with a one-time password or biometric scan, such as fingerprint recognition. Authenticated users can get access to online content and corporate resources -- and depending on the level of assurance, electronic medical records -- on computers, smartphones or tablets. Universal Identity Services runs in three secure data centers, and meets standards through the Health Insurance Portability and Accountability Act (HIPAA).

When it comes to government users, the benefits of cloud-based identity and access management are twofold, Tracy Hulver, senior identity strategist of Verizon Enterprise Solutions, said in a phone interview. "First, agencies want to make it easier and less expensive to validate employees and contractors. We can provide that two-factor authentication," said Hulver. "Second, what the government is really wrestling with is how to authenticate citizens. How can the government cut down on the number of credentials that citizens have, while keeping the costs down? The Affordable Care Act (ACA) online portal, for instance, is having problems getting people on and signed up with a username and password."

[ Want more on government security efforts? Read Energy Dept. Invests $30 Million In Utility Security. ]

One solution, Hulver said, is providing citizens with a single identity that they can use government-wide. Last December, Verizon teamed with Criterion Systems to develop a more secure online identity system. The National Institute of Standards and Technology (NIST) awarded $9 million to five pilot programs lead by teams of online-identity and technology providers in support of the National Strategy for Trusted Identities in Cyberspace (NSTIC). Verizon is one of two providers of high-assurance identity credentials on a pilot program.

NSTIC, a public-private initiative launched by the White House in 2011, aims to create cost-effective and easy-to-use "trust elevation," or validation efforts, for online credentials. With trust elevation, individuals would be able to use one set of credentials to access any site, including online banking and medical records. The system would use additional information to electronically validate a user, such as a fingerprint or a mobile phone number.

According to Hulver, Verizon, as a third-party identity provider, can scale to tens of thousands of users for a considerably smaller price point. The new features included in Verizon's Universal Identity Services are appealing to federal agencies looking for added security, he said. One such feature is Quick Response (QR) code-enabled access. Users can access a website using a unique QR code generated on a login screen, or scan a QR code as second-factor authentication on a smartphone.

The enhanced Universal Identity Services platform also includes an updated mobile app for the iOS, Android, Windows, and Blackberry operating systems; legally binding digital signature capabilities required for electronic prescriptions, online tax filing and license renewals; and a simplified end-user interface that provides administrators with an enhanced dashboard and operations reporting.

In addition to the new capabilities, Verizon has expanded the platform -- which was previously only offered in the U.S. -- to Europe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?